Question: How can I filter AWS DMS tasks by date?

I want to filter my AWS Database Migration Service (AWS DMS) tasks by date. How can I do that?

Answer: "I want to filter my AWS Database Migration Service (AWS DMS) tasks by date. How can I do that?ResolutionTo filter AWS DMS tasks by date, use table mappings. When entering your table mappings, the filter-operator parameter can have one of the following values:lte – less than or equal to one valueste – less than or equal to one value (lte alias)gte – greater than or equal to one valueeq – equal to one valuenoteq – not equal to one valuebetween – equal to or between two valuesnotbetween – not equal to or between two valuesThe following JSON example filter uses gte and date_of_record >= 2019-01-08.{  "rules": [    {      "rule-type": "selection",      "rule-id": "1",      "rule-name": "1",      "object-locator": {        "schema-name": "testonly",        "table-name": "myTable_test"      },      "rule-action": "include",      "filters": [        {          "filter-type": "source",          "column-name": "date_of_record",          "filter-conditions": [            {              "filter-operator": "gte",              "value": "2019-01-08"            }          ]        }      ]    }  ]}Note: When importing data, AWS DMS uses the date format YYYY-MM-DD and the time format YYYY-MM-DD HH:MM:SS for filtering.Related informationUsing table mapping to specify task settingsUsing source filtersFiltering by time and dateFollow"


Question: How do I configure CloudFront to forward the host header to the origin?

"The origin that's configured on my Amazon CloudFront distribution uses virtual hosting. Because of this, my distribution must forward the host header to my origin server. I want to configure my distribution to forward the host header."

Answer: "The origin that's configured on my Amazon CloudFront distribution uses virtual hosting. Because of this, my distribution must forward the host header to my origin server. I want to configure my distribution to forward the host header.Short descriptionTo configure your distribution to forward the host header to the origin, take one of the following actions:Create a cache policy and an origin request policy.Edit the settings of an existing behavior in the distribution.Important: For Amazon Simple Storage Service (Amazon S3) origins, caching that's based on the host header isn't supported. For more information, see Selecting the headers to base caching on.ResolutionCreate a cache policy and an origin request policyFollow the steps to create a cache policy using the CloudFront console.Under Cache key settings, for Headers, choose Include the following headers. From the Add header dropdown list, choose Host.Complete all other settings of the cache policy based on the requirements of the behavior that you're attaching the policy to, and then choose Create.After you create the cache policy, follow the steps to attach the policies to the relevant behavior of your CloudFront distribution.Edit the settings of an existing behaviorOpen the CloudFront console, and then choose your distribution.Choose the Behaviors tab, and then choose the path to forward the host header to.Choose Edit.Under Cache key and origin requests, confirm that Legacy cache settings is selected. If it's not selected, then follow the steps in the preceding section to create a cache policy. If Legacy cache settings is selected, then complete the following:For Headers, choose Include the following headers.From the Add header dropdown list, choose Host.Choose Save Changes.Related informationCaching content based on request headersWorking with policiesFollow"


Question: How can I be notified when changes are made to Route 53 hosted zone records?

How can I receive an email response with a custom notification when resource record sets are created or deleted from Amazon Route 53?

Answer: "How can I receive an email response with a custom notification when resource record sets are created or deleted from Amazon Route 53?Short descriptionYou can use a custom event pattern with an Amazon EventBridge or Amazon CloudWatch Events rule that triggers when ChangeResourceRecordSets API activity is logged in AWS CloudTrail. Then, route the response to an Amazon Simple Notification Service (Amazon SNS) topic.ResolutionIf you haven't already created an Amazon SNS topic with an email subscription, then follow the instructions for Getting started with Amazon SNS. This topic and subscription will be used later. This article breaks up the task into three parts:Create an EventBridge rule to match Route 53 API calls captured by CloudTrailAssociate the EventBridge rule with an SNS target for email notificationConfigure Input Transformer on the target so that the notification can be customized into a human-readable messageTo be notified when changes are made to Route 53 hosted zone records, follow all the steps for each task.Create an EventBridge RuleRoute 53 is an AWS global service that is available only in US East (N. Virginia). The EventBridge rule must be created in US East (N. Virginia).1.    Open the EventBridge console.2.    In the navigation pane, choose Rules, and then choose Create rule.3.    In Name and Description fields, enter a name and description for the rule. To receive events from AWS services, select Enable the rule on the selected eventbus.4.    Choose Rule with an event pattern. Then, choose Next.5.    Choose AWS Events or EventBridge partner events.6.    Under Event Pattern, choose the following:For Event Source, choose AWS servicesFor AWS service, choose Route 53For Event Type, choose AWS API Call via CloudTrail7.    Choose Specific Operation(s) and enter ChangeResourceRecordSets into the field. This will limit events to only match for create, delete, or updates to resource record sets.The following event pattern appears:{  "source": ["aws.route53"],  "detail-type": ["AWS API Call via CloudTrail"],  "detail": {    "eventSource": ["route53.amazonaws.com"],    "eventName": ["ChangeResourceRecordSets"]  }}8.    Choose Next to proceed to the next step.Associate SNS Target with EventBridge Rule1.     In the Target types section, choose AWS Service.2.    In the Select a target dropdown list, choose SNS topic.3.    In the Topic dropdown list, choose the SNS topic you created previously.Configure Input Transformer to Customize SNS NotificationBy default, EventBridge forwards the entire CloudTrail event to the target. The SNS topic then delivers a notification as unformatted JSON. This might be difficult to read and quickly understand the contents.By using the Input Transformer, specific fields in the inbound event can be selected and then integrated into a more human-readable message. The Input Path identifies the desired fields.For this example, the eventTime, hostedZone, username, and eventID are included in the notification. The fields can be changed to align with your use case. The Input Template contains the message body of the notification and placeholders that will be dynamically updated with the desired fields.1.    Expand the Additional settings dropdown list. In the Configure target input dropdown list, choose Input transformer.2.    Choose Configure input transformer.3.    In the Input path field, paste the following text:{    "eventTime": "$.detail.eventTime",    "hostedZone": "$.detail.requestParameters.hostedZoneId",    "userName": "$.detail.userIdentity.sessionContext.sessionIssuer.userName",    "eventID": "$.detail.eventID"}4.    In the Template field, paste the following text:"At <eventTime>, one or more Route 53 records within Hosted Zone <hostedZone> were modified by user <userName>. To view the event directly in your Event History and review these changes, use the following link. Note that the event may take up to 15 minutes to be available in your Event History: https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events?EventId=<eventID>"6.    Choose Confirm.7.    (Optional) Add tags to the EventBridge rule. Then, choose Next.8.    Review the rule configuration. Then, choose Create rule.After the rule is created, any changes to Route 53 resource sets will result in a notification similar to the following:"At 2022-08-16T21:02:46Z, one or more Route 53 records within Hosted Zone ZB3A123456789 were modified by user Admin. To view the event directly in your Event History and review these changes, use the following link. Note that the event may take up to 15 minutes to be available in your Event History: https://console.aws.amazon.com/cloudtrail/home?region=us-east-1#/events?EventId=04d08662-537e-4424-97c2-8bc796943b75"Related informationHow can I create a custom event pattern for an EventBridge rule?How do I set up human-readable EventBridge notifications for API calls using input transformer?Tutorial: Use input transformer to customize what EventBridge passes to the event targetTutorial: Log AWS API calls using EventBridgeFollow"


Question: How do I resolve WorkSpaces system errors by restoring or rebuilding my WorkSpace?

"Amazon WorkSpaces is failing, returning system errors, or failing while Windows is updating. How do I resolve these issues?"

Answer: "Amazon WorkSpaces is failing, returning system errors, or failing while Windows is updating. How do I resolve these issues?ResolutionYou can resolve critical errors or failures with your WorkSpace by using either the restore or rebuild feature. Restoring a WorkSpace is easier than rebuilding one, and it deletes less data in the process. Keep the following points in mind when deciding whether to restore or rebuild a WorkSpace:Restoring your WorkSpaceTo restore a WorkSpace, it must have a state of AVAILABLE, ERROR, UNHEALTHY, or STOPPED. A WorkSpace in the REBOOTING state cannot be restored.To restore a WorkSpace, you must have snapshots of both the root volume and user volume.When you restore a WorkSpace, both the root volume and user volume are recreated from the most recent healthy snapshot.To restore your WorkSpace, then follow the instructions at Restore a WorkSpace.Rebuilding your WorkSpaceTo restore a WorkSpace, it must have a state of AVAILABLE, ERROR, UNHEALTHY, STOPPED, or REBOOTING.To rebuild a WorkSpace, you must have a snapshot of the user volume.When you rebuild a WorkSpace, it is restored to the most recent image of the bundle that the WorkSpace was launched from. Any modifications made after the WorkSpace was launched from the image (custom system settings, installed applications) are lost.Because automatic snapshots of the D: drive are taken every 12 hours, you might be able to preserve the contents of the D: drive by rebooting the WorkSpace, waiting 12 hours, and then rebuilding the WorkSpace.Note: The file structure of an application installed to the D: drive will be restored, but if it was installed after the Workspace was launched, the application will require reinstallation.To rebuild your WorkSpace, then follow the instructions at Rebuild a WorkSpace.Related informationAdminister your WorkSpacesFollow"


Question: How does EKS Anywhere cluster bootstrapping work?

I want to understand the bootstrapping process for Amazon Elastic Kubernetes Service (Amazon EKS) Anywhere.

