Question: Why is my EC2 instance not displaying as a managed node or showing a "Connection lost" status in Systems Manager?

My Amazon Elastic Compute Cloud (Amazon EC2) instance either lost its connection or isn't displaying under Fleet Manager in the AWS Systems Manager console.

Answer: "My Amazon Elastic Compute Cloud (Amazon EC2) instance either lost its connection or isn't displaying under Fleet Manager in the AWS Systems Manager console.ResolutionA managed instance is an EC2 instance that's used with Systems Manager as a managed node.To confirm that your EC2 instance meets the prerequisites to be a managed instance, run the AWSSupport-TroubleshootManagedInstance Systems Manager Automation document. Then, verify that your EC2 instance meets the following requirements.Important: Throughout the troubleshooting steps, select the AWS Region that includes your EC2 instance.Verify that SSM Agent is installed and running on the instanceAfter you confirm that your operating system supports Systems Manager, verify that AWS Systems Manager Agent (SSM Agent) is installed and running on your instance.SSM Agent is preinstalled on some Linux, macOS, and Windows Amazon Machine Images (AMIs). To manually install SSM Agent when the agent isn't preinstalled, see the following documentation:Linux: Manually installing SSM Agent on EC2 instances for LinuxmacOS: Manually installing SSM Agent on EC2 instances for macOSWindows: Manually installing SSM Agent on EC2 instances for Windows ServerTo verify that SSM Agent is running, use operating system-specific commands to check the agent status.After you finish verifying SSM Agent, run ssm-cli to troubleshoot managed instance availability.Verify connectivity to Systems Manager endpoints on port 443To verify connectivity to Systems Manager endpoints on port 443, you must consider your operating system and subnet settings. For a list of Systems Manager endpoints by Region, see AWS Systems Manager endpoints and quotas.Note: In the examples, the ssmmessages endpoint is required for AWS Systems Manager Session Manager.EC2 Linux instancesUse either Telnet or Netcat commands to verify connectivity to endpoints on port 443 for EC2 Linux instances.Note: Replace RegionID with your instance's Region when running commands.Telnet commands:telnet ssm.RegionID.amazonaws.com 443telnet ec2messages.RegionID.amazonaws.com 443telnet ssmmessages.RegionID.amazonaws.com 443Telnet connection example:root@111800186:~# telnet ssm.us-east-1.amazonaws.com 443Trying 52.46.141.158...Connected to ssm.us-east-1.amazonaws.com.Escape character is '^]'.To exit from telnet, hold down the Ctrl key and press the ] key. Enter quit, and then press Enter.Netcat commands:nc -vz ssm.RegionID.amazonaws.com 443nc -vz ec2messages.RegionID.amazonaws.com 443nc -vz ssmmessages.RegionID.amazonaws.com 443Netcat isn't preinstalled on EC2 instances. To manually install Netcat, see Ncat on the Nmap website.EC2 Windows instancesUse the following Windows PowerShell commands to verify connectivity to endpoints on port 443 for EC2 Windows instances.Test-NetConnection ssm.RegionID.amazonaws.com -port 443Test-NetConnection ec2messages.RegionID.amazonaws.com -port 443Test-NetConnection ssmmessages.RegionID.amazonaws.com -port 443Public subnetsSystems Manager endpoints are public endpoints. To resolve issues when connecting to an endpoint from an instance in a public subnet, confirm the following points:Your instance's route table routes internet traffic to an internet gateway.Your Amazon Virtual Private Cloud (Amazon VPC) security groups and network access control lists (network ACLs) allow outbound connections on port 443.Private subnetsUse private IP addresses to privately access Amazon EC2 and Systems Manager APIs. To resolve issues when connecting to an endpoint from an instance in a private subnet, confirm one of the following points:Your instance's route table routes internet traffic to a NAT gateway.Your VPC endpoint is configured to reach Systems Manager endpoints.For more information, see How do I create VPC endpoints so that I can use Systems Manager to manage private EC2 instances without internet access?Note: Each interface endpoint creates an elastic network interface in the provided subnet.As a security best practice for private subnets, verify the following settings:The security group attached to your VPC endpoint's network interface allows TCP port 443 inbound traffic from the security group that's attached to your instance.The security group attached to your instance allows TCP port 443 outbound traffic to the private IP address for your VPC endpoint's network interface.Verify the setup for Default Host Management ConfigurationNote: If you aren't using Default Host Management Configuration, then skip to the Verify that the correct IAM role is attached to the instance section.Systems Manager automatically manages EC2 instances without an AWS Identity and Access Management (IAM) instance profile when you configure Default Host Management Configuration. When you configure this feature, Systems Manager has permissions to manage all instances in your Region and account. If the permissions aren't sufficient for your use case, add policies to the default IAM role created by Default Host Management Configuration.All the associated instances must use Instance Metadata Service Version 2 (IMDSv2). To check your IMDSv2 configuration, see When there is zero IMDSv1 usage and Check if your instances are transitioned to IMDSv2.Default Host Management Configuration is available in SSM Agent version 3.2.582.0 or later. To verify your SSM Agent version, see Checking the SSM Agent version number.To verify the setup for Default Host Management Configuration, complete the following steps:Open the Systems Manager console.In the navigation pane, choose Fleet Manager.From the Account management dropdown list, choose Default Host Management Configuration.Verify that the Enable Default Host Management Configuration setting is turned on.You might also use the following AWS Command Line Interface (AWS CLI) command to verify the setup for Default Host Management Configuration:Note: Replace AccountID with your AWS account ID when running commands.aws ssm get-service-setting \--setting-id arn:aws:ssm:RegionID:AccountID:servicesetting/ssm/managed-instance/default-ec2-instance-management-roleWhen Default Host Management Configuration is set up, you'll receive a response similar to the following:{  "ServiceSetting": {    "SettingId": "/ssm/managed-instance/default-ec2-instance-management-role",    "SettingValue": "service-role/AWSSystemsManagerDefaultEC2InstanceManagementRole",     "LastModifiedDate": 1679492424.738,    "LastModifiedUser": "arn:aws:sts::012345678910:assumed-role/role/role-name",    "ARN": "arn:aws:ssm:ap-southeast-1:012345678910:servicesetting/ssm/managed-instance/default-ec2-instance-management-role",    "Status": "Customized"  }}Note: If the value for SettingValue is $None, then Default Host Management Configuration isn't configured.Verify that Default Host Management Configuration is using an appropriate IAM roleThe AWSSystemsManagerDefaultEC2InstanceManagementRole role is the recommended IAM role when you set up Default Host Management Configuration. To use a different role, make sure that the role has the AmazonSSMManagedEC2InstanceDefaultPolicy IAM policy attached to it.If you have instance profiles attached to your EC2 instances, then remove any permissions that allow the ssm:UpdateInstanceInformation operation. SSM Agent tries to use instance profile permissions before using the Default Host Management Configuration permissions. When you allow the ssm:UpdateInstanceInformation operation in your instance profiles, your instance doesn't use the Default Host Management Configuration permissions.Verify that the correct IAM role is attached to the instanceNote: If you're using Default Host Management Configuration, then skip to the Verify connectivity to IMDS section.To make API calls to a Systems Manager endpoint, you must attach the AmazonSSMManagedInstanceCore policy to the IAM role that's attached to your instance. If you're using a custom IAM policy, then confirm that your custom policy uses the permissions found in AmazonSSMManagedInstanceCore. Also, make sure that the trust policy for your IAM role allows ec2.amazonaws.com to assume this role.For more information, see Add permissions to a Systems Manager instance profile (console).Verify connectivity to IMDSSSM Agent must communicate with Instance Metadata Service (IMDS) to obtain necessary information about your instance. To test the connection, run the following Netcat command:nc -vz 169.254.169.254 80To verify that IMDS is set up for your existing instance, do one of the following steps:Open the Amazon EC2 console. In the navigation pane, choose Instances, select your instance, and then choose Actions, Instance settings, Modify instance metadata options. In the dialog box, Instance metadata service must be Enabled.In the AWS CLI, run the describe-instances CLI command.aws ec2 describe-instances --query "Reservations[*].Instances[*].MetadataOptions" --instance-ids i-012345678910Output example:[  [    {      "State": "applied",      "HttpTokens": "optional",      "HttpPutResponseHopLimit": 1,      "HttpEndpoint": "enabled",      "HttpProtocolIpv6": "disabled",      "InstanceMetadataTags": "disabled"    }  ]]Note: "HttpTokens": "optional" means both IMDSv1 and IMDSv2 are supported. "HttpTokens": "required" means IMDSv2 is supported. "HttpEndpoint": "enabled" means that IMDS is turned on.If you're using a proxy on your instance, then the proxy might block connectivity to the metadata URL. To avoid this, make sure that you configure your SSM Agent to work with a proxy and set no_proxy for the metadata URL. To configure SSM Agent to use a proxy, see the following documentation:Linux: Configure SSM Agent to use a proxy (Linux)macOS: Configure SSM Agent to use a proxy (macOS)Windows: Configure SSM Agent to use a proxy for Windows Server instancesAdditional troubleshootingIf your instance still doesn't appear as a managed node or shows a lost connection in Systems Manager, then continue troubleshooting in the SSM Agent logs:Linux and macOS: The SSM Agent logs are in /var/log/amazon/ssm.Windows: The SSM Agent logs are in %PROGRAMDATA%\Amazon\SSM\Logs.When your instance isn't reporting to SSM Agent, try signing in using RDP (Windows) or SSH (Linux) to collect the logs. If you can't collect the logs, then you must stop your instance and detach the root volume. Then, attach the root volume to another instance in the same Availability Zone as a secondary volume to obtain the logs.Related informationAttach an Amazon Elastic Block Store (Amazon EBS) volume to an instanceDetach an Amazon EBS volume from a Linux instanceMake an Amazon EBS volume available for use on LinuxMake an Amazon EBS volume available for use on WindowsFollow"


Question: Why can't I access a VPC to launch my Amazon Redshift cluster?

"I want to launch an Amazon Redshift cluster in a specific Amazon Virtual Private Cloud (Amazon VPC). However, I can't access my VPC from the dropdown list."

Answer: "I want to launch an Amazon Redshift cluster in a specific Amazon Virtual Private Cloud (Amazon VPC). However, I can't access my VPC from the dropdown list.Short descriptionYou might not be able to select and access your VPC for the following reasons:The VPC doesn't exist in the same AWS Region where you're trying to create your Amazon Redshift cluster in.The VPC isn't associated with a cluster subnet group.ResolutionTo access your VPC in Amazon Redshift, perform the following steps:1.    Create a VPC in the same Region where you want to launch an Amazon Redshift cluster.2.    Create a cluster subnet group.Note: To improve fault tolerance, it's a best practice to create a cluster subnet group with two or more subnets from different Availability Zones. However, all the nodes in a cluster must be in the same Availability Zone.3.    Launch an Amazon Redshift cluster into the VPC. In the Additional configurations section, switch off Use defaults. Then, choose the VPC that you want from the dropdown list.Related informationAmazon Redshift cluster subnet groupsFollow"


Question: How can I use a static or Elastic IP address for an Amazon ECS task on Fargate?

I want to use a static or Elastic IP address for an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate.

Answer: "I want to use a static or Elastic IP address for an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate.Short descriptionYou can't add a static IP address or Elastic IP address directly to a Fargate task. To use a static IP or Elastic IP with Fargate tasks, first create a Fargate Service with a Network Load Balancer. Then, attach the Elastic IP address of the task to the Load Balancer.Choose one of the following options:To create a static IP address for a Fargate task for inbound traffic, complete the following steps in the Resolution section.To create a static IP address for a Fargate task for outbound traffic, create a NAT gateway. In this scenario, a static IP address is required by the downstream consumer. You must place your Fargate task on a private subnet. You can use the NAT gateway IP address for an IP allow list.ResolutionCreate a network load balancer, and then configure routing for your target groupOpen the Amazon EC2 console.In the navigation pane, under Load Balancing, choose Load Balancers.Choose Create Load Balancer.On the Select load balancer type page, choose Create for Network Load Balancer.On the Create Network Load Balancer page, for Load balancer name, enter a name for your load balancer.For Scheme, select either Internet-facing or internal.For IP address type, select IPv4.In the Network mapping section, for VPC, select the Amazon Virtual Private Cloud (Amazon VPC) for your Fargate task.For Mappings, select at least one Availability Zone and one subnet for each Availability Zone.Note: Turning on multiple Availability Zones increases the fault tolerance of your applications. For internet-facing load balancers, select an Elastic IP address for each Availability Zone. This provides your load balancer with static IP addresses. Or, for an internal load balancer, assign a private IP address from the IPv4 range of each subnet instead of letting AWS assign one for you.In the Listeners and routing section, keep the default listener or add another listener.Note: The default listener accepts TCP traffic on port 80. You can keep the default listener settings, modify the protocol or port of the listener, or choose Add listener to add another listener.For Protocol, select your protocol.For Port, select your port.Under Default action, choose Create target group.Note: The target group is used by the Network Load Balancer listener rule that forwards the request to the target group.On the Specify group details page, for Choose a target type, select IP addresses.Note: The target type Instances isn't supported on Fargate.For Target group name, enter a name for your target group.In the Health checks section, keep the default settings.Choose Next.Note: Load balancers distribute traffic between targets within the target group. When a target group is associated with an Amazon ECS service, Amazon ECS automatically registers and deregisters containers with the target group. Because Amazon ECS handles target registration, you don't need to add targets to your target group.On the Register targets page, choose Create target group.Navigate to the Create Network Load Balancer page.In the Listeners and routing section, for Forward to, select the target group that you created.Note: You must select the reload button to see the new target group after it has been created.Choose Create load balancer.Create an Amazon ECS serviceCreate an Amazon ECS service. Be sure to specify the target group in the service definition when you create your service.When each task for your service is started, the container and port combination specified in the service definition is registered with your target group. Then, traffic is routed from the load balancer to that container.Related informationService load balancingFollow"


Question: How do I troubleshoot InsufficientInstanceCapacity errors when starting or launching an EC2 instance?

"I'm unable to start or launch my Amazon Elastic Compute Cloud (Amazon EC2) instance, and I'm receiving an insufficient capacity error. How can I troubleshoot this issue and be sure that I have enough capacity for my critical machines?"

Answer: "I'm unable to start or launch my Amazon Elastic Compute Cloud (Amazon EC2) instance, and I'm receiving an insufficient capacity error. How can I troubleshoot this issue and be sure that I have enough capacity for my critical machines?Short descriptionIf AWS doesn't currently have enough available On-Demand capacity to complete your request, you'll receive the following InsufficientInstanceCapacity error:"An error occurred (InsufficientInstanceCapacity) when calling the RunInstances operation (reached max retries: 4). We currently do not have sufficient capacity in the Availability Zone you requested."ResolutionIf you receive this error, do the following:For troubleshooting steps, see Insufficient instance capacity.If the preceding troubleshooting steps don't resolve the problem, then you can move the instance to another VPC or to another subnet and Availability Zone.To avoid insufficient capacity errors on critical machines, consider using On-Demand Capacity Reservations. To use an On-Demand Capacity Reservation, do the following:Create the Capacity Reservation in an Availability Zone.Launch critical instances into your Capacity Reservation. You can view real-time Capacity Reservation usage, and launch instances into it as needed.Related informationWhy am I unable to start or launch my EC2 instance?Follow"


Question: Clients are receiving certificate error messages when trying to access my website using HTTPS connections. How do I resolve this?

I'm using a certificate from AWS Certificate Manager (ACM). My clients are receiving warning messages that say the connection is not secure or private. What can I do to resolve these certificate error messages?

Answer: "I'm using a certificate from AWS Certificate Manager (ACM). My clients are receiving warning messages that say the connection is not secure or private. What can I do to resolve these certificate error messages?Short descriptionIf you are using HTTPS connections, then a server certificate is required. A server certificate is an x.509 v3 data structure signed by a certificate authority (CA). A server certificate contains the name of the server, the validity period, the public key, and other data. When your browser accesses the web server, all the data fields must be valid. Your browser considers invalid data fields an insecure connection.You can receive a certificate error message if:The certificate isn't valid for the name of the server.The certificate is expired.The SSL/TLS certificate for the website isn't trusted.Your connection is not fully secured.ResolutionThe certificate is not valid for the name of the serverCheck the domain that you're accessing, and then check the domain names included in your certificate. You can view the domain name using your browser and by checking the certificate details. The domain in the URL must match at least one of the domain names included in the certificate.If you use a wildcard name (*), then the wildcard matches only one subdomain level. For example, *.example.com can protect login.example.com and test.example.com, but the wildcard can't protect test.login.example.com or example.com. If your website can be accessed by example.com and www.example.com, then you can add multiple domain names to your certificate to cover other possible domain and subdomain names of your website.The certificate is expiredIf you use an ACM-issued certificate, then ACM tries to renew the certificate automatically. If the certificate is expired, then you must issue or import a new certificate. After a new certificate is issued, confirm that your DNS records are pointing to the AWS resource, such as a load balancer, where the ACM certificate is used. For more information, see Troubleshoot managed certificate renewal problems.The SSL/TLS certificate for the website is not trustedACM-issued certificates are trusted by most modern browsers, operating systems, and mobile devices. Update your browser to the latest version, or try to access the domain from a different computer and browser. If you imported a self-signed certificate using AWS Certificate Manager (ACM), then some browsers can't trust the certificate. To resolve this error, request a public certificate using ACM or contact your CA.Your connection is not fully securedMixed content can occur if an initial request and parts of the webpage are established over HTTPS, and other parts are established over HTTP. Webpage visitors see the error “Your connection is not fully secured” with mixed content. This is because webpage elements in your source code use HTTP instead of HTTPS. To resolve this error, update your source code to load all the resources on your page over HTTPS.Related informationHow do I upload SSL certificates for my Classic Load Balancer to prevent clients from receiving “untrusted certificate” errors?Listeners for your Classic Load BalancerImporting certificates into AWS Certificate ManagerFollow"


Question: I want to troubleshoot performance bottlenecks within my EC2 Linux instances. What advanced tools can I use with EC2Rescue for Linux to do that?

"I want to troubleshoot performance bottlenecks within my Amazon Elastic Compute Cloud (Amazon EC2) instances running Amazon Linux 1 or 2, RHEL or CentOS. What tools can I use with EC2Rescue for Linux to do that?"

Answer: "I want to troubleshoot performance bottlenecks within my Amazon Elastic Compute Cloud (Amazon EC2) instances running Amazon Linux 1 or 2, RHEL or CentOS. What tools can I use with EC2Rescue for Linux to do that?Short descriptionPerformance bottlenecks on Linux instances running Amazon Linux 1 or 2, RHEL, or CentOS can occur in CPU performance, block I/O performance, or network performance. To determine where performance bottlenecks are happening, you can leverage the 33 tools available in EC2Rescue for Linux using the bcc framework in eBPF (extended Berkeley Packet Filter). eBPF efficiently and securely runs monitoring tools in production environments without significant performance overhead.Note: This resolution doesn't apply to instances running Debian or Ubuntu.Resolution(For experienced Linux system administrators)Install the bcc package for your operating system.1.    Connect to your instance using SSH.2.    Install the bcc package. For download and installation instructions for distributions other than Amazon Linux, refer to the documentation specific to your distribution. For Amazon Linux instances, use the following command:$ sudo yum install bcc3.    The bcc tools must be in the PATH variable on your operating system for EC2 Rescue for Linux to run them. Use the following command to put the tools in the PATH variable:$ sudo -s# export PATH=$PATH:/usr/share/bcc/tools/4.    It's a best practice to permanently add the PATH setting to your Linux system. The steps to make this setting permanent vary depending on your specific Linux distribution. For Amazon Linux, use the following commands:Open ~/.bash_profile using the vi editor:# vi ~/.bash_profileAppend /usr/share/bcc/tools to the PATH variable:PATH=$PATH:$HOME/bin:/usr/share/bcc/toolsSave the file and exit the vi editor.Source the updated profile:#source ~/.bash_profile6.    Download and install the EC2 Rescue for Linux tool, and then navigate to the installation directory on your instance.The following are commonly used bcc-based modules used with EC2Rescue for Linux.CPU performance toolsbccsoftirqs.yaml - This module runs the softirqs tool that traces soft interrupts (IRQs), and then stores timing statistics in-kernel for efficiency. An interval can be provided using --period, and a count using --times argument. The tool automatically prints the timestamps for each time it runs. For more information, see EC2Rescue for Linux - bccsoftirqs.yaml on the GitHub website.bccrunqlat.yaml - This program shows how long tasks have spent waiting their turn to run on-CPU. Results are shown as a histogram. For more information, see EC2Rescue for Linux - bccrunqlat.yaml on the GitHub website.# ./ec2rl run --only-modules=bccsoftirqs,bccrunqlat --period=5 --times=5Block I/O performance toolsbccbiolatency.yaml - Traces block device I/O, and records the distribution of I/O latency (time) per disk device, such as an instance store and Amazon Elastic Block Store (Amazon EBS), attached to your EC2 instance. Results are printed as a histogram. The module runs for the specified period and collects output a specified number of times. In the example below, the period and times variables are set to 5. For more information, see EC2Rescue for Linux - bccbiolatency.yaml on the GitHub website.bccext4slower.yaml - Collects output using the ext4slower tool. ext4slower traces any ext4 reads, writes, opens, and fsyncs that are slower than a threshold of 10 ms by default. The module runs for the specified period and collects output a specified number of times. In the example below, the period and times variables are set to 5. For more information, see EC2Rescue for Linux - bccext4slower.yaml on the GitHub website.You can use the bccxfsslower module similarly to bccext4slower.yaml for XFS file systems. For more information, see EC2Rescue for Linux - bccxfsslower.yaml on the GitHub website.bccfileslower.yaml - Collects output using fileslower that traces file-based synchronous reads and writes slower than a default threshold of 10 ms. The module runs for the specified period and then collects output a specified number of times. In the example below, the period and times variables are set to 5. For more information, see EC2Rescue for Linux - bccfileslower.yaml on the GitHub website.# ./ec2rl run --only-modules=bccbiolatency,bccext4slower,bccfileslower --period=5 --times=5Network performance toolsbcctcpconnlat.yaml - Traces the kernel function performing active TCP connections (for example, through a connect() syscall). The results display the latency (time) for the connection. Latency is measured locally, meaning the time from SYN sent to the response packet for a specified period. TCP connection latency indicates the time taken to establish a connection. For more information, see EC2Rescue for Linux - bcctcpconnlat.yaml on the GitHub website.bcctcptop.yaml - Displays TCP connection throughput per host and port for the specified period and times without clearing the screen. For more information, see EC2Rescue for Linux - bcctcptop.yaml on the GitHub website.bcctcplife.yaml - Summarizes TCP sessions that open and close while tracing. For more information, see EC2Rescue for Linux - bcctcplife.yaml on the GitHub website.# ./ec2rl run --only-modules=bcctcpconnlat,bcctcptop,bcctcplife --period=5 --times=5Output exampleThe results of running these modules are located under the /var/tmp/ec2rl directory after each single run of one or more modules on your instance.The following example is the output from the bcctcptop module with the period parameter set to 5 and the times parameter set to 2:# ./ec2rl run --only-modules=bcctcptop --period=5 --times=2        # cat /var/tmp/ec2rl/2020-04-20T21_50_01.177374/mod_out/run/bcctcptop.log I will collect tcptop output from this alami box 2 times.Tracing... Output every 5 secs. Hit Ctrl-C to end21:50:17 loadavg: 0.74 0.33 0.17 5/244 4285PID    COMM         LADDR                 RADDR                  RX_KB  TX_KB3989   sshd         172.31.22.238:22      72.21.196.67:26601         0      921:50:22 loadavg: 0.84 0.36 0.18 4/244 4285PID    COMM         LADDR                 RADDR                  RX_KB  TX_KB3989   sshd         172.31.22.238:22      72.21.196.67:26601         0     112731   amazon-ssm-a 172.31.22.238:54348   52.94.225.236:443          5      42938   amazon-ssm-a 172.31.22.238:58878   52.119.197.249:443         0      0You can upload results to AWS Support using the following command:# ./ec2rl upload --upload-directory=/var/tmp/ec2rl/2020-04-20T21_50_01.177374 --support-url="URLProvidedByAWSSupport"Note: The quotation marks in the preceding command are required. If you run the tool with sudo, upload the results using sudo. Run the command help upload for details on using an Amazon Simple Storage Service (Amazon S3) presigned URL to upload the output.Related informationHow do I diagnose high CPU utilization on an EC2 Windows instance?Follow"


Question: How can I troubleshoot slow performance when I copy local files to Storage Gateway?

"I want to copy local files to my Network File System (NFS) or Server Message Block (SMB) file share on AWS Storage Gateway, but the transfer is slow. How can I improve the upload performance?"

Answer: "I want to copy local files to my Network File System (NFS) or Server Message Block (SMB) file share on AWS Storage Gateway, but the transfer is slow. How can I improve the upload performance?ResolutionConsider the following ways to improve the performance when you copy local files to a file share on Storage Gateway:Note: A file gateway is an object-store cache, not a file server. This means that a file gateway's performance characteristics differ from those of file servers.Scale your workloadFor the best performance, scale your workload by adding threads or clients. When you transfer a directory of files, a file gateway scales best when the workload is multi-threaded or involves multiple clients. Review your file-management tool and confirm whether the tool runs single-threaded uploads by default.It's a best practice to use multiple threads or clients when you transfer small or large files. You get the highest MiB per second throughput when you transfer large files (tens or hundreds of MiB each) using multiple threads. Because of the overhead of creating new files, transferring many small files results in a lower MiB per second throughput when compared to the same workload with large files.To perform a multi-threaded copy in Windows, use robocopy, a file copy tool by Microsoft.Note: For transfers of smaller files, measure the transfer rate in files per second instead of MiB per second. The rate of file creation can take up workload space associated with transferring smaller files.Tune your cache storageTune your gateway's total cache storage size to the size of the active working set. A cache that uses multiple local disks can parallelize access to data and lead to higher I/O operations per second (IOPS). For more information, see Performance guidance for Amazon Simple Storage Service (Amazon S3) File Gateway.Also, monitor the CachePercentDirty metric for your gateway. This metric returns the percentage of Cache storage that's occupied by data that isn't persisted to an S3 bucket. A high value of CachePercentDirty can cause the gateway's cache storage to throttle writes to the gateway.Use higher-performance disksIt's a best practice to use solid state drive (SSD) backed disks for your gateway's cache storage with dedicated tenancy. Ideally, the underlying physical disks shouldn't be shared with other virtual machines in order to prevent IOPS exhaustion.To measure disk IOPS, use the ReadBytes and WriteBytes metric with the Samples statistic in CloudWatch. As a general rule, when you review these metrics for the gateway, look for low throughput and low IOPS trends to indicate any disk-related bottlenecks.Monitor the IOWaitPercent metric in CloudWatch, which reports the percentage of time that the CPU is waiting for a response from the local disk.. A value higher than 10% typically indicates a bottleneck in the underlying disks and can be a result of slower disks. In this case, add additional disks to provide more available IOPS to the gateway.Note: For Amazon Elastic Compute Cloud (Amazon EC2) based gateways, the Amazon Elastic Block Store (Amazon EBS) throughput of the instance can also be a limiting factor. Confirm that the CPU and RAM of your gateway's host virtual machine or Amazon EC2 instance supports your gateway's throughput to AWS. For example, every EC2 instance type has a different baseline throughput. If burst throughput is exhausted, then the instance uses its baseline throughput, which can limit the upload throughput to AWS. If your gateway is hosted on an Amazon EC2 instance, NetworkOut metric for the instance. If the NetworkOut metric stays at the baseline throughput during your testing, then consider changing the instance to a larger instance type.Follow"


Question: How can I use Sysprep to create and install custom reusable Windows AMIs?

I want to use Sysprep to capture and install a custom reusable Windows Amazon Machine Image (AMI).

Answer: "I want to use Sysprep to capture and install a custom reusable Windows Amazon Machine Image (AMI).Short descriptionYou can use Sysprep, a Microsoft tool, to capture custom Windows images. Sysprep removes unique information from an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance. This information includes the instance security identifiers (SID), computer name, and drivers.ResolutionBefore you run Sysprep, consider the following points:Don't use Sysprep to create a backup for your instance.Don't run Sysprep on a production system.Sysprep isn't supported on Windows Server 2016 Nano Server.For Windows Server 2008 through Windows Server 2012 R2, run Sysprep with EC2Config.For Windows Server 2016 or later, run Sysprep with EC2Launch.Run Sysprep with EC2Config or EC2Launch1.    Open the Amazon EC2 console, and then connect to your Windows EC2 instance using Remote Desktop Protocol (RDP).Note: To create a standard custom image without Sysprep, see Create a Windows AMI from a running instance. Be sure to note the AMI ID.2.    From the Windows Start menu, complete the following steps:For Windows Server 2008 through Windows Server 2012 R2, open EC2ConfigService Settings, and then choose the Image tab.For Windows Server 2016 or later, open EC2LaunchSettings.3.    For Administrator Password, choose Random.4.    Choose Shutdown with Sysprep.5.    Choose Yes.Note: You must retrieve the new password from the EC2 console on the next boot.6.    Open the Amazon EC2 console, and then choose Instances from the navigation pane.7.    After the instance state changes to stopped, select your instance.8.    For Actions, choose Image, Create image.For Image name, enter a name.(Optional) For Image description, enter a description.9.    Choose Create image.For more information and customization options, see Create a standardized Amazon Machine Image (AMI) using Sysprep.If you receive error messages or experience issues when using Sysprep, then see Troubleshoot Sysprep.You can also use EC2Rescue for Windows Server to collect log files and troubleshoot issues.Related informationWhat is Sysprep? (Microsoft)How do I create an AMI that is based on my EBS-backed EC2 instance?How do I launch an EC2 instance from a custom AMI?Why can't I launch EC2 instances from my copied AMI?Follow"


Question: How do I troubleshoot issues with historical reports in Amazon Connect?

"In Amazon Connect, I want to troubleshoot common issues with historical metric reports."

Answer: "In Amazon Connect, I want to troubleshoot common issues with historical metric reports.ResolutionBefore troubleshooting issues with historical reports, be sure you have the permissions required to view historical reports.After a report is published, any user with the Saved reports, Create permission can create, edit, or delete the schedule of your report.Note: Only the user who created the report can delete the report. Admin or emergency access accounts can't delete a saved report published by another user. However, you can use either an Admin account or an emergency access account to access the reports of your instance and unpublish the report. If a report is unpublished, then it's removed from the list of Saved reports, but isn't deleted.Troubleshooting historical report scheduling errorsMissing schedule optionTo schedule reports, you must turn on and configure the Amazon Simple Storage Service (Amazon S3) bucket where the reports will be saved.To configure an Amazon S3 bucket for reports, do the following:Open the Amazon Connect console.On the instances page, choose the instance alias.In the navigation pane, choose Data storage.Choose Edit, and then specify the bucket and KMS key for exported reports.Choose Save.Error message: Schedule report creation unsuccessfulIf you use blank spaces in the prefix to specify the location for the report file in Amazon S3, then the preceding error might occur. When setting up the scheduled report, you can add or update a prefix for the report files. To resolve this error, remove the blank spaces in the prefix, and then schedule the report to run again.Note: Scheduled reports are saved as CSV files in the Amazon S3 bucket specified for reports for your contact center.If correcting the prefix doesn't resolve the error message, then do the following:Create a HAR file to capture browser related issues.Create a Support case.Attach the HAR file and a screenshot of the error message to the support case.Reports aren't scheduled for my time zoneReports can be scheduled only in the UTC time zone. The historical metrics available in the console are viewable in different time zones. For more information, see Schedule a historical metrics report.Troubleshooting historical report creation errorsWhen generating a historical metrics report with filtering you receive the following error: "Failed to generate report. Please try again in a few minutes. Report this error with exceptionId:aabxxxxx-a93c-xxxx-9042-xxxxdf12xxxx"The preceding error might occur when running a historical report with an incorrect configuration. An incorrect configuration includes running a report with metrics that can't be grouped or filtered by queue, phone number, or channel.To resolve this error, remove the following metrics that can't be grouped or filtered:Non-Productive TimeOnline timeError status timeIf changing the report groupings or filters doesn't resolve the error message, then do the following:Create a HAR file to capture browser related issues.Create a Support case. Be sure to indicate the type of report (Queues, Agents, or Phone numbers) and the report custom settings (selected metrics and filters).Attach the HAR file and a screenshot of the error message to the Support case.When generating a historical metrics report, you receive the following error**: "The report includes more records than the maximum allowed. To create a report with fewer records, please select a shorter time range, apply different filters, or select fewer metrics to include in the report. You can also use Amazon Kinesis to stream your contact data for advanced monitoring and analytics."**The preceding error occurs when your historical report exceeds the 80k cell limit for a report. The 80k cell limit applies to the total number of cells (columns * rows), accounting for grouping and filtering. To reduce the report records to under 80,000 cells, consider the following:Create multiple historical reports by customizing the report by Time range.Reduce the selected report criteria, such as, the time interval or the number of historical metrics in the report.Use filters to control the data included in the report.Historical metric report limitationsConsider the following when scheduling historical reports:Using 15 minute intervals creates reports for only three days at a time. Also, the report can't list data more than 35 days old. This means that the report contains data within the past 35 days and only three days of data can be viewed at a time.Using 30 minute intervals creates reports for only three days at a time. Also, the available data is based on a two-year retention period. This means that the report contains data within the past two years and only three days of data can be viewed at a time.Using a Daily interval or Total interval creates reports for 31 days. Also, the available data is based on a two-year retention period. This means that the report contains data within the past two years and only 31 days of data can be viewed at a time.For more information, see Historical report limits.To export records without these limitations, you can turn on data streaming for your Amazon Connect instance. Then, use a consumer, such as an AWS Lambda function, to poll the streams and perform monitoring and analytics. For instructions on streaming and storing contact trace records, see Data streaming on AWS.Follow"


Question: "How do I troubleshoot packet loss, latency, or intermittent connectivity issues with my Client VPN connection?"

"How do I troubleshoot packet loss, latency, or intermittent connectivity issues with my AWS Client VPN connection?"

Answer: "How do I troubleshoot packet loss, latency, or intermittent connectivity issues with my AWS Client VPN connection?Short descriptionTo diagnose network issues such as packet loss, latency, or intermittent connectivity in your Client VPN connection, first test the network to isolate the source of the issue. To isolate the source of the issue, consider:Is this issue affecting all users, or only users on a specific internet service provider (ISP) or at a specific remote location?What connectivity medium are the affected users using to connect to Client VPN? For example, possibly a fixed internet connection, a local WiFi hotspot, or a mobile network.From what device are the affected users connecting? For example, possibly a Windows machine or a mobile device.Where are the affected users located in relation to the Client VPN endpoint?What are users accessing when they experience packet loss, latency, or intermittent connectivity issues?Does the client still experience packet loss, latency, or intermittent connectivity issues to external resources when not connected to Client VPN?Is split-tunnel enabled on the endpoint?ResolutionReview how users connect to the Client VPN endpointThere are several factors involved in troubleshooting performance and connectivity issues with a Client VPN connection. Before progressing to more complicated troubleshooting methods used by network administrators to test connectivity, review the following considerations.For users on a mobile network or WiFi hotspotUsers might have a poor connection with low signal or connectivity issues. Specifically with hotspots accessed in a shared location, there might be bandwidth restrictions. For these types of connections:Test connection speeds using a performance testing tool, such as the Speedtest website. It's a best practice to test from the same Region as the Client VPN endpoint.-or-On Windows, macOS, or Linux-based systems, use ICMP to test connectivity to the default gateway. To check the stability of a WiFi hotspot connection:Ping <Default Gateway IP>Note: Be sure to replace "Default Gateway IP" with the IP address of the default gateway.If there's a poor connection or bandwidth constraints, it's a best practice to connect using a faster or more stable connection and then note any performance improvements.For users in different geographic locationsReview where users are located in relation to the Client VPN endpoint.For example, consider a scenario where split-tunnel isn't enabled and all user traffic is forced over the Client VPN tunnel. A user that's geographically separated from the endpoint might experience elevated latency, packet loss, or intermittent connectivity to resources in the VPC or over the internet. In this case, you can resolve the issues by configuring the VPC to allow this traffic if the intermediate ISPs have issues.If it's not a requirement that traffic from internet resources is forwarded over the VPC, it's a best practice to enable split-tunnel. When you enable split-tunnel on the Client VPN endpoint, the routes in the endpoint route table are pushed to the device that's connected to the Client VPN. Then, only traffic with a destination to the network matching a route from the endpoint route table is routed through the Client VPN tunnel.If necessary, use advanced troubleshooting techniquesIf the previously described methods don't resolve your issues, use the following advanced techniques. These methods can help remote users troubleshoot network connectivity issues between their local device and the Client VPN endpoints.For Windows usersFind the Client VPN endpoint node IP addresses:1.    Open Command Prompt (cmd).2.    Perform nslookup on your endpoint DNS URL:nslookup cvpn-endpoint-0102bc4c2eEXAMPLE.clientvpn.us-west-2.amazonaws.comIf you have trouble resolving the previous command, append a subdomain:nslookup test.cvpn-endpoint-0102bc4c2eEXAMPLE.clientvpn.us-west-2.amazonaws.comUse the MTR method:1.    Download and install WinMTR from the SourceForge website.2.    For Host, enter the destination IP address, and then choose Start.3.    Run the test for approximately one minute, and then choose Stop.4.    Choose Copy text to clipboard, and then paste the output in a text file.5.    Search output in the text file for any losses in the % column that are propagated to the destination.6.    Review hops on the MTR reports using a bottom-up approach. For example, check for loss on the last hop or destination, and then review the preceding hops.Notes:Client VPN doesn't respond to ICMP. However, MTR is still a viable test to confirm that there's no packet loss on the intermediate ISP links.Ignore any hops with the "No response from host" message. This message indicates that those particular hops aren't responding to the ICMP probes.Use the tracert method:If you don't want to install MTR, or need to perform further testing, you can use the tracert command utility tool. Perform a tracert to the destination URL or IP address. Then, look for any hop that shows an abrupt spike in round-trip time (RTT). An abrupt spike in RTT might indicate that there's a node under high load. A node under high load induces latency or packet drops in your traffic.For macOS and Amazon Linux usersFind your Client VPN endpoint node IP addresses:1.    Open Terminal.2.    Perform dig on your endpoint DNS URL:dig cvpn-endpoint-0102bc4c2eEXAMPLE.clientvpn.us-west-2.amazonaws.comIf you have trouble resolving the previous command, append a subdomain:dig test.cvpn-endpoint-0102bc4c2eEXAMPLE.clientvpn.us-west-2.amazonaws.comUse the MTR method:1.    Install MTR.    On macOS, use macOS with Homebrew.On Amazon Linux, use "sudo yum install mtr".On Ubuntu Linux, use "sudo apt-get mtr".2.    Run a TCP-based MTR:mtr -n -T -P 443 -c 200 <Client VPN endpoint IP> --reportmtr -n -T -P 1194 -c 200 <Client VPN endpoint IP> --report-or-Run a UDP-based MTR:mtr -n -u -P 443 -c 200 <Client VPN endpoint IP> --reportmtr -n -u -P 1194 -c 200 <Client VPN endpoint IP> --reportNote: Be sure to test based on the port configured on your Client VPN endpoint. If you find packet loss in your network, refer to your vendor documentation for instructions on how to check network devices for analysis and troubleshooting. Or, reach out to your internet service provider.Follow"


Question: How can I access an API Gateway private REST API in another AWS account using an interface VPC endpoint?

I want to use an interface virtual private cloud (VPC) endpoint to access an Amazon API Gateway private REST API that's in another AWS account.

Answer: "I want to use an interface virtual private cloud (VPC) endpoint to access an Amazon API Gateway private REST API that's in another AWS account.Short descriptionTo use an interface VPC endpoint to access an API Gateway private REST API that's in another AWS account, complete the following steps:Create an interface endpoint in an Amazon Virtual Private Cloud (Amazon VPC) in one account (account A).Create an API Gateway private REST API in a second account (account B).Configure a resource policy for the private REST API that allows the interface endpoint to invoke the API.Set up a method for the private REST API.Deploy the private REST API.Call the private REST API from account A to test the setup.Note: The Amazon API Gateway private REST API and the VPC endpoint must be in the same AWS Region.ResolutionCreate an interface endpoint in an Amazon VPC in one account (account A)Create a new interface VPC endpointFrom account A, follow the instructions in Create an interface VPC endpoint for API Gateway execute-api.Important: For Policy, choose Full access. It's a best practice to use a VPC endpoint policy to restrict endpoint access by API ID. It's also a best practice to use the API Gateway resource policy to restrict endpoint access by principal. For more information on the security advice of granting least privilege, see Apply least-privilege permissions in the IAM User Guide.As you create the interface endpoint, consider take the following actions:It's a best practice to select multiple subnets in different Availability Zones. Configuring subnets across multiple Availability Zones makes your interface endpoint resilient to possible AZ failures.With private DNS activated, you can use public or private DNS to connect to your private REST API.Note: When you activate private DNS for an interface VPC endpoint, you can no longer access API Gateway public APIs from your Amazon VPC. For more information, see Why do I get an HTTP 403 Forbidden error when connecting to my API Gateway APIs from a VPC?The security groups that you choose must have a rule that allows TCP Port 443 inbound HTTPS traffic from one of the following places:An IP address range in your Amazon VPC-or-Another security group in your Amazon VPCNote: If you don't have a security group that meets either of these requirements, then choose Create a new security group. Create a new security group that meets one of the requirements. If you don't specify a security group, then a default security group is associated with the endpoint network interfaces.Retrieve the interface endpoint's VPC Endpoint IDAfter you choose Create endpoint and create the interface endpoint, the VPC Endpoint ID appears. Copy the VPC Endpoint ID of your new interface endpoint (for example: vpce-1a2b3c456d7e89012). Then, choose Close.Note: Use this ID when creating and configuring your private REST API.Retrieve the interface endpoint's public DNS nameAfter you choose Close, the Endpoints page opens in the Amazon VPC console. On the Details tab of the Endpoints page, in the DNS names column, find and copy the public DNS name for your interface endpoint. For example: vpce-1a2b3c456d7e89012-f3ghijkl.execute-api.region.vpce.amazonaws.com.Create an API Gateway private REST API in a second account (account B)1.    In account B, open the API Gateway console.2.    Choose Create API.3.    For Choose an API type, Under REST API Private, choose Build.4.    On the Create page, keep Choose the protocol set to REST.5.    For Create new API, choose New API.6.    Under Settings, enter the following information:For API name, enter a name for your API.(Optional) For Description, enter a description for your API.Keep Endpoint Type set to Private.For VPC Endpoint IDs, paste your interface endpoint ID. Then, choose Add.Note: When you associate your interface endpoint with your private REST API, API Gateway generates a new Amazon Route 53 alias record. You can use the Route53 alias to access your private API.7.    Choose Create API.For more information, see Creating a private API in Amazon API Gateway.Configure a resource policy for the private REST API that allows the interface endpoint to invoke the API1.    In the navigation pane of the API Gateway console, under your API, choose Resource Policy.2.    On the Resource Policy page, paste the following example resource policy into the text box:Note: Replace vpce-1a2b3c456d7e89012 with the interface endpoint ID that you copied.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Deny",      "Principal": "*",      "Action": "execute-api:Invoke",      "Resource": "execute-api:/*/*/*",      "Condition": {        "StringNotEquals": {          "aws:sourceVpce": "vpce-1a2b3c456d7e89012"        }      }    },    {      "Effect": "Allow",      "Principal": "*",      "Action": "execute-api:Invoke",      "Resource": "execute-api:/*/*/*"    }  ]}For more information, see Set up a resource policy for a private API.Set up a method for the private REST API1.    In the navigation pane of the API Gateway console, under your API, choose Resources.2.    On the Resources pane, choose Actions, and then choose Create Method.3.    In the dropdown list under the / resource node, choose ANY, and then choose the check mark icon.4.    On the / - ANY - Setup pane, for Integration type, choose Mock.Note: A mock integration responds to any request that reaches it. This response helps when testing.5.    Choose Save.For more information, see Set up REST API methods in API Gateway.Deploy the private REST API1.    On the Resources pane of the API Gateway console, choose Actions, and then choose Deploy API.2.    In the Deploy API dialog box, enter the following information:For Deployment stage, choose [New Stage].For Stage name, enter a name. For example, dev or test.Choose Deploy.3.    On the Stage Editor pane, find the message ("If Private DNS is enabled, use this URL:"). This includes your private REST API's invoke URL. Copy the URL.Note: Use the private REST API's invoke URL for testing the setup.For more information, see Deploy a private API using the API Gateway console.Test the setup by calling the private REST API from account A1.    In account A, launch an Amazon Elastic Compute Cloud (Amazon EC2) instance in the same Amazon VPC as your interface endpoint.Important: During setup, choose the existing security group that you associated with your interface endpoint.2.    Connect to the Amazon EC2 instance.Note: An amazon EC2 instance can incur charges on your AWS account. If you create an instance for testing this setup only, then terminate the instance when you're done to prevent recurring charges.3.    From the command line of your Amazon EC2 instance, use any of the following curl commands to call the private REST API in account B.Note: For more information, see Invoking your private API using endpoint-specific public DNS hostnames. For more information about curl, see the curl project website.Call your API using a Private DNS namecurl -i https://a1bc234d5e.execute-api.region.amazonaws.com/stage-nameNote: Replace https://a1bc234d5e.execute-api.region.amazonaws.com/stage-name with your private API's invoke URL that you copied from the API Gateway console. This command works only if you turned on private DNS for your interface endpoint. For more information, see Invoking your private API using private DNS names.Call your API using a Route 53 aliascurl -i https://a1bc234d5e-vpce-1a2b3c456d7e89012.execute-api.region.amazonaws.com/stage-nameNote: Replace a1bc234d5e with your API's ID.Replace vpce-1a2b3c456d7e89012 with the interface endpoint ID.Replace region with your API's Region. (For example, us-east-1.)Replace stage-name with the name of the stage where you deployed your private API. For more information, see Accessing your private API using a Route53 alias.Call your API using a public DNS name with a host headercurl -i https://vpce-1a2b3c456d7e89012-f3ghijkl.execute-api.region.vpce.amazonaws.com/stage-name -H "Host: a1bc234d5e.execute-api.region.amazonaws.com"Note: Replace vpce-1a2b3c456d7e89012-f3ghijkl.execute-api.region.vpce.amazonaws.com with the public DNS name that you noted in the Amazon VPC console.Replace stage-name with the name of the stage where you deployed your private API.Replace a1bc234d5e.execute-api.region.amazonaws.com with your private API's invoke URL from the API Gateway console.Call your API using a public DNS name with the x-apigw-api-id headercurl -i https://vpce-1a2b3c456d7e89012-f3ghijkl.execute-api.region.vpce.amazonaws.com/stage-name -H "x-apigw-api-id:a1bc234d5e"Note: Replace vpce-1a2b3c456d7e89012-f3ghijkl.execute-api.region.vpce.amazonaws.com with the public DNS name that you noted in the Amazon VPC console.Replace stage-name with the name of the stage where you deployed your private API.Replace a1bc234d5e with your API's ID.4.    Review the command output. API Gateway returns a 200 OK response if the connection is successful.Related informationUse VPC endpoint policies for private APIs in API GatewayHow do I troubleshoot issues when connecting to an API Gateway private API endpoint?Access an AWS service using an interface VPC endpointFollow"


Question: How can I use messaging construct features to customize my interactions in Amazon Lex?

"I want to customize my interaction with the bot in Amazon Lex. How can I use messaging constructs like response cards, message groups, and intent contexts to customize my interactions with the bot?"

Answer: "I want to customize my interaction with the bot in Amazon Lex. How can I use messaging constructs like response cards, message groups, and intent contexts to customize my interactions with the bot?Short descriptionAmazon Lex V2 provides you with a number of messaging construct features that allow you to customize user interactions with bots. Follow the steps in this article to customize messaging constructs like response cards, message groups, and intent contexts using the Amazon Lex V2 console.ResolutionResponse CardsResponse cards consist of a set of responses to a prompt. You can use response cards when you want Amazon Lex to provide a predefined set of applications to a client application. For example, in a taxi booking application, you can configure the types of vehicles available for a user, like compact, van, or SUV. The vehicle types are displayed as buttons in the response cards, and your application users chooses one of the available options. This option is then sent as input to Amazon Lex.To create a response card using the Amazon Lex V2 console for slot prompt, follow these steps:1.    Open the Amazon Lex V2 console, and then choose the intent where the slot is configured.2.    From the slots section, choose the slot, and then choose Advanced options.3.    From the to slot prompts section, choose More prompt options.4.    Choose the Add dropdown, and then choose Add card group. You can now create cards and card groups, as needed.Note: You can define up to three cards per group. A user selects one card during a conversation.Message groupsA message group is a set of suitable responses to a specific prompt. You can use message groups when you want your bot to dynamically build the responses in a conversation. When Amazon Lex returns a response to a client application, it randomly chooses one message from each group.For example, in a TaxiBooking bot, your first message group might contain different ways that the bot will greet the user. It might use “Hello”, “Hi” , "Hey", or “Greetings”. The second message group might contain different forms of introduction like “I am the TaxiBooking chatbot” or “This is the TaxiBooking chatbot.” A third message group might communicate capabilities like “I can help with the Taxi booking” or "I am here to assist you with taxi booking". Amazon Lex randomly selects one message from each group, and then uses them to give a response to the user.Follow these steps to create multiple message groups for success fulfillment messages using the Amazon Lex V2 console.1.    Open the Amazon Lex V2 console, and then choose the intent that you want to customize.2.    From the fulfillment section, choose Advanced options.3.    From the Success response section, choose More response options.4.    Choose the Add dropdown, and then choose Add text message group. You can now create messages and message groups, as needed.ContextsA context is a state variable that can be associated with an intent when you define a bot. You can configure the contexts for an intent when you create the intent using the console or using the CreateIntent operation.There are two types of relationships for contexts, output contexts and input contexts. An output context becomes active when an associated intent is fulfilled. After a context is activated, it stays active for the number of turns or for a time limit that you configure when you define the context.An input context specifies the conditions under which an intent is recognized. An intent is only recognized during a conversation when all of its input contexts are active. An intent with no input contexts is always eligible for recognition.Create an output contextAmazon Lex makes an intent's output contexts active when the intent is fulfilled. You can use the output context to control the intent's eligibility to follow up the current intent. You can configure an intent with more than one output context. When the intent is fulfilled, all of the output contexts are activated and returned in the RecognizeText or RecognizeUtterance response.When you define an output context, you also define its time to live. This indicates the length of time or number of turns that the context is included in responses from Amazon Lex. A turn is one request from your application to Amazon Lex. Once the number of turns or the time has expired, the context is no longer active.Your application can use the output context, as needed. For example, your application can use the output context to:Change the behavior of the application based on the context. For example, a travel booking application might have one action for the context book_car_fulfilled and a different action for rental_hotel_fulfilled.Return the output context to Amazon Lex as the input context for the next utterance. If Amazon Lex recognizes the utterance as an attempt to use an intent, it uses the context to limit the intents that can be returned to those with the specified context.Follow these steps to create/specify output contexts:1.    Open the Amazon Lex V2 console, and choose the intent that you want to customize.2.    In the Context section, enter the output contexts that you want to create and assign to the intent.Create an input contextYou can set an input context to limit the points in the conversation where the intent is recognized. Intents without an input context are always eligible to be recognized.Follow these steps to create or specify input contexts:1.    Open the Amazon Lex V2 console, and choose the intent that you want to customize.2.    From the Context section, enter the output contexts that you want to create and assign to the intent.For an intent with more than one input context, all contexts must be active to trigger the intent. You can set an input context when you call the RecognizeText, RecognizeUtterance or PutSession operations.Related informationImageReponseCardMessageGroupOutputContextInputContextFollow"


Question: How do I connect agents in my Amazon Connect contact center to incoming calls automatically?

"When agents in my Amazon Connect contact center are available, I want them to connect to incoming calls automatically. How do I set that up?"

Answer: "When agents in my Amazon Connect contact center are available, I want them to connect to incoming calls automatically. How do I set that up?ResolutionActivate Auto-Accept Call for your agents in Amazon Connect. When the Auto-Accept Call setting is turned on for an available agent, the agent connects to incoming contacts automatically.Auto-Accept Call doesn't work for callbacks.Note: You must edit existing users individually to activate the Auto-Accept Call setting in your Amazon Connect instance. However, you can configure the setting for multiple new users when you bulk upload users with the CSV template.Follow"


Question: How do I troubleshoot issues with including metadata on an EC2 instance in CloudFormation?

"I used AWS::CloudFormation::Init to include metadata on an Amazon Elastic Cloud Compute (Amazon EC2) instance, but I don't see the changes on the instance."

Answer: "I used AWS::CloudFormation::Init to include metadata on an Amazon Elastic Cloud Compute (Amazon EC2) instance, but I don't see the changes on the instance.Short descriptionIssues with EC2 instance metadata in an AWS CloudFormation stack can occur due to the following reasons:The cfn-init helper script isn't installed on one or more instances of the CloudFormation stack. To resolve this issue, complete the steps in the Verify that the cfn-init helper script is installed section.The instance isn't connected to the internet. To resolve this issue, complete the steps in the Verify that the instance is connected to the internet section.The CloudFormation template contains syntax errors or incorrect values. To resolve this issue, complete the steps in the Search for errors in the cloud-init or cfn-init logs section.Important: Before you complete the following resolutions, set the Rollback on failure option for your CloudFormation stack to No.Note: The following resolutions are specific to CloudFormation stacks that are created with Linux instances.ResolutionVerify that the cfn-init helper script is installedTo confirm that cfn-init is installed on the instance that's configured to send signals to CloudFormation resources:1.    Connect to the instance using SSH.2.    Run one of the following commands to verify that cfn-init or the aws-cfn-bootstrap package is installed in your directory.cfn-init:$ sudo find / -name cfn-init/opt/aws/bin/cfn-init/opt/aws/apitools/cfn-init/opt/aws/apitools/cfn-init-1.4-34.24.amzn1/bin/cfn-init/var/lib/cfn-init-or-aws-cfn-bootstrap package:$ sudo rpm -q aws-cfn-bootstrapaws-cfn-bootstrap-1.4-34.24.amzn1.noarchImportant: The preceding command works only on distributions that use the RPM Package Manager.Note: By default, CloudFormation helper scripts are installed on the Amazon Linux Amazon Machine Image (AMI). If CloudFormation helper scripts aren't installed, see CloudFormation helper scripts reference for instructions on how to install them.Verify that the instance is connected to the internetIf the instance is in an Amazon Virtual Private Cloud (Amazon VPC), then it can connect to the internet through:A NAT device in a private subnetAn internet gateway in a public subnetTo test the instance's internet connection, access a public webpage, such as AWS, and run a curl command on the instance. For example:curl -I https://aws.amazon.comNote: If the instance is connected to the internet, then the command returns an HTTP 200 status code.If you're using an interface VPC endpoint, then the endpoint must be located in the same AWS Region as the instance. Also, the security group that's attached to the interface endpoint must allow incoming connections on port 443 from the private subnet of the Amazon VPC.Search for errors in the cloud-init or cfn-init logsTo search for errors in the cloud-init logs or cfn-init logs:1.    Connect to your instance using SSH.2.    Look for detailed error or failure messages by