Question: How can I enable audit logging for an Amazon RDS for MySQL or MariaDB instance and publish the logs to CloudWatch?

"I want to audit database (DB) activity to meet compliance requirements for my Amazon Relational Database Service (Amazon RDS) DB instance that's running MySQL or MariaDB. Then, I want to publish the DB logs to Amazon CloudWatch. How can I do this?"

Answer: "I want to audit database (DB) activity to meet compliance requirements for my Amazon Relational Database Service (Amazon RDS) DB instance that's running MySQL or MariaDB. Then, I want to publish the DB logs to Amazon CloudWatch. How can I do this?Short descriptionTo use the MariaDB Audit Plugin to capture events such as connections, disconnections, queries, or tables queried, you must do the following:Add and configure the MariaDB Audit Plugin and associate the DB instance with a custom option group.Publish the logs to CloudWatch.If you use Amazon Aurora MySQL-Compatible Edition, see How can I enable audit logging for my Aurora MySQL-Compatible DB cluster and publish the logs to CloudWatch?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, confirm that you're running a recent version of the AWS CLI.Amazon RDS supports Audit Plugin option settings on the following versions for MySQL and MariaDB:All MySQL 5.7 versionsMySQL 5.7.16 and higher 5.7 versionsMySQL 8.0.25 and higher 8.0 versionsMariaDB 10.2 and higherFor more information about supported versions, see MariaDB Audit Plugin support and Options for MariaDB database engines.Add and configure the MariaDB Audit Plugin and associate the DB instance with a custom option group1.    Create a custom option group or modify an existing custom option group.2.    Add the MariaDB Audit Plugin option to the option group and configure the option settings.3.    Apply the option group to the DB instance.To apply the option to a new DB instance, configure the instance to use the newly created option group when you launch the DB instance. To apply the option to an existing DB instance, modify the DB instance and attach the new option group. For more information, see Modifying an Amazon RDS DB instance.After you configure the DB instance with the MariaDB Audit Plugin, you don't need to reboot the DB instance. When the option group is active, auditing begins immediately.Note: Amazon RDS doesn't support turning off logging in the MariaDB Audit Plugin. To turn off audit logging, remove the plugin from the associated option group. This restarts the instance automatically. To limit the length of the query string in a record, use the SERVER_AUDIT_QUERY_LOG_LIMIT option.Publish audit logs to CloudWatch1.    Open the Amazon RDS console.2.    Choose Databases from the navigation pane.3.    Select the DB instance that you want to use to export log data to CloudWatch.4.    Choose Modify.5.    From the Log exports section, select Audit log.6.    Choose Continue.7.    Review the Summary of modifications, and then choose Modify instance.You can also use the following AWS CLI command syntax to turn on CloudWatch log exports:aws rds modify-db-instance --db-instance-identifier <mydbinstance> --cloudwatch-logs-export-configuration '{"EnableLogTypes":["audit"]}'After turning on audit logging and modifying your instance to export logs, events that are recorded in audit logs are sent to CloudWatch. Then, you can monitor the log events in CloudWatch.Follow"


Question: Can I restrict the access of IAM Identity to specific Amazon EC2 resources?

I want to restrict access of an AWS Identity and Access Management (IAM) user/group/role to a specific Amazon Elastic Compute Cloud (Amazon EC2) resource on the same account. How can I do this?

Answer: "I want to restrict access of an AWS Identity and Access Management (IAM) user/group/role to a specific Amazon Elastic Compute Cloud (Amazon EC2) resource on the same account. How can I do this?ResolutionAmazon EC2 has partial support for resource-level permissions or conditions. This means that for certain Amazon EC2 actions, you can control when users are allowed to use those actions based on conditions that have to be fulfilled, or specific resources that users are allowed to use.Isolating IAM users or groups of user's access to Amazon EC2 resources by any criteria other than AWS Region doesn't fit most use cases. If you must isolate your resources by Region or any conditions on the same account, be sure to check the list of Amazon EC2 actions that support resource-level permissions and conditions to verify that your use case is supported.Below is an example of a policy that can be used to restrict access of an IAM identity (user/group/role) to only Start/Stop/Reboot EC2 instances in the N. Virginia (us-east-1) Region. The instance must have a tag key of "Owner" with a tag value of "Bob." "ec2:Describe*" is added to the policy to grant permission to describe the EC2 instance and all associated resources in the AWS management EC2 console.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "ec2:Describe*",      "Resource": "*"    },    {      "Effect": "Allow",      "Action": [        "ec2:StartInstances",        "ec2:StopInstances",        "ec2:RebootInstances"      ],      "Resource": [        "arn:aws:ec2:us-east-1:111122223333:instance/*"      ],      "Condition": {        "StringEquals": {          "ec2:ResourceTag/Owner": "Bob"        }      }    }  ]}Note: Replace "Owner," "Bob," and the resource ARN with parameters from your environment.After creating the policy, you can attach it to either an IAM user, group, or roleFor tagging use cases and best practices, see Best practices.Related informationIAM policies for Amazon EC2Identity and access management for Amazon EC2Amazon EC2 API actionsAmazon Resource Names (ARNs)Follow"


Question: How can I use CloudWatch Logs Insights queries with my VPC flow log?

I want to use Amazon CloudWatch Logs Insights queries to process my Amazon Virtual Private Cloud (Amazon VPC) flow logs that are in a log group. How can I do this?

Answer: "I want to use Amazon CloudWatch Logs Insights queries to process my Amazon Virtual Private Cloud (Amazon VPC) flow logs that are in a log group. How can I do this?Short descriptionAfter you turn on VPC flow logs targeting CloudWatch Logs, you see one log stream for each elastic network interface. CloudWatch Logs Insights is a query tool that can perform complex queries on log events stored in log groups. If an issue occurs, you can use CloudWatch Logs Insights to identify potential causes and validate deployed fixes.For information on supported log types, see Supported logs and discovered fields.ResolutionRun a queryTo run a query, do the following:1.    Open the Cloudwatch console.2.    Select Logs, Logs Insights.3.    On the Logs Insights dashboard, select the log group that you want to analyze and visualize data for.4.    You can create a query, or you can run one of the provided sample queries for VPC flow logs. If you're creating a custom query, start by reviewing the tutorials provided in the Amazon CloudWatch documentation. For information on query syntax, see CloudWatch Logs Insights query syntax.5.    Select History to view your previously executed queries. You can run queries again from History.6.    To export your results, select Export results and then choose a format.Example queriesScenario 1You have a webserver, application server, and DB server. The application isn't working as expected. For example, you're receiving a timeout or HTTP 503 error and you're trying to determine the cause of the error.Example variables:Action is set to "REJECT" so that only rejected connections are returned.The query includes only internal networks.The list of server IPs shows both inbound and outbound connections (srcAddr and dstAddr).The Limit is set to 5 so that only the first five entries are shown.Web server IP: 10.0.0.4App server IP: 10.0.0.5DB server IP: 10.0.0.6filter(action="REJECT" anddstAddr like   /^(10\.|192\.168\.)/andsrcAddrlike   /^(10\.|192\.168\.)/ and(srcAddr = "10.0.0.4" ordstAddr = "10.0.0.4" orsrcAddr = "10.0.0.5" ordstAddr = "10.0.0.5" orsrcAddr = "10.0.0.6" ordstAddr = "10.0.0.6" or))|stats count(*) as records by srcAddr,dstAddr,dstPort,protocol |sort records desc |limit 5Scenario 2You're experiencing intermittent timeouts on a given elastic network interface. The following query checks for any rejects on the elastic network interface over a period of time.fields @timestamp, interfaceId, srcAddr, dstAddr, action| filter (interfaceId = 'eni-05012345abcd' and action = 'REJECT')| sort @timestamp desc| limit 5Scenario 3The following query example analyzes VPC flow logs to produce a report on a specific elastic network interface. The query checks the amount of traffic that's being sent to different ports.fields @timestamp, @message | stats count(*) as records by dstPort, srcAddr, dstAddr as Destination | filter interfaceId="eni-05012345abcd" | filter dstPort="80" or dstPort="443" or dstPort="22" or dstPort="25" | sort HitCount desc | limit 10Scenario 4The following query filters VPC flow logs to list IP addresses that are trying to connect with a specific IP or CIDR in your VPC.For a specific IP:fields @timestamp, srcAddr, dstAddr | sort @timestamp desc | limit 5 | filter srcAddr like "172.31."For a specific CIDR:fields @timestamp, srcAddr, dstAddr | sort @timestamp desc | limit 5 | filter isIpv4InSubnet(srcAddr,"172.31.0.0/16)Note: For additional example queries, see Sample queries.Related informationAnalyzing log data with CloudWatch Logs InsightsFollow"


Question: How do I resolve the error that I receive in AWS CodeDeploy when my deployment times out while waiting for a status callback?

My AWS CodeDeploy deployment times out and returns the following error: "The deployment timed out while waiting for a status callback. CodeDeploy expects a status callback within one hour after a deployment hook is invoked."

Answer: "My AWS CodeDeploy deployment times out and returns the following error: "The deployment timed out while waiting for a status callback. CodeDeploy expects a status callback within one hour after a deployment hook is invoked."Short descriptionThis issue can occur when you use CodeDeploy to deploy an Amazon Elastic Container Service (Amazon ECS) service with a validation test.If the test doesn't return a Succeeded or Failed response within 60 minutes after a lifecycle event hook is invoked, then CodeDeploy returns the following error:"The deployment timed out while waiting for a status callback. CodeDeploy expects a status callback within one hour after a deployment hook is invoked."Note: The default timeout limit for a lifecycle hook AWS Lambda function's status callback is 60 minutes.To resolve the error, verify that the lifecycle hook Lambda function has the required method and AWS Identity and Access Management (IAM) permissions.ResolutionConfirm the cause of the error by reviewing your CloudWatch LogsFor instructions, see How do I retrieve log data from Amazon CloudWatch Logs?Verify that the lifecycle hook Lambda function has the required IAM permissionsMake sure that the lifecycle hook Lambda function has an execution role that includes the following permission: PutLifecycleEventHookExecutionStatus.Note: The PutLifecycleEventHookExecutionStatus permission isn't included by default in the AWS managed CodeDeployFullAccess IAM policy.See the following example of a PutLifecycleEventHookExecutionStatus permissions statement:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Allow",      "Action": "codedeploy:PutLifecycleEventHookExecutionStatus",      "Resource": "*"    }  ]}Verify that the lifecycle hook Lambda function includes the required method to return a status response to CodeDeployMake sure that the lifecycle hook Lambda function includes the putLifecycleEventHookExecutionStatus method.For more information, see Step 3: Create a lifecycle hook Lambda function in the CodeDeploy User Guide.See the following example of a putLifecycleEventHookExecutionStatus method for a lifecycle hook Lambda function:codedeploy.putLifecycleEventHookExecutionStatus(params, function(err, data) {     if (err) {          // Validation failed.          console.log('AfterAllowTestTraffic validation tests failed');          console.log(err, err.stack);          callback("CodeDeploy Status update failed");     } else {          // Validation succeeded.          console.log("AfterAllowTestTraffic validation tests succeeded");callback(null, "AfterAllowTestTraffic validation tests succeeded");         }Follow"


Question: What do I need to know about the Amazon RDS maintenance window?

I want to know what happens during the Amazon Relational Database Service (Amazon RDS) maintenance window. I want to know the pending maintenance actions and defer these maintenance actions accordingly.

Answer: "I want to know what happens during the Amazon Relational Database Service (Amazon RDS) maintenance window. I want to know the pending maintenance actions and defer these maintenance actions accordingly.ResolutionAmazon RDS performs maintenance on Amazon RDS resources periodically to fix issues related to security and instance reliability. During the maintenance window, Amazon RDS applies updates related to hardware, underlying operating system, or database engine minor version. In addition, DB instance modifications that you've chosen not to apply immediately are also applied during the maintenance window. Some of these maintenance operations, such as operating system updates and database patching, cause downtime on your RDS instance. Enabling the Multi-AZ configuration on your RDS instance might help in minimizing the downtime required during some maintenance operations.Get notifications for maintenance actionsTo configure notifications for upcoming maintenance actions on your RDS instance, do the following:Create an Amazon Simple Notification Service (Amazon SNS) topic to receive notifications from Personal Health Dashboard.Create an Amazon CloudWatch Events rule to be notified for AWS Health events related to RDS resources in your account.Use the Amazon RDS event notification to be notified for instance events in the maintenance category. You can also subscribe to Amazon RDS event notification.To create the CloudWatch Events rule to get notifications for Amazon RDS maintenance actions, do the following:Open the Amazon CloudWatch console.In the navigation pane, under Events, choose Rules.Choose Back to CloudWatch Events.Choose Create rule.Under Event Source, do the following:For Service Name, choose Health.For Event Type, choose Specific Health events.Select Specific service(s).For Specific service(s), select RDS.Select Specific event type category(s).For Specific event type category(s), select scheduledChange.Select Any event type code.Select Any resource.Under Targets, do the following:Choose Add target*, and then select SNS topic.For Topic*, select the Amazon SNS topic that you created for notifying Amazon RDS maintenance actions.Choose Configure details.Under Rule definition, do the following:For Name*, enter the name for the rule.For Description, enter the description for the rule.Choose Create rule.Note: To see the Amazon RDS DB instances that are scheduled to receive hardware maintenance during your maintenance window, review the DB instances that are listed in the Open and recent issues tab on your AWS Health Dashboard. For more information, see the maintenance notification email that's sent to your account.List pending maintenance actionsTo view whether a maintenance update is available for your DB instance, do the following:Open the Amazon RDS console.In the navigation pane, choose Databases.Choose the settings icon.Under Preferences, turn on Maintenance, and then choose Continue.You can see the maintenance updates for your DB instance with one of the following column values:required: The maintenance action will be applied to the resource and can't be deferred indefinitely.available: The maintenance action is available, but won't be applied to the resource automatically. You can apply it manually.next window: The maintenance action will be applied to the resource during the next maintenance window.In progress: The maintenance action is in the process of being applied to the resource.To view the maintenance actions for the RDS instance, do the following:Open the Amazon RDS console.In the navigation pane, choose Databases.Select the DB instance that you want to view.Choose the Maintenance & backups tab.You can view the list of pending maintenance actions under the Pending maintenance section.You can also run the following AWS Command Line Interface (AWS CLI) command to list pending maintenance actions:$ aws rds describe-pending-maintenance-actions --region example-region-nameNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Change the maintenance windowThe maintenance window should fall at the time of lowest usage and thus might need modification from time to time. To change the maintenance window to a preferred time, see Adjusting the preferred DB instance maintenance window.Changing the maintenance window for an RDS instance doesn’t require any downtime. However, if there are one or more pending actions that cause downtime, and the maintenance window is changed to include the current time, then the pending actions are applied immediately, resulting in downtime.To postpone a maintenance action that's scheduled for the next maintenance window, consider changing the maintenance window of your DB instance to the next feasible window.Important: Changing the maintenance window continuously to avoid downtime might lead to the maintenance actions being applied at the time of highest usage. This might cause an outage.Defer maintenance actionsYou can't defer a maintenance action that has already started. However, you can defer a maintenance action that's scheduled for the next maintenance window. If you set the Maintenance value to next window, then the option to defer is available:Open the Amazon RDS console.In the navigation pane, choose Databases.Choose the DB instance for which you want to defer the maintenance action.Choose Actions, and then choose Defer upgrade.Related informationMaintaining a DB instanceModifying an Amazon RDS DB instanceHow do I minimize downtime during required Amazon RDS maintenance?How long is the Amazon RDS maintenance window?How do I configure notifications for Amazon RDS or Amazon Redshift maintenance windows?Follow"


Question: How can I allow only certain file types to be uploaded to my Amazon S3 bucket?

I want only certain file types to be stored on my Amazon Simple Storage Service (Amazon S3) bucket. How can I limit uploads so that my bucket accepts only those file types?

Answer: "I want only certain file types to be stored on my Amazon Simple Storage Service (Amazon S3) bucket. How can I limit uploads so that my bucket accepts only those file types?ResolutionAdd statements to your bucket policy that do the following:Allow the s3:PutObject action only for objects that have the extension of the file type that you want.Explicitly deny the s3:PutObject action for objects that don't have the extension of the file type that you want.Note: This explicit deny statement applies the file-type requirement to users with full access to your Amazon S3 resources.For example, the following bucket policy allows the s3:PutObject action to exampleuser only for objects with .jpg, .png, or .gif file extensions:Warning: This example bucket policy includes an explicit deny statement. If a user doesn't meet the specified conditions, even the user who enters the bucket policy can get denied access to the bucket. Therefore, you must carefully review the bucket policy before saving it. If you've accidentally locked the bucket, then see I accidentally denied everyone access to my Amazon S3 bucket. How do I regain access?{  "Version": "2012-10-17",  "Id": "Policy1464968545158",  "Statement": [    {      "Sid": "Stmt1464968483619",      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::111111111111:user/exampleuser"      },      "Action": "s3:PutObject",      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.jpg",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.png",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.gif"      ]    },    {      "Sid": "Stmt1464968483619",      "Effect": "Deny",      "Principal": "*",      "Action": "s3:PutObject",      "NotResource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.jpg",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.png",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.gif"      ]    }  ]}Note:For the first Principal value, list the Amazon Resource Names (ARNs) of the users that you want to grant upload permissions to.For the Resource and NotResource values, make sure to replace DOC-EXAMPLE-BUCKET with the name of your bucket.When you specify resources in the bucket policy, the bucket policy evaluation is case-sensitive. A bucket policy that denies s3:PutObject actions for NotResource "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*.jpg" will allow you to upload "my_image.jpg". However, if you try to upload "my_image.JPG", Amazon S3 will return an Access Denied error.Follow"