Answer: "I want to understand the bootstrapping process for Amazon Elastic Kubernetes Service (Amazon EKS) Anywhere.ResolutionThe bootstrap clusterWhen you create an initial standalone cluster or management cluster, Amazon EKS Anywhere also creates a bootstrap cluster. This is a temporary, single node Kubernetes in Docker (KinD) cluster that's created on a separate Administrative machine to facilitate your main cluster's creation.EKS Anywhere creates a bootstrap cluster on the Administrative machine that hosts CAPI and CAPX operators. To create the bootstrap cluster, EKS Anywhere must complete the following steps:Pull the KinD node imagePrepare the nodeWrite the configurationStart the control planeInstall the CNIInstall the StorageClass on the KinD-based single node clusterCluster creationWhen the bootstrap cluster is running and properly configured on the Administrative machine, the creation of the target cluster begins. EKS Anywhere uses kubectl to apply a target cluster configuration in the following process:1.    After etcd, the control plane, and the worker nodes are ready, the target cluster receives its networking configuration.2.    The target cluster receives its default storage class installation.3.    CAPI providers are configured on the target cluster. This allows the target cluster to control and run the components that it needs to manage itself.4.    After CAPI runs on the target cluster, CAPI objects are moved from the bootstrap cluster to the target cluster's CAPI service. This happens internally with the clusterctl command.5.    The target cluster receives Kubernetes CRDs and other add-ons that are specific to EKS Anywhere.6.    The cluster configuration is saved.The bootstrapping process creates a YAML file that's located in CLUSTER_NAME/generated/CLUSTER_NAME-eks-a-cluster.yaml.When boostrapping succeeds, this YAML file moves to CLUSTER_NAME/CLUSTER_NAME-eks-a-cluster.yamlSimilarly, Kubeconfig moves from CLUSTER_NAME/generated/CLUSTER_NAME.kind.kubeconfig to CLUSTER_NAME/CLUSTER_NAME-eks-a-cluster.kubeconfig.When etcd, the control plane, and the worker nodes are ready, the workload cluster receives its networking configuration. When the cluster is active and the CAPI service is running on the new cluster, the bootstrap cluster is no longer needed. Then, the service deletes the bootstrap cluster.Package workflowsDuring the bootstrapping process, EKS Anywhere uses the following logic in its workflows for the target cluster creation, cluster upgrade, and cluster deletion.Cluster creationFor the full package workflow during cluster creation, see create.go on GitHub. During this workflow, EKS Anywhere uses the following logic:Setups and validationsNote: If this step fails, then either preflights failed or the registry isn't set up properly.Create a new bootstrap clusterCreate a new KinD clusterProvider specific pre-capi-install-setup on the bootstrap clusterInstall cluster-api providers on bootstrap clusterProvider specific post-setupCreate a new workload clusterWait for external etcd to be readyWait for control plane to become availableWait for workload kubeconfig generationInstall networking the on workload clusterInstall machine health checks on the bootstrap clusterWait for control plane and worker machines to be readyInstall resources on managementInstall the eks-a components taskInstall the Git ops managerMove cluster managementWrite ClusterConfigDelete the bootstrap clusterInstall curated packagesCluster upgradeFor the full package workflow during a cluster upgrade, see upgrade.go on GitHub. During this workflow, EKS Anywhere uses the following logic:Setups and validationsUpdate secretsVerify etcd CAPI components existUpgrade core componentsVerify the needed upgradePause eks-a reconciliationCreate the bootstrap clusterInstall CAPIMove management to the bootstrap clusterMove management to the workload clusterUpgrade the workload clusterDelete the bootstrap clusterUpdate the workload cluster and Git resourcesResume eks-a reconciliationWrite ClusterConfigCluster deletionFor the full package workflow during a cluster's deletion, see delete.go on GitHub. During this workflow, EKS Anywhere uses the following logic:Setups and validatationsCreate a management clusterInstall CAPIMove cluster managementDelete the workload clusterClean up the Git repositoryDelete package resourcesDelete the management clusterErrors during cluster creationIf you encounter issues or errors, then look for logs in the Administrative machine and the capc-controller-manager. View the capc-controller-manager logs with kubectl in the capc-system namespace. For further troubleshooting, check the status of the CAPI objects for your cluster, located in the eksa-system namespace.You might also find related information on errors in the logs of other CAPI managers, such as capi-kubeadm-bootstrap-controller, capi-kubeadm-control-plane-controller and capi-controller-manager. These managers work together, and you can locate each in their own namespace with the kubectl get pods -A command. For more information, see the troubleshooting guide for EKS Anywhere.For a script to fix linting errors during the bootstrapping process, see bootstrapper.go on GitHub.Related informationKinD quick start (on the KinD website)Cluster creation workflowFollow"


Question: Why am I being billed for Elastic IP addresses when all my Amazon EC2 instances are terminated?

"I terminated all my Amazon Elastic Compute Cloud (Amazon EC2) instances, but I'm still billed for Elastic IP addresses. The Amazon EC2 On-Demand pricing page says that Elastic IP addresses are free. Why am I being billed?"

Answer: "I terminated all my Amazon Elastic Compute Cloud (Amazon EC2) instances, but I'm still billed for Elastic IP addresses. The Amazon EC2 On-Demand pricing page says that Elastic IP addresses are free. Why am I being billed?ResolutionAn Elastic IP address doesn’t incur charges as long as all the following conditions are true:The Elastic IP address is associated with an EC2 instance.The instance associated with the Elastic IP address is running.The instance has only one Elastic IP address attached to it.The Elastic IP address is associated with an attached network interface. For more information, see Network interface basics.Note: If the address is from a BYOIP address pool, then you're never charged for that address.You're charged by the hour for each Elastic IP address that doesn't meet these conditions. For pricing information, see Elastic IP addresses on the Amazon EC2 pricing page.To see the Elastic IP addresses that are provisioned to your account, open the Amazon EC2 console, and then choose Elastic IPs in the navigation pane.If you don’t need an Elastic IP address, you can stop the charges by releasing the IP address.Note: When you release the IP address, it might be provisioned automatically by another AWS account. You might be able to recover that same Elastic IP address again later, but only if no one else is using it.If you receive an error when you try to release an Elastic IP address from your Amazon EC2 instance, see How do I resolve the error "The address with allocation id cannot be released because it is locked to your account" when trying to release an Elastic IP address from my Amazon EC2 instance?Related informationElastic IP addressesFollow"


Question: Why does the "blended" annotation appear on some line items in my AWS bill?

I want to understand why some of the line items on my AWS bill have the "blended" annotation on them.

Answer: "I want to understand why some of the line items on my AWS bill have the "blended" annotation on them.ResolutionFor billing purposes, AWS treats all accounts in an organization as if they're one account. The pricing tiers and capacity reservations of the accounts in the organization are combined into one consolidated bill. Combining the accounts into consolidated billing can lower the effective price per hour for some services.This effective price per hour is displayed as the "blended" rate in your Cost and Usage Reports or AWS Cost Explorer. The blended rate that's shown in the console is for informational purposes only. For more information, see Blended rates and costs.An organization's management account can restrict the pricing benefit of Amazon Elastic Compute Cloud (Amazon EC2) Reserved Instances to the accounts that they’re purchased on. To restrict the pricing benefit of Amazon EC2 Reserved Instances, see Turning off shared Reserved Instances and Savings Plans discounts.Related informationWhat is AWS Billing?Understanding consolidated billsFollow"


Question: How do I prevent "rate exceeded" ThrottlingException errors when I run monitoring scripts in Amazon EMR?

"To monitor my Amazon EMR clusters, I run scripts that make API calls. The scripts return errors similar to the following:"Rate exceeded (Service: AmazonElasticMapReduce; Status Code: 400; Error Code: ThrottlingException; Request ID: e2b6191c-gkl5-269r-u735-cryyz251a837)"How do I prevent "rate exceeded" errors?"

Answer: "To monitor my Amazon EMR clusters, I run scripts that make API calls. The scripts return errors similar to the following:"Rate exceeded (Service: AmazonElasticMapReduce; Status Code: 400; Error Code: ThrottlingException; Request ID: e2b6191c-gkl5-269r-u735-cryyz251a837)"How do I prevent "rate exceeded" errors?Short descriptionAmazon EMR throttles API calls to maintain system stability. Throttling exceptions usually occur when you run monitoring scripts at regular intervals to check clusters for a parameter. Here's an example: calling DescribeCluster every 60 seconds to check if the cluster has reached the WAITING state. The more clusters that you have and the more monitoring scripts that you run, the more likely you are to get throttling errors.ResolutionTo prevent throttling errors:Reduce the frequency of the API calls.Stagger the intervals of the API calls so that they don't all run at the same time.Implement exponential backoff when making API calls.Consider moving to an event-based architecture.To understand the source of throttling errors, use AWS CloudTrail to track Event History. CloudTrail can help identify event details such as the following:Frequent API callsRate exceeded errors and their related API callsWhether API calls are triggered by users or automationRelated informationCommon errorsManaging and monitoring API throttling in your workloadsHow CloudTrail worksFollow"


Question: How do I run an AWS Batch job using Java?

I want to run AWS Batch jobs using Java. How do I set that up?

Answer: "I want to run AWS Batch jobs using Java. How do I set that up?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.Prepare your environment1.    Install Java by following the download instructions on the Oracle website.2.    Install Eclipse by following the download instructions on the Eclipse Foundation website.3.    Create an AWS Batch compute environment, job definition, and job queue.4.    Verify that the job queue is assigned to a valid compute environment by running the following describe-compute-environments AWS CLI command:Important: Replace your-compute-env-name with your compute environment's name.$ aws batch describe-compute-environments --compute-environments your-compute-env-name5.    Verify that the "status" value in the command output is "VALID". If your compute environment isn't valid, make the compute environment valid before continuing.Note: You can use Java code to create an AWS Batch compute environment, job definition, and job queue. However, you must complete the steps in the Convert the Java project to a Maven project section before creating the resources. For more information, see the sample code from the AWS SDK for Java API Reference.Install the AWS Toolkit for Eclipse1.    Open the Eclipse Integrated Development Environment (IDE).2.    From the Eclipse IDE menu bar, choose Help.3.    Under Help, choose Eclipse Marketplace.4.    In Eclipse Marketplace, choose the Search tab.5.    In the Find search box, enter AWS.6.    From the search results, choose Install for AWS Toolkit for Eclipse.7.    From the Eclipse menu bar, choose Navigate.8.    Choose Preferences. Then, choose Add Access Key ID and Secret Access key.Create a new Java project1.    From the Eclipse IDE menu bar, choose File.2.    Choose New. Then, choose Project.Convert the Java project to a Maven project1.    In the Eclipse IDE, right-click the Java project that you created.2.    Choose Configure. Then, choose Convert to Maven Project. Maven creates a POM.xml file that contains information about the project and the configuration details used to build the project.3.    Add the required dependencies to the POM.xml file by adding the following code after the closing build tag in the file:<!-- https://mvnrepository.com/artifact/com.amazonaws/aws-java-sdk-batch -->    <dependencies>    <dependency>    <groupId>com.amazonaws</groupId>    <artifactId>aws-java-sdk-batch</artifactId>    <version>1.11.470</version></dependency>    </dependencies>Important: The code for step 3 works only if you include the code after the closing build tag in the POM.xml file.Create a Java program to submit AWS Batch jobs1.    In the Eclipse IDE, choose the project that you created.2.    Inside the project, right-click the src folder.3.    Choose New. Then, choose File.4.    Name the new file BatchClient.java.Important: The .java extension name must match with the public class name in the Java program.5.    Add your AWS Batch environment details to the BatchClient.java file by entering the following code into the file:Important: Replace new-queue with your queue name. Replace us-east-1 with the AWS Region that your environment is in. Replace sleep30:4 with your job definition.public class BatchClient {public static void main(String[] args) {        AWSBatch client = AWSBatchClientBuilder.standard().withRegion("us-east-1").build();SubmitJobRequest request = new SubmitJobRequest().withJobName("example").withJobQueue("new-queue").withJobDefinition("sleep30:4");SubmitJobResult response = client.submitJob(request);System.out.println(response);}}6.    To submit the AWS Batch job and run the Java program, choose Run from the Run menu.Note: If you receive a "SubmitJobResult can not be resolved" error, then you must import the package required for the SubmitJobResult API action. To import the package in the Eclipse IDE, do the following:In the Java code BatchClient.java, select the SubmitJobResult.Right-click Choose.Choose Source.Choose Add import.Follow"


Question: How do I configure and attach an internet gateway for use with Elastic Load Balancing?

Answer: "How do I configure and attach an internet gateway for use with Elastic Load Balancing?ResolutionFirst, create an internet gateway and attach it to your Amazon Virtual Private Cloud (Amazon VPC).Next, configure the internet gateway to route traffic to and from the internet:Add an entry to the route table for your subnet that points to your internet gateway.Confirm that your Amazon VPC's security groups and network access control list (ACL) allow traffic to and from the internet. For example configurations for network ACLs, see Network ACL rules  .Confirm that any instances that route traffic through the internet gateway have a public IP address or an attached Elastic IP address.If you're creating a new load balancer, choose an internet-facing load balancer.Related informationInternet-facing Classic Load BalancersFollow"


Question: How do I configure routing for my Direct Connect private virtual interface?

I created a private virtual interface (VIF) in AWS Direct Connect. How do I check if I'm routing properly over my Direct Connect connection?

Answer: "I created a private virtual interface (VIF) in AWS Direct Connect. How do I check if I'm routing properly over my Direct Connect connection?ResolutionAfter you create your private virtual interface, do the following to verify that routing is set up correctly.Verify that the virtual private gateway associated with your private virtual interface is attached to the correct Amazon Virtual Private Cloud (Amazon VPC):Sign in to the Direct Connect console.In the navigation pane, choose Virtual Interfaces.Choose the virtual interface (VIF), and then choose View details.For private VIFs attached to a virtual gateway (VGW), in General configuration choose the VGW ID.If the virtual gateway isn't attached to your VPC, follow the instructions to attach it.For private VIFs attached to a Direct Connect gateway, in General configuration choose the gateway ID.In Gateway associations, verify the Direct Connect gateway is attached to your virtual gateway.Confirm that the allowed prefixes contains the VPC CIDR.Verify that you're advertising and receiving the correct routes through Border Gateway Protocol (BGP). For more information, see Routing policies and BGP communities.Be sure that you're advertising routes to AWS that cover the networks that are communicating with your VPC.Be sure that you're receiving the VPC CIDR route from AWS.Verify that you've enabled route propagation to your subnet route tables. This step propagates the routes learned through VPN connections and Direct Connect virtual interfaces to your VPC route tables. Any changes to the routes are updated dynamically, and you don't need to manually enter or update routes.Verify that your security groups allow traffic from your local network.Sign in to the VPC console.In the navigation pane under Security, choose Security Groups.In the content pane, select the security group that's associated with your instances.Choose the Inbound Rules view.Be sure that there are rules permitting traffic from your local network over the desired ports.Choose the Outbound Rules view.Be sure that there are rules permitting traffic to your local network over the desired ports.Verify that your network access control lists (ACLs) allow traffic from your local network.Sign in to the VPC console.In the navigation pane under Security, choose Network ACLs.In the content pane, select the network ACL that's associated with your VPC and subnets.Choose the Inbound Rules view.Be sure that there are rules permitting traffic from your local network over the desired ports.Choose the Outbound Rules view.Be sure that there are rules permitting traffic to your local network over the desired ports.Verify that your Direct Connect private virtual interface is traversable using the ping utility. Security groups, network ACLs, and on-premises security allow for bidirectional connectivity tests using ping.Related informationWhich type of virtual interface should I use to connect different resources in AWS?My virtual interface BGP status For Direct Connect is down in the AWS console. What should I do?Follow"


Question: How can I add certificates for multiple domains to a load balancer using AWS Certificate Manager?

I want to upload multiple certificates for different domains using Elastic Load Balancing (ELB).

Answer: "I want to upload multiple certificates for different domains using Elastic Load Balancing (ELB).Short descriptionAs of April 2018, Classic Load Balancer doesn't support adding multiple certificates.To add multiple certificates for different domains to a load balancer, do one of the following:Use a Subject Alternative Name (SAN) certificate to validate multiple domains behind the load balancer, including wildcard domains, with AWS Certificate Manager (ACM).Use either an Application Load Balancer (ALB) or Network Load Balancer (NLB), which supports multiple certificates and smart certificate selection using Server Name Indication (SNI).Note: ACM certificates can't be downloaded, and are used only with AWS services integrated with ACM.ResolutionTo use a Classic Load Balancer, follow these steps to create a SAN certificate using ACM.Open the ACM console.Note: If you've never created a certificate, choose Get started.Follow the instructions for Requesting a public certificate.In the ACM console, verify that the Status of the certificate request has changed from Pending validation to Issued.Attach the certificate to a load balancer. For instructions, see Replace the SSL certificate for your Classic Load Balancer.To add multiple certificates with an ALB, see Application Load Balancers now support multiple TLS certificates with smart selection using SNI.To add multiple certificates with an NLB, see Elastic Load Balancing: Network Load Balancers now support multiple TLS certificates using Server Name Indication (SNI).Note: The ALB and NLB certificate quota limit is 25 (excluding default certificates). This limit can be increased. For more information, see Quotas for your Application Load Balancers and Quotas for your Network Load Balancers.Related informationAWS Certificate Manager FAQsEmail validationDNS validationFollow"


Question: What's the source IP address of the traffic that Elastic Load Balancing sends to my web servers?

I'm using Elastic Load Balancing for my web servers. I want to know the IP address that the load balancer uses to forward traffic to my web servers.

Answer: "I'm using Elastic Load Balancing for my web servers. I want to know the IP address that the load balancer uses to forward traffic to my web servers.Short descriptionYou can determine the IP addresses associated with an internal load balancer or an internet-facing load balancer by resolving the DNS name of the load balancer. These are the IP addresses where the clients should send the requests that are destined for the load balancer. However, Classic Load Balancers and Application Load Balancers use the private IP addresses associated with their elastic network interfaces as the source IP address for requests forwarded to your web servers. For Network Load Balancers, the source IP address of these requests depends on the configuration of its target group.These IP addresses can be used for various purposes, such as allowing the load balancer traffic on the web servers and for request processing. It's a best practice to use security group referencing on the web server's security group inbound rules for allowing load balancer traffic from Classic Load Balancers or Application Load Balancers. However, because Network Load Balancers don't support security groups, then based on the target group configurations, the IP addresses of the clients or the private IP addresses associated with the Network Load Balancers must be allowed on the web server's security group.ResolutionImportant: The IP addresses for Classic Load Balancers and Application Load Balancers change over time. Avoid using this information to statically configure your applications to point to these IP addresses.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.Find private IP addresses associated with load balancer elastic network interfaces using the AWS Management Console1.    Open the Amazon Elastic Compute Cloud (Amazon EC2) console.2.    Under Load Balancing, choose Load Balancers from the navigation pane.3.    Select the load balancer that you're finding the IP addresses for.4.    On the Description tab, copy the Name.5.    Under Network & Security, choose Network Interfaces from the navigation pane.6.    Paste the load balancer name that you copied in step 4 in the search box. The filtered results show all elastic network interfaces associated with the load balancer.7.    For each of the elastic network interfaces in the filtered results:Select the elastic network interface.Choose the Details tab.Find the interface that contains an IP address for Primary private IPv4 IP. This is the primary private IP address of the elastic network interface.Find private IP addresses associated with load balancer elastic network interfaces using the AWS CLIRun the following command:aws ec2 describe-network-interfaces --filters Name=description,Values="ELB elb-name" --query 'NetworkInterfaces[*].PrivateIpAddresses[*].PrivateIpAddress' --output textReplace elb-name with one of the following:For Classic Load Balancers: Name of the load balancerFor Application Load Balancers: app/load-balancer-name/load-balancer-idFor Network Load Balancers: net/load-balancer-name/load-balancer-idFor Application Load Balancers and Network Load Balancers, use the following command to find the load-balancer-id:aws elbv2 describe-load-balancers --names load-balancer-nameThe load-balancer-id is the last field of characters that follows the trailing slash after the load balancer's name in the ARN.Follow"


Question: How do I troubleshoot "S3 write failed for bucket" 403 Access Denied errors from Amazon S3 when creating resource data sync for Systems Manager inventory?

I want to troubleshoot 403 Access Denied errors from Amazon Simple Storage Service (Amazon S3) when creating a resource data sync.

Answer: "I want to troubleshoot 403 Access Denied errors from Amazon Simple Storage Service (Amazon S3) when creating a resource data sync.ResolutionThere are two methods for configuring resource data sync for AWS Systems Manager inventory:Create a resource data sync for multiple accounts within the same organization.Create a resource data sync for multiple accounts that aren't within the same organization.To resolve S3 write failed for bucket errors, do the following:Troubleshooting for multiple accounts within the same organizationMake sure that the central Amazon S3 bucket policy has the required permissions to allow multiple AWS accounts to send inventory data to the bucket.To create a resource data sync for multiple accounts within the same organization, use the CreateResourceDataSync API and be sure to specify the DestinationDataSharing parameter. From AWS CloudTrail, you can check the API request for event name CreateResourceDataSync to confirm the DestinationDataSharing parameter is included in the event.Note: You can't create a resource data sync from the AWS Management Console when the resource data sync is for multiple accounts within the same organization.The following is an example AWS Command Line Interface (AWS CLI) command for CreateResourceDataSync:aws ssm create-resource-data-sync --sync-name name --s3-destination "BucketName=DOC-EXAMPLE-BUCKET,Prefix=prefix-name,SyncFormat=JsonSerDe,Region=AWS Region ID,DestinationDataSharing={DestinationDataSharingType=Organization}"Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Troubleshooting for multiple accounts that aren't within the same organizationTo create a resource data sync, confirm that the S3 bucket policy of the target S3 bucket allows the required actions from the source account.For example, you have Account A and Account B sending the inventory data to an S3 bucket in Account C.The S3 bucket policy in Account C is similar to the following example policy:{               "Version": "2012-10-17",      "Statement": [          {              "Sid": "SSMBucketPermissionsCheck",              "Effect": "Allow",              "Principal": {                   "Service": "ssm.amazonaws.com"                },              "Action": "s3:GetBucketAcl",              "Resource": "arn:aws:s3:::S3_bucket_name"           },           {               "Sid": " SSMBucketDelivery",               "Effect": "Allow",               "Principal": {                   "Service": "ssm.amazonaws.com"               },               "Action": "s3:PutObject",               "Resource": [                   "arn:aws:s3:::S3_bucket_name/*/accountid=AWS_AccountA_ID/*",                   "arn:aws:s3:::S3_bucket_name/*/accountid=AWS_AccountB_ID/*"             ],             "Condition": {                 "StringEquals": {                     "aws:SourceAccount": [                         "AWS_AccountA_ID",                         "AWS_AccountB_ID"                      ],                      "s3:x-amz-acl": "bucket-owner-full-control"                  },                  "ArnLike": {                     "aws:SourceArn": [                          "arn:aws:ssm:*:AWS_AccountA_ID:resource-data-sync/*",                          "arn:aws:ssm:*:AWS_AccountB_ID:resource-data-sync/*"                     ]                  }             }          }     ]  }  Note: To encrypt the resource data sync, be sure to update the AWS Key Management Service (AWS KMS) key policy and S3 bucket policy. For more information, see Walkthrough: Use resource data sync to aggregate inventory data.Follow"


Question: Is my application impacted by the migration of Amazon S3 and Amazon CloudFront certificates to Amazon Trust Services?

My application might be impacted by the migration of Amazon Simple Storage Service (Amazon S3) and Amazon CloudFront certificates to Amazon Trust Services. I want to verify that the Amazon Trust Services Certificate Authorities (CAs) are in my trust store.

Answer: "My application might be impacted by the migration of Amazon Simple Storage Service (Amazon S3) and Amazon CloudFront certificates to Amazon Trust Services. I want to verify that the Amazon Trust Services Certificate Authorities (CAs) are in my trust store.Short descriptionAs of March 23, 2021, AWS will start migrating the Secure Sockets Layer/Transport Layer Security (SSL/TLS) CA for Amazon S3 and CloudFront from DigiCert to Amazon Trust Services.Application traffic that matches any of the following scenarios isn't impacted by this migration:HTTP trafficHTTPS traffic to CloudFront using custom domains and certificatesHTTPS traffic to S3 buckets in AWS Regions where S3 is already using Amazon Trust Services for its certificates (eu-west-3, eu-north-1, me-south-1, ap-northeast-3, ap-east-1, or us-gov-east-1)ResolutionYou must confirm that your applications trust Amazon Trust Services as a CA if either of the following is true:You send HTTPS traffic directly to S3 buckets in Regions that aren't listed above.You send HTTPS traffic to CloudFront domains that are covered by *.cloudfront.net.If you use other AWS services, your application might already trust Amazon Trust Services. Many AWS services, such as Amazon Elastic Compute Cloud (Amazon EC2) and Amazon DynamoDB, already migrated their CAs.Certificates issued by Amazon Trust Services are already included in trust stores across most web browsers, operating systems, and applications. You might not need to update your configurations to handle the migration, but there are exceptions. If you build custom certificate trust stores or use certificate pinning, then you might need to update your configurations. If Amazon Trust Services isn't in your trust store, you'll see error messages in browsers (see Example) and applications.To verify if Amazon Trust Services is in your trust store, run one of following tests from the system that you're using to connect to an Amazon S3 or CloudFront endpoint:Retrieve a test object from this test URL. Then, verify that you are either getting a 200 response or seeing the green check mark in the test image.Create an Amazon S3 bucket in one of the following AWS Regions: eu-west-3, eu-north-1, me-south-1, ap-northeast-3, ap-east-1, or us-gov-east-1. (S3 buckets in these Regions already use Amazon Trust Services certificates.) Then, retrieve a test object from the bucket over HTTPS.If any of these tests are successful, then your client is ready for migration to Amazon Trust Services.To verify that each of the four root CAs of Amazon Trust Services are included in your trust store, do the following:Choose each Test URL in the list of Amazon Trust Services certificates.Verify that the Test URLs work for you.For this migration, your application doesn't need to trust the Amazon Trust Services' root CAs directly. It's sufficient if your application trusts the Starfield Services Root CA. Amazon S3 and CloudFront will present certificate chains with an Amazon root CA that's cross-signed by the Starfield Service Root CA.If any of the first two tests fail, then the Amazon Trust Services CAs aren't in your trust store. Update your trust store to include the Amazon Trust Services CAs by doing one or more of the following:Upgrade your operating system or web browser.Update your application to use CloudFront with a custom domain name and your own certificate.If your application is using a custom trust store, then you must add the Amazon root CAs to your application's trust store.If you're using certificate pinning to lock down the CAs that you trust, then you must adjust your pinning to include the Amazon Trust Services CAs.Most AWS SDKs and AWS Command Line Interfaces (AWS CLIs) aren't impacted by the migration. But if you're using a version of the Python AWS SDK or AWS CLI released before October 29, 2013, then you must upgrade your certificates.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Related informationHow to prepare for AWS move to its own Certificate AuthorityFollow"


Question: What are common issues that might occur when using native backup and restore in RDS for SQL Server?

I'm performing a native backup or restore for my Amazon Relational Database Service (Amazon RDS) for Microsoft SQL Server instance. What are common errors that I might encounter during this process?

Answer: "I'm performing a native backup or restore for my Amazon Relational Database Service (Amazon RDS) for Microsoft SQL Server instance. What are common errors that I might encounter during this process?ResolutionWhen using the RDS for SQL Server native backup and restore option, you might encounter validation errors. These errors are displayed immediately, and a task isn't created. The following are common errors and suggested fixes:Error: Aborted the task because of a task failure or a concurrent RESTORE_DB requestThis error occurs if you have space-related issues on the DB instance when restoring the backup from Amazon Elastic Compute Cloud (Amazon EC2) or on-premises:[2022-04-07 05:21:22.317] Aborted the task because of a task failure or a concurrent RESTORE_DB request.[2022-04-07 05:21:22.437] Task has been aborted[2022-04-07 05:21:22.440] There is not enough space on the disk to perform restore database operation.To resolve this error, do the following:Option 1:1.    Run the following command on the source instance (EC2 or on-premises). This command verifies the size of the database, including the data file and Tlog file. In the following example, replace [DB_NAME] with the name of your database.SELECT DB_NAME(database_id) AS DatabaseName,Name AS Logical_Name,Physical_Name, (size*8)/1024/1024 SizeGBFROM sys.master_filesWHERE DB_NAME(database_id) = '[DB_NAME]'GODatabase Size = (DB_Name size + DB_Name_Log size)2.    Compare the source instances data base size with the available storage on the DB instance. Increase the available storage accordingly and then restore the database.Option 2:Shrink the current DB log file on the source SQL Server to clear up unused space, and then perform the database backup.Use the following command to shrink the log file.DBCC SHRINKFILE (LogFileName, Desired Size in MB)Error: Aborted the task because of a task failure or a concurrent RESTORE_DB requestThe following error occurs when you have permission issues related to the AWS Identity and Access Management (IAM) role or policy associated with the SQLSERVER_BACKUP_RESTORE option:[2020-12-15 08:56:22.143] Aborted the task because of a task failure or a concurrent RESTORE_DB request.[2020-12-15 08:56:22.213] Task has been aborted[2020-12-15 08:56:22.217] Access DeniedTo resolve this error, do the following:1.    Verify the restore query to make sure that the S3 bucket and the folder prefix are correct:exec msdb.dbo.rds_restore_database      @restore_db_name='database_name',      @s3_arn_to_restore_from='arn:aws:s3:::bucket_name/file_name_and_extension';2.    Verify that the IAM policy includes the following attributes:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:ListBucket",        "s3:GetBucketLocation"      ],      "Resource": "arn:aws:s3:::bucket_name"    },    {      "Effect": "Allow",      "Action": [        "s3:GetObjectAttributes",        "s3:GetObject",        "s3:PutObject",        "s3:ListMultipartUploadParts",        "s3:AbortMultipartUpload"      ],      "Resource": "arn:aws:s3:::bucket_name/*"    }  ]}Note: Replace arn:aws:s3:::bucket_name with the ARN of your S3 bucket.3.    Verify that the policy is correctly associated with the role given in the SQLSERVER_BACKUP_RESTORE option.4.    Verify that the SQLSERVER_BACKUP_RESTORE option is the option group associated with the DB instance:S3 Bucket ARNS3 folder prefix (Optional)For more information, see How do I perform native backups of an Amazon RDS DB instance that's running SQL Server?Error: Aborted the task because of a task failure or a concurrent RESTORE_DB requestThis error is commonly associated with cross account database restore.Example:Account A has an S3 bucket where the backup is stored.Account B has an RDS DB instance where the restore needs to be done.The error occurs when you have permission-related issues in an IAM role or policy associated with the option. Or, there is a permissions issue with the bucket policy associated with the S3 bucket in the cross account.[2022-02-03 15:57:22.180] Aborted the task because of a task failure or a concurrentRESTORE_DB request.[2022-02-03 15:57:22.260] Task has been aborted[2022-02-03 15:57:22.263] Error making request with Error Code Forbidden and Http Status Code Forbidden. No further error information was returned by the service.To resolve this error, do the following:1.    Verify that the IAM policy in Account B (the account where the DB instance that you will be restoring to is located) includes the following attributes:{  "Version": "2012-10-17",  "Statement":    [      {        "Effect": "Allow",        "Action":          [            "s3:ListBucket",            "s3:GetBucketLocation"          ],        "Resource": "arn:aws:s3:::name_of_bucket_present_in_Account_A"      },      {        "Effect": "Allow",        "Action":          [            "s3:GetObject",            "s3:PutObject",            "s3:ListMultipartUploadParts",            "s3:AbortMultipartUpload"          ],        "Resource": "arn:aws:s3::: name_of_bucket_present_in_Account_A /*"      },      {        "Action": [          "kms:DescribeKey",          "kms:GenerateDataKey",          "kms:Decrypt",          "kms:Encrypt"          "kms:ReEncryptTo",          "kms:ReEncryptFrom"        ],        "Effect": "Allow",        "Resource": [          "arn:aws: PUT THE NAME OF THE KEY HERE",          "arn:aws:s3::: name_of_bucket_present_in_Account_A /*"        ]      }    ]}2.    Verify that the bucket policy associated with the S3 bucket in Account A includes the following attributes:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "Permission to cross account",      "Effect": "Allow",      "Principal": {        "AWS": [          "arn:aws:iam::AWS-ACCOUNT-ID-OF-RDS:role/service-role/PUT-ROLE-NAME"   /*---- Change Details here        ]      },      "Action": [        "s3:ListBucket",        "s3:GetBucketLocation"             ],      "Resource": [        "arn:aws:s3:::PUT-BUCKET-NAME"   /*---- Change Details here      ]    },    {      "Sid": "Permission to cross account on object level",      "Effect": "Allow",      "Principal": {        "AWS": [          "arn:aws:iam::AWS-ACCOUNT-ID-OF-RDS:role/service-role/PUT-ROLE-NAME"   /*---- Change Details here        ]      },      "Action": [        "s3:GetObject",        "s3:PutObject",        "s3:ListMultipartUploadParts",        "s3:AbortMultipartUpload"      ],      "Resource": [        "arn:aws:s3::: PUT-BUCKET-NAME/*"  /*---- Change Details here      ]    }  ]}For more information, see the following:Importing and exporting SQL Server databases using native backup and restoreExample 4: Bucket owner granting cross-account permission to objects it does not ownError: Cannot find server certificate with thumbprint 'XXXXXX'This error occurs when you try to restore a database with Transparent Data Encryption (TDE) from EC2 or on-premises to RDS for SQL Server:[2022-06-1511:55:22.280] Cannot find server certificate with thumbprint 'XXXXXXX'.[2022-06-15 11:55:22.280] RESTORE FILELIST is terminating abnormally.[2022-06-15 11:55:22.300] Aborted the task because of a task failure or a concurrent RESTORE_DB request.[2022-06-15 11:55:22.333] Task has been aborted[2022-06-15 11:55:22.337] Empty restore file list result retrieved.This error indicates an attempt to restore a backup of a database that is encrypted using TDE to a SQL instance other than its original server. The TDE certificate of the original server must be imported to the destination server. For more information on importing server certificates and respective limitations, see Support for Transparent Data Encryption in SQL Server.To resolve this error apart from importing certificates, do the following:There are two workarounds available to prevent this error.Option 1: The database backup is sourced from on-premises or an EC2 instance but target RDS SQL Server is in MultiAZ1.    Create a backup of the source database with TDE turned on.2.    Restore the backup as new DB with in your on-premises server.3.    Turn off TDE on the newly created database. Use the following commands to turn off TDE:Run the following command to turn off encryption on the database. In the following command, replace Databasename with the correct name for your database.USE master;GOALTER DATABASE [Databasename] SET ENCRYPTION OFF;GORun the following command to drop the DEK used for encryption. In the following command, replace Databasename with the correct name for your database.USE [Databasename];GODROP DATABASE ENCRYPTION KEY;GO4.    Create a native SQL Server backup and restore this new backup to the desired RDS instance. For more information, see How do I perform native backups of an Amazon RDS DB instance that's running SQL Server?5.    Turn TDE back on in the new RDS database.Option 2: The database is sourced from an RDS for SQL Server database that’s encrypted with TDE1.    Use a snapshot from the source instance to restore the DB in to a new instance.2.    Turn off TDE on the database created from the snapshot.3.    Create a native SQL backup and restore this new backup to the desired RDS instance.4.    Turn TDE back on in the new RDS database.Common errors observed for native backup on RDS for SQL ServerError: Aborted the task because of a task failure or an overlap with your preferred backup window for RDS automated backupThe following error occurs when you have permission issues related to the IAM role or policy associated with the SQLSERVER_BACKUP_RESTORE option.[2022-07-16 16:08:22.067]Task execution has started. [2022-07-16 16:08:22.143] Aborted the task because of a task failure or an overlap with your preferred backup window for RDS automated backup.[2022-07-16 16:08:22.147] Task has been aborted [2022-07-16 16:08:22.150] Access DeniedTo resolve this issue, do the following:1.    Verify the restore query to make sure that the S3 bucket and the folder prefix are correct:exec msdb.dbo.rds_restore_database      @restore_db_name='database_name',      @s3_arn_to_restore_from='arn:aws:s3:::bucket_name/file_name_and_extension';2.    Verify that the IAM policy includes the following attributes:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:ListBucket",        "s3:GetBucketLocation"      ],      "Resource": "arn:aws:s3:::bucket_name"    },    {      "Effect": "Allow",      "Action": [        "s3:GetObjectAttributes",        "s3:GetObject",        "s3:PutObject",        "s3:ListMultipartUploadParts",        "s3:AbortMultipartUpload"      ],      "Resource": "arn:aws:s3:::bucket_name/*"    }  ]}Note: Replace arn:aws:s3:::bucket_name with the ARN of your S3 bucket.3.    Verify that the policy is correctly associated with the role shown in the SQLSERVER_BACKUP_RESTORE option.4.    Verify that the SQLSERVER_BACKUP_RESTORE option in the option group associated with the DB instance.S3 Bucket ARNS3 folder prefix (Optional)For more information, see How do I perform native backups of an Amazon RDS DB instance that's running SQL Server?Error: Write on "XXX" failed, Unable to write chunks to S3, S3 write stream upload failedThis is a known issue with RDS for SQL Server. The database size is sometimes estimated incorrectly and causes the backup procedure to fail with the following error.[2022-04-21 16:45:04.597] reviews_consumer/reviews_consumer_PostUpdate_042122.bak: Completed processing 100% of S3 chunks.[2022-04-21 16:47:05.427] Write on "XXXX" failed: 995(The I/O operation has been aborted because of either a thread exit or an application request.) A nonrecoverable I/O error occurred on file "XXXX:" 995(The I/O operation has been aborted because of either a thread exit or an application request.). BACKUP DATABASE is terminating abnormally.[2022-04-21 16:47:22.033] Unable to write chunks to S3 as S3 processing has been aborted. [2022-04-21 16:47:22.040] reviews_consumer/reviews_consumer_PostUpdate_042122.bak: Aborting S3 upload, waiting for S3 workers to clean up and exit[2022-04-21 16:47:22.053] Aborted the task because of a task failure or an overlap with your preferred backup window for RDS automated backup.[2022-04-21 16:47:22.060] reviews_consumer/reviews_consumer_PostUpdate_042122.bak: Aborting S3 upload, waiting for S3 workers to clean up and exit[2022-04-21 16:47:22.067] S3 write stream upload failed. Encountered an error while uploading an S3 chunk: Part number must be an integer between 1 and 10000, inclusive S3 write stream upload failed. Encountered an error while uploading an S3 chunk: Part number must be an integer between 1 and 10000, inclusive S3 write stream upload failed. Encountered an error while uploading an S3 chunk: Part number must be an integer between 1 and 10000, inclusive S3 write stream upload failed. Encountered an error while uploading an S3 chunk: Part number must be an integer between 1 and 10000, inclusiveThe work around for this error is to turn on database backup compression. This compresses the backup, making it easier for S3 to receive the file.Run the following command to turn on backup compression:exec rdsadmin..rds_set_configuration 'S3 backup compression', 'true';Follow"


Question: How can I verify if my AWS DMS migration task is stuck or making progress?

My AWS Database Migration Service (AWS DMS) task is stuck or it is not progressing. How do I troubleshoot why my task is not progressing?

Answer: "My AWS Database Migration Service (AWS DMS) task is stuck or it is not progressing. How do I troubleshoot why my task is not progressing?Short descriptionAlthough AWS DMS tasks are rarely stuck, they can sometimes be slow to progress. Follow the steps in this article to check if the data from your DMS task is migrated from source to target.ResolutionCheck the status of your AWS DMS taskUse the following steps below to check the status of your DMS task.Log in to the AWS DMS console.From the navigation pane, choose the Database migration tasks.Review the status of your task. The status should be as follows:During the full load phase, your task status should be Running.During change data capture (CDC) phase or ongoing replication phase of a CDC-only task, your task status should be Replication ongoing.During a full load and CDC, your task status should be Load complete, replication ongoing.Monitor Amazon CloudWatch logsCheck the migration task by monitoring the Amazon CloudWatch logs.Log in to the AWS DMS console.From the navigation pane, choose Database migration tasks, and then select your task.Choose View CloudWatch logs. This redirects you to the AWS CloudWatch console, where you can monitor the logs for your task.Note: When viewing your logs, choose Retry to refresh the logs and display the latest information with the timestamp. If you don’t see a new message in log after five minutes, proceed to the next step.Refresh the table statistics of your DMS taskRefresh the Table statistics of your AWS DMS task.Log in to the AWS DMS console.From the navigation pane, choose Database migration tasks, and then select your task.Choose Table statistics.During a full load, you can see an increase in the Full Load rows value and a change in the Load state value. During ongoing replication (CDC), you can see an increase in DMLs (Inserts, Updates, and Deletes) and DDLs.If you have a test database that has little activity, you might not see any change in your task logs or in the table statistic counters.Monitor CloudWatch metrics for rows unloading and applyingLog in to the AWS DMS console.From the navigation pane, choose Database migration tasks, and then choose your task.Choose CloudWatch metrics. This action re-directs you to the CloudWatch Console.During the full load phase of the DMS task, monitor the following metrics using CloudWatch:Choose Full load from the dropdown list in the CloudWatch console.Monitor the FullLoadThroughputRowsSource metric. This metric gives a detailed picture of the rate at which AWS DMS can unload source data into the replication instance during the full load phase.Monitor the FullLoadThroughputRowsTarget. This metric shows the rate at which the rows are leaving the replication instance to commit to the target.During the CDC phase, monitor the following metrics using CloudWatch:Choose CDC from the drop down list in the CloudWatch console.Monitor the CDCThroughputRowsSource metric. This metric gives a detailed picture of the rate at which changes are captured from the source and moved to the replication instance during the CDC phase.Monitor the CDCThroughputRowsTarget. This metric shows the rate at which the changes are moved from the replication instance to the target.Monitor the CDCLatencySource metric. This metric shows the latency between source and replication instance in seconds.Monitor the CDCLatencyTarget metric. This metric shows the latency between replication instance and target in seconds.You can also query the record count on the target at specific intervals to confirm that the data is being migrated to the target. This interval varies based on the load on the source, target, and replication instances, and the amount of data that is in a single record.If you see no latency on your DMS task, and no new log message appears in the task log, then enable debug logging. Make sure to do this while the task is running, and then monitor the Amazon Cloud Watch logs of the DMS task.Note: It's a best practice to enable debug logging for a short time only while you are actively troubleshooting the task. If you enable debug logging for longer, the replication instance disk space can fill up quickly and impact running tasks on the DB instance.Related informationData Migration Service metricsFollow"


Question: How can I resolve DNS resolution or SSL certificate mismatch errors for my API Gateway custom domain name?

I configured a custom domain name for my Amazon API Gateway API. I am unable to connect to the domain name and receive DNS resolution or SSL certificate mismatch errors. How can I resolve this?

Answer: "I configured a custom domain name for my Amazon API Gateway API. I am unable to connect to the domain name and receive DNS resolution or SSL certificate mismatch errors. How can I resolve this?Short descriptionThere are two types of custom domain names that you can create for API Gateway APIs: Regional or (for REST APIs only) edge-optimized.ResolutionBefore creating a custom domain name for your API, you must do one of the following:Request an SSL/TLS certificate from AWS Certificate Manager (ACM).-or-Import an SSL/TLS certificate into ACM.For more information, see Getting certificates ready in AWS Certificate Manager.After you have your SSL/TLS certificate, you can follow the instructions to set up a custom domain name for my API Gateway API.To connect to a custom domain name for API Gateway APIs, you must configure Amazon Route 53 to route traffic to an API Gateway endpoint.If the DNS records for the custom domain name aren't mapped to the correct API Gateway domain name, then the SSL connection fails. This is because the default *.execute-api.<region>.amazonaws.com certificate is returned instead of the SSL/TLS certificate.To confirm that the DNS mapping is correct, run the following command from the client:$ nslookup <customdomainname>The output should be the API Gateway domain name. Make sure that the domain name matches the API Gateway domain name. If a Route 53 alias record is used for DNS mapping, then the output is the IP address. Make sure that the IP address matches the API Gateway domain name IP address.Note:When configuring Route 53, you must create either a public hosted zone or a private hosted zone. For internet-facing applications with resources that you want to make available to users, choose a public hosted zone. For more information, see Working with hosted zones.Route 53 uses records to determine where traffic is routed for your domain. Alias records provide easier DNS queries to AWS resources, while CNAME (non-alias) records can redirect DNS queries outside of AWS resources. For more information, see Choosing between alias and non-alias records.Related informationMigrating a custom domain name to a different API endpointFollow"


Question: How do I restore data from an Amazon OpenSearch Service domain in another AWS account?

I want to restore data from an Amazon OpenSearch Service domain in another AWS account. How can I do this?

Answer: "I want to restore data from an Amazon OpenSearch Service domain in another AWS account. How can I do this?Short descriptionTo restore data from an OpenSearch Service domain in another AWS account, you must set up cross-account access. Cross-account access must be established between your OpenSearch Service domain and the domain that you're trying to restore data from. You must also allow your domain to access the Amazon Simple Storage Service (Amazon S3) bucket that stores your data.To create this cross-account access, perform the following steps:1.    In Account A, set up the following:Source: OpenSearch Service domain with fine-grained access controlSource: Amazon S3 bucket2.    In Account B, set up your destination (OpenSearch Service domain) with fine-grained access control.Note: You don't need to create an S3 bucket in the destination (Account B). A single S3 bucket is used to restore the data across the AWS accounts. This setup also works for the OpenSearch Service domains without fine-grained access control.ResolutionNote: The examples in this article use Python and Postman code.Set up cross-account access for Account A1.    Create an S3 bucket in Account A in the same Region as the OpenSearch Service domain.2.    Create an AWS Identity Access Management (IAM) policy to provide S3 bucket access permissions:{     "Version": "2012-10-17",     "Statement": [{          "Action": [               "s3:ListBucket"          ],          "Effect": "Allow",          "Resource": [               "arn:aws:s3:::snapshot"          ]     },     {          "Action": [               "s3:GetObject",               "s3:PutObject",               "s3:DeleteObject",               "iam:PassRole"          ],          "Effect": "Allow",          "Resource": [               "arn:aws:s3:::snapshot/*"          ]     }]}Note: Replace "arn:aws:s3:::snapshot" with your bucket ARN from Step 1.3.    Create an IAM role and select Amazon Elastic Compute Cloud (Amazon EC2) as your service.4.    Add the IAM policy (created in Step 2) to your newly created IAM role.5.    Open your IAM role and choose Trust relationships.6.    Update the trust relationship of the following policy:{     "Version": "2012-10-17",     "Statement": [{          "Effect": "Allow",          "Principal": {               "Service": "es.amazonaws.com"          },          "Action": "sts:AssumeRole"     }]}Note: Replace "Service": "ec2.amazonaws.com" with "Service": "es.amazonaws.com". Also, record the role ARN, which you'll need for later steps.7.    Choose one of these options:Update the policy (from Step 2) to include the "iam:PassRole" permissions, attaching the policy to your IAM role. This permission allows OpenSearch service to have write access to an S3 bucket.-or-Create a new IAM policy, attaching the policy to your IAM role.Note: You can have all your permissions set under one IAM role by updating the policy. Or, if you want to create a new IAM policy and split up the permissions, you can reuse the IAM policy for another use case.Here's an example policy with the required IAM permissions:{     "Version": "2012-10-17",     "Statement": [{          "Effect": "Allow",          "Action": "iam:PassRole",          "Resource": "arn:aws:iam::Account A:role/cross"     },     {          "Effect": "Allow",          "Action": "es:ESHttpPut",          "Resource": "arn:aws:es:us-east-1:Account A:domain/srestore/*"     }]}This policy must be attached to the IAM user or role that is used to sign the HTTP request.Note: Replace "arn:aws:iam::Account A:role/cross" with the role that you created in Step 3. Also, update "arn:aws:es:us-east-1:Account A:domain/srestore/*" with the OpenSearch Service domain listed as the Source in Account A. The Source in Account A is used for cluster snapshots.8.    Create an IAM user and attach the policy that you created in Step 2 (which includes the required permissions to access Amazon S3). This IAM user must have Admin access to the OpenSearch Service domain in Account A to provide access to the read/write API using FGAC. For more information about using fine-grained access control, see Map the snapshot role in OpenSearch Dashboards (if using fine-grained access control).9.    (Optional) If you're using Python code to register the S3 bucket to OpenSearch Service, launch an Amazon EC2 machine in Account A. Then, attach the IAM role created in Step 3.Note: Make sure that your security group can access the OpenSearch Service domain.Register the S3 bucket to the Source in Account ATo register the S3 bucket to the Source domain in Account A, perform the following steps:1.    Update the PUT field with a URL that includes the OpenSearch Service domain endpoint and S3 bucket name. For example:https://endpointofdomain.amazonaws.com/_snapshot/snapshot2.    Choose the Authorization tab.3.    Update the AccessKey and SecretKey of the IAM user.4.    Update the AWS Region and Service Name.5.    Choose Save.6.    Choose the Headers tab.7.    Select Content-Type for your key type.8.    Select Application/JSON for your key value.9.    Choose Save.10.    Choose the Body tab.11.    Use the following code:{     "type": "s3",     "settings": {          "bucket": "snapshot",          "region": "us-east-1",          "role_arn": "arn:aws:iam::Account A:role/cross"     }}12.    Choose Send to submit the query through the OpenSearch Service console. After the registration completes, you'll receive a Status Code: 200 OK message.13.    Log in to OpenSearch Dashboards in Account A. Then, check the available data on the S3 bucket.14.    Use the following command to take a new snapshot:PUT /_snapshot/<registered_snapshot_repository>/<snapshot_name>Here's an example output:GET _cat/snapshots/casnapshottoday SUCCESS 1585190280 02:38:00 1585190284 02:38:04 3.9s 4 4 0 4This output verifies the completion of the S3 bucket registration to the OpenSearch Service domain in Account A.Set up cross-account access for Account B1.    Create a policy and IAM role in Account B, specifying the same S3 bucket ARN as Account A:{     "Version": "2012-10-17",     "Statement": [{          "Action": [               "s3:ListBucket"          ],          "Effect": "Allow",          "Resource": [               "arn:aws:s3:::snapshot" --> S3 bucket ARN from Account A          ]     },     {          "Action": [               "s3:GetObject",               "s3:PutObject",               "s3:DeleteObject",               "iam:PassRole"          ],          "Effect": "Allow",          "Resource": [               "arn:aws:s3:::snapshot/*"          ]     },     {          "Effect": "Allow",          "Action": "iam:PassRole",          "Resource": "arn:aws:iam::Account B:role/cross" --> Role created in Account B      },     {          "Effect": "Allow",          "Action": "es:*",          "Resource": "arn:aws:es:us-east-1:Account B:domain/restore/*" --> Destination ES domain in Account B     }]}Here's an example trust policy for your role:{     "Version": "2012-10-17",     "Statement": [{          "Effect": "Allow",          "Principal": {               "Service": "es.amazonaws.com"          },          "Action": "sts:AssumeRole"     }]}2.    Attach the IAM role that you previously created to the IAM user in Account B. The same IAM user must have administrator access to the Destination (domain with FGAC) in Account B. For more information about updating IAM user access, see Registering a manual snapshot repository.3.     Update the S3 bucket policy for your bucket in Account A, providing Account B access to your bucket:{     "Version": "2012-10-17",     "Id": "Policy1568001010746",     "Statement": [{          "Sid": "Stmt1568000712531",          "Effect": "Allow",          "Principal": {               "AWS": "arn:aws:iam::Account B:role/cross" --> Role which is created in Account B           },          "Action": "s3:*",          "Resource": "arn:aws:s3:::snapshot"     },     {          "Sid": "Stmt1568001007239",          "Effect": "Allow",          "Principal": {               "AWS": "arn:aws:iam::Account B:role/cross" --> Role which is created in Account B           },          "Action": "s3:*",          "Resource": "arn:aws:s3:::snapshot/*"     }]}4.    Register the S3 bucket to your domain (in Account B).Note: You must use the authentication credentials of the IAM user in Account B. Make sure to choose OpenSearch Service as your destination.{     "type": "s3",     "settings": {          "bucket": "snapshot",          "region": "us-east-1",          "role_arn": "arn:aws:iam::Account B:role/cross" --> Role which is created in Account B.     }}5.    Log in to OpenSearch Dashboards in Account B.6.    Check the snapshots from Account A that are available in the S3 bucket:GET _cat/snapshots/casnapshotHere's an example of the output:today SUCCESS 1585190280 02:38:00 1585190284 02:38:04 3.9s 4 4 0 4This output confirms that cross-account access is successfully set up in Account B.Related informationHow can I migrate data from one Amazon OpenSearch Service domain to another?Attach a bucket policy to grant cross-account permissions to Account BMigrating Amazon OpenSearch Service indices using remote reindexFollow"


Question: How do I troubleshoot subscription filter policy issues in Amazon SNS?

My Amazon Simple Notification Service (Amazon SNS) subscription filter policy isn't working. How do I troubleshoot the issue?

Answer: "My Amazon Simple Notification Service (Amazon SNS) subscription filter policy isn't working. How do I troubleshoot the issue?ResolutionImportant: Additions or changes to a subscription filter policy require up to 15 minutes to take effect.Verify that message attributes are included in the messages published to your Amazon SNS topicSubscription filter policies can filter message attributes only, not the message body. If the MessageAttributeValue is left empty on a message, then the filter policy rejects the message.To see if your filter policy rejected messages because they didn't include attributes, review the following metric in your Amazon CloudWatch metrics for Amazon SNS:NumberOfNotificationsFilteredOut-NoMessageAttributesFor more information, see Amazon SNS message filtering. For a tutorial on how to send messages with attributes, see To publish messages to Amazon SNS topics using the AWS Management Console.Verify that the messages published to your Amazon SNS topic meet the required filter policy constraintsFor a complete list of restraints, see Filter policy constraints.Verify that your subscription filter policy's attributes are configured correctlyAfter you define a subscription filter policy's attributes, the subscription endpoint receives only messages that include those defined attributes. For more information see, Attribute string value matching and Attribute numeric value matching.To see the messages that your filter policy rejected because of mismatching or incorrectly formatted attributes, review the following CloudWatch metrics for Amazon SNS:NumberOfNotificationsFilteredOutNumberOfNotificationsFilteredOut-InvalidAttributesNote: The NumberOfNotificationsFilteredOut metric shows messages that your filter policy rejected because the message attributes didn’t match the policy attributes. The NumberOfNotificationsFilteredOut-InvalidAttributes metric shows messages that your filter policy rejected because the message attributes weren't in a valid format.Follow"


Question: How can I access an Amazon S3 bucket from an application running on an Elastic Beanstalk instance?

I want to access an Amazon Simple Storage Service (Amazon S3) bucket from an application running on an AWS Elastic Beanstalk instance.

Answer: "I want to access an Amazon Simple Storage Service (Amazon S3) bucket from an application running on an AWS Elastic Beanstalk instance.Short descriptionTo access an S3 bucket from Elastic Beanstalk, verify that your AWS Identity and Access Management (IAM) instance profile is attached to an Amazon Elastic Compute Cloud (Amazon EC2) instance. The instance must have the correct permissions for Amazon S3. Then, confirm that your S3 bucket policy doesn't deny access to the role attached to your instance profile.ResolutionValidate permissions for your instance profileOpen the Elastic Beanstalk console.Select your environment.From the navigation menu, choose Configuration.In the Configuration overview section, from the Category column, for Security, choose Modify.From the IAM instance profile menu, note the name of your instance profile.Open the IAM console.In the navigation pane, choose Roles.In the search box, enter the name of your instance profile from step 5.Verify that the role from step 8 has the required Amazon S3 permissions for the bucket that you want to access. For more information, see Identity and access management in Amazon S3 and Actions, resources, and condition keys for Amazon S3.Validate permissions for your S3 bucketOpen the Amazon S3 console.From the list of buckets, choose the bucket with the bucket policy that you want to change.Choose the Permissions tab.Choose Bucket Policy.Search for "Effect": "Deny" statements.In your bucket policy, edit or remove any "Effect": "Deny" statements that are denying the IAM instance profile access to your role. For more information, see Adding a bucket policy using the Amazon S3 console.Note: Be careful not to remove any necessary deny statements to align to the security best practice of principle of least privilege. For more information, see Amazon S3 security.Access your S3 bucketYou can now access your S3 bucket, and then use your S3 bucket to do the following tasks:Manage application versions.Note: Set the S3 URL when you create or update an application.Read or write application files or photos.Note: For more information, see Developing with Amazon S3 using the AWS SDKs, and explorers.Related informationBuckets overviewElastic Beanstalk instance profileBucket policy examplesStoring private keys securely in Amazon S3Follow"


Question: How do I create a HAR file from my browser for an AWS Support case?

AWS Support asked me to create a HAR file from my web browser to help them troubleshoot my support case. How do I create that file?

Answer: "AWS Support asked me to create a HAR file from my web browser to help them troubleshoot my support case. How do I create that file?Short descriptionAn HTTP Archive (HAR) file is a JSON file that contains the latest network activity recorded by your browser. AWS Support can use a HAR file from your browser to investigate or replicate networking issues that you've documented in a technical support case.Important: You must have a Developer, Business, or Enterprise Support plan to open a technical support case. If AWS Support asks you for a HAR file for troubleshooting, create a HAR file in your browser and then submit that file in the AWS Support Center. HAR files can capture sensitive information, such as user names, passwords, and keys. Be sure to remove any sensitive information from a HAR file before you send it to AWS Support.ResolutionCreate a HAR file in your browserNote: These instructions were last tested on Google Chrome version 98.0.4758.102, Microsoft Edge (Chromium) version 98.0.1108.62, and Mozilla Firefox version 91.6. Because these browsers are third-party products, these instructions might not match the experience in the latest versions or in the version that you use. In another browser, such as legacy Microsoft Edge (EdgeHTML) or Apple Safari for macOS, the process to generate a HAR file might be similar, but the steps will be different.Google ChromeIn the browser, at the top right, choose Customize and control Google Chrome.Pause on More tools, and then choose Developer tools.With DevTools open in the browser, choose the Network panel.Select the Preserve log check box.Choose Clear to clear all current network requests.In the AWS Management Console, reproduce the issue from your support case. Or, follow the steps that AWS Support advised in a local setup.In DevTools, open the context (right-click) menu on any network request.Choose Save all as HAR with content, and then save the file.For more information, see Open Chrome DevTools and Save all network requests to a HAR file on the Google Developers website.Microsoft Edge (Chromium)In the browser, at the top right, choose Settings and more.Pause on More tools, and then choose Developer tools.With DevTools open in the browser, choose the Network panel.Select the Preserve log check box.Choose Clear to clear all current network requests.In the AWS Management Console, reproduce the issue from your support case. Or, follow the steps that AWS Support advised in a local setup.In DevTools, open the context (right-click) menu on any network request.Choose Save all as HAR with content, and then save the file.For more information, see Save all network requests to a HAR file on the Network Analysis Reference page of the Microsoft Docs website.Mozilla FirefoxIn the browser, at the top right, choose Open Application Menu.Choose More tools, and then choose Web Developer tools.In the Web Developer menu, choose Network. (In some versions of Firefox, the Web Developer menu is in the Tools menu.)Choose the gear icon, and then select Persist Logs.Choose the trash can icon (Clear) to clear all current network requests.In the AWS Management Console, reproduce the issue from your support case. Or, follow the steps that AWS Support advised in a local setup.In the Network Monitor, open the context menu (right-click) on any network request in the request list.Choose Save All As HAR, and then save the file.For more information, see Network Monitor and Network request list on the MDN Web Docs website.Edit the HAR fileOpen the HAR file in a text editor application.Use the text editor's Find and Replace tools to identify and replace all sensitive information captured in the HAR file. This includes any user names, passwords, and keys that you entered in your browser while creating the file.Save the edited HAR file with the sensitive information removed.Submit the HAR fileIn the AWS Support Center, under Open support cases, choose your support case.In your support case, choose your preferred contact option, attach the edited HAR file, and then submit.Related informationWhat browsers are supported for use with the AWS Management Console?Follow"


Question: How do I recreate a "Deleted" Amazon SNS topic subscription for an Amazon SQS queue in another AWS account?

"My Amazon Simple Queue Service (Amazon SQS) queue was subscribed to an Amazon Simple Notification Service (Amazon SNS) topic in a different AWS account. I deleted the cross-account subscription, and the topic subscription is now in "Deleted" status. How do I recreate a deleted Amazon SNS topic subscription for an Amazon SQS queue in another account?"

Answer: "My Amazon Simple Queue Service (Amazon SQS) queue was subscribed to an Amazon Simple Notification Service (Amazon SNS) topic in a different AWS account. I deleted the cross-account subscription, and the topic subscription is now in "Deleted" status. How do I recreate a deleted Amazon SNS topic subscription for an Amazon SQS queue in another account?Short descriptionIf you call the Amazon SNS Unsubscribe API from an account that doesn't own the subscription, the subscription enters Deleted status for 72 hours. While the SNS topic subscription is in Deleted status, the account that owns the subscription can't resubscribe the same endpoint to the topic.After 72 hours, Amazon SNS clears the Deleted subscription and the account that owns the subscription can resubscribe the same endpoint to the topic.If you don't want to wait 72 hours to resubscribe, you can manually recreate the subscription by doing any of the following.Note: It's a best practice to run Subscribe and Unsubscribe API calls from the same AWS account. When you call the Subscribe API, the AWS account that you use to make the call becomes the subscription owner.ResolutionImportant: The following procedures apply to HTTP and HTTPS endpoint subscribers. It doesn't apply to AWS Lambda function subscribers.Send an HTTP GET method request to the SubscribeURL in the UnsubscribeConfirmation message you received1.    In the UnsubscribeConfirmation message sent to the SQS queue after you deleted the subscription, find the SubscribeURL. Then, copy and paste the URL to a text document.2.    Send an HTTP GET method request to the SubscribeURL.HTTP GET method request examplecurl -X GET "https://sns.us-west-2.amazonaws.com/?Action=ConfirmSubscription&TopicArn=arn:aws:sns:us-west-2:123456789012:MyTopic&Token=<token>"Call the Amazon SNS Subscribe API from the AWS account that owns the SNS topic, then confirm the subscription1.    Call the Amazon SNS Subscribe API from the AWS account that owns the SNS topic.2.    Have an AWS user with permissions to read messages from the SQS queue confirm the subscription.Create a new Amazon SNS topic to replace the current topic, then subscribe to the new topic1.    Create a new SNS topic to replace the current topic.2.    Subscribe the SQS queue to the new topic.Related informationDeleting an Amazon SNS subscription and topicSending Amazon SNS messages to an Amazon SQS queue in a different accountFanout to Amazon SQS queuesFollow"


Question: Why am I receiving an error when copying my ElastiCache snapshot?

I'm trying to copy my Amazon ElastiCache for Redis snapshot or backup to an Amazon Simple Storage Service (Amazon S3) bucket. The copy operation is stuck or failing. How can I troubleshoot this?

Answer: I'm trying to copy my Amazon ElastiCache for Redis snapshot or backup to an Amazon Simple Storage Service (Amazon S3) bucket. The copy operation is stuck or failing. How can I troubleshoot this?Short descriptionElastiCache snapshot copy operations might fail or get stuck for one of the following reasons:The destination S3 bucket is not in the same Region as the snapshot.S3 doesn't have the necessary permission to access ElastiCache.The user doesn't have the proper Identify and Access Management (IAM) policy set to access an S3 bucket.The cluster is using data tiering.ResolutionMake sure that you followed the steps for exporting your backup.Make sure that ElastiCache has the necessary permissions to access your S3 bucket. You can review error messages to rule out S3 permission issues.Make sure that you're not using data tiering in your cluster. Data tiering is turned on by default if you're using a combination of Redis engine version 6.2n or later with the rdg cache node family.Related informationcopy-snapshot (AWS CLI Command reference)Follow


Question: Why isn't my SC1 or ST1 EBS volume achieving the rated throughput performance?

My ST1 or SC1 Amazon Elastic Block Store (Amazon EBS) volume isn't reaching the throughput performance listed in the AWS documentation. Why is this?

Answer: "My ST1 or SC1 Amazon Elastic Block Store (Amazon EBS) volume isn't reaching the throughput performance listed in the AWS documentation. Why is this?Short descriptionWhen using HDD Amazon EBS volumes, such as SC1 and ST1, keep the following:These volumes always use a 1024 KiB I/O token regardless of the actual I/O size used by the workload on the instance. Even if the actual I/O size of the application workload is set to 16 KiB, the volume still uses the entire 1024 KiB size of the I/O token. This wastes most of the token's space. To maximize efficiency, fill the entire 1024KiB.When the I/O size of a sequential workload is greater than 32 KiB, Amazon EBS always merges the I/Os into a single I/O operation of 1024 KiB. This merging fills the entire token size.When the I/O size is smaller than 32 KiB, or if the workload is random, Amazon EBS doesn't merge the I/Os to 1024 KiB. However, Amazon EBS still uses the entire 1024 KiB token size. This leaves most of the space inside the token empty. Since the I/Os aren't merged, the instance uses more IOPS sending the same amount of data to the volume. This causes a reduction in the burst balance even though the throughput is below its baseline value.ResolutionTo enable your ST1 and SC1 EBS volumes to reach their maximum rated throughput, do the following:Set up your application to use an I/O size greater than 32 KiB.Verify that your application uses sequential workload.ExampleWhen calculating throughput, use the following formula:Throughput = I/Osize * IOPSIf the I/O size is smaller than 32 KiB, the volume hits its IOPS limit, throttling the throughput. When this happens, the volume never achieves it's rated throughput performance.For example, setting the I/O size to 16 KiB and sending 3 MiB/s of data results in the following:3MiB/s/16KiB = 192 IOPSSetting the I/O size to 32 KiB with a sequential/contiguous workload causes Amazon EBS to merge to 1024 KiB. Amazon only sends 3 IOPS, in this case, as shown in the following calculation:3MiB/s/1024Kib = 3 IOPSAssume you're using 0.5 TiB (500 GiB) of an ST1 volume. This volume ideally provides a baseline throughput performance of 20 MiB/s and can burst up to 125 MiB/s.If the volume is bursting at 125 MiB/s, and the applications I/O size is 1024 KiB, then maximum theoretical IOPS equals 125 IOPS.Throughput / IOsize = 125MiB/s / 1024 KiB = 125 IOPS.However, if the application uses an I/O size of 16 KiB, then sending 3 MiB of data uses 192 IOPS. The application can't push 192 IOPS because the volume only achieves a theoretical maximum of 125 IOPS. In this case, the volume throttles IOPS to 125. In this scenario, the actual throughput is as follows:Actual throughput = 16 KiB * 125 = 1.95 MiB/sAs shown in the preceding calculations, IOPS is throttled to 125 IOPS, so Amazon EBS throttles the throughput to 1.95 MiB/s. This throttling occurs even though the burstable theoretical throughput for the volume is 125 IOPS given that the application used 1024 KiB I/O size.Related informationI/O characteristics and monitoringAmazon EBS volume typesFollow"


Question: How do I push Systems Manager SSM Agent logs to CloudWatch?

I want to send AWS Systems Manager SSM Agent logs to Amazon CloudWatch Logs. How can I do that?

Answer: "I want to send AWS Systems Manager SSM Agent logs to Amazon CloudWatch Logs. How can I do that?ResolutionCreate a log group in CloudWatch LogsTo create a log group in CloudWatch Logs, follow these steps:Open the CloudWatch console, and then choose Log groups from the navigation pane.Choose Create log group.For Log group name, enter a name.Choose Create.Attach permissionsThe Amazon Elastic Compute Cloud (Amazon EC2) instance must include AWS Identity and Access Management (IAM) permissions to send the logs. You must attach the CloudWatchLogsFullAccess IAM role to the instance. For instructions, see Attach an IAM role to an instance.Note: You can include these permissions with already existing permissions. You can also further narrow the permissions based on your requirements.Configure SSM Agent to send logs to CloudWatch LogsFor instructions to configure SSM Agent to send logs to CloudWatch Logs, see Sending SSM Agent logs to CloudWatch Logs.Related informationChecking SSM Agent status and starting the agentWhat is Amazon CloudWatch Logs?Getting started with CloudWatch LogsFollow"


Question: I can't open Jupyter on my Amazon SageMaker notebook instance

I get an error when I try to open my Amazon SageMaker Jupyter notebook in my browser.

Answer: "I get an error when I try to open my Amazon SageMaker Jupyter notebook in my browser.ResolutionFirst, try the following:On the Amazon SageMaker console, and then confirm that the notebook instance status is InService. If the status is Pending, the notebook instance isn't ready yet.Clear your browser cache or try a different browser.Check the Jupyter logs for errors.If you still can't open the Jupyter notebook, restart the notebook instance. It's a best practice to regularly restart notebook instances. Restarting helps keep notebook instance software updated. When you restart, the notebook instance moves to a new underlying host. This can help resolve HTTP 503 and 504 errors in your browser.Note: The only persistent storage on the notebook instance is the /home/ec2-user/SageMaker file system. When you restart, you lose all other data.To restart a notebook instance:1.    Open the Amazon SageMaker console.2.    In the navigation pane, choose Notebook instances.3.    Select the circle next to the notebook instance name.4.    Choose the Actions dropdown list, and then choose Stop.5.    Wait for the notebook instance to reach the Stopped status.6.    Choose the Actions dropdown list, and then choose Start.7.    Open the notebook instance URL.To prevent this issue from happening again, check for the following common causes of an overloaded notebook instance.Too many open sessionsOn the Jupyter dashboard, check the Running tab. When you have a large number of active sessions and notebooks, notebooks take longer to load and might time out in the browser. To resolve this issue, shut down unnecessary notebook or terminal sessions.High CPU or memory utilization1.    Open the Jupyter dashboard, and then choose the Files tab.2.    Choose New, and then choose Terminal.3.    Check memory utilization:free -h4.    Check CPU utilization:topIf CPU or memory utilization is high and you can't free up any more resources, consider switching to a larger notebook instance type:1.    Stop the notebook instance, as explained earlier.2.    When the notebook instance reaches the Stopped status, choose the Actions dropdown list, and then choose Update settings.3.    Choose a new Notebook instance type, and then choose Save. For a list of instance types available in each Region, see Supported instance types and Availability Zones.4.    Choose the Actions dropdown list, and then choose Start.5.    Open the notebook instance URL.High disk utilization1.    Open the Jupyter dashboard, and then choose the Files tab.2.    Choose New, and then choose Terminal.3.    Run a command similar to the following to start a shell session and check disk utilization:df -h4.    Check disk utilization for filesystem /home/ec2-user/SageMaker.If disk utilization is high, then remove temporary files from the /home/ec2-user/SageMaker directory, if possible. Or, increase the Amazon Elastic Block Store (Amazon EBS) volume size:1.    Stop the notebook instance, as explained earlier.2.    When the notebook instance reaches the Stopped status, choose the Actions dropdown list, and then choose Update settings.3.    Enter a new volume size, and then choose Save. The default EBS volume size is 5 GB. You can increase the volume size up to 16 TB.4.    Choose the Actions dropdown list, and then choose Start.5.    Open the notebook instance URL.Follow"


Question: How do I allow my IP address while blocking other IP addresses using AWS WAF?

I've set up AWS WAF and I need to allow my IP address while blocking other IP addresses using AWS WAF. How can I do this?

Answer: "I've set up AWS WAF and I need to allow my IP address while blocking other IP addresses using AWS WAF. How can I do this?ResolutionAWS WAF can inspect the source IP address of a web request against a set of IP addresses and address ranges. You can create a rule that blocks requests from all IPs except the specific IPs in an IP set.First, create an IP setOpen the AWS WAF console.In the navigation pane, choose IP sets, and then choose Create IP set.Enter an IP set name and Description - optional for the IP set. For example: MyTrustedIPs.Note: You can't change the IP set name after you create the IP set.For Region, choose the AWS Region where you want to store the IP set. To use an IP set in web ACLs that protect Amazon CloudFront distributions, you must use Global (CloudFront).For IP version, choose the version that you want to use.For IP addresses, enter one IP address or an IP address range per line that you want to allow in CIDR notation.Note: AWS WAF supports all IPv4 and IPv6 CIDR ranges except for /0.Examples:To specify the IPv4 address 10.20.0.5, enter 10.20.0.5/32.To specify the IPv6 address 0:0:0:0:0:ffff:c000:22c, enter 0:0:0:0:0:ffff:c000:22c/128.To specify the range of IPv4 addresses from 10.20.0.0 to 10.20.0.255, enter 10.20.0.0/24.To specify the range of IPv6 addresses from 2620:0:2d0:200:0:0:0:0 to 2620:0:2d0:200:ffff:ffff:ffff:ffff, enter 2620:0:2d0:200::/64.Review the settings for the IP set. If the IP set matches your specifications, choose Create IP set.Then, create an IP match ruleIn the navigation pane, under AWS WAF, choose Web ACLs.For Region, select the AWS Region where you created your web ACL.Note: Select Global if your web ACL is set up for Amazon CloudFront.Select your web ACL.Choose Rules, and then choose Add Rules, Add my own rules and rule groups.For Name, enter a name to identify this rule. For example: Block-Other-IPs.For Type, choose Regular rule.For If a request, choose doesn't match the statement (NOT).On Statement, for Inspect, choose Originates from IP address in.For IP Set, choose the IP Set you created earlier. For example: MyTrustedIPs.For IP address to use as the originating address, choose Source IP address.For Action, choose Block.Choose Add rule.Choose Save.The IP match rule blocks any IP not added to the IP set. For IPs added to an IP set, the request is evaluated by other rules below the rule. If there isn't a match, the web ACL default action is applied. For more information, see Processing order of rules and rule groups in a web ACL.Related informationHow do I use AWS WAF to block HTTP requests that don't contain a User-Agent header?Follow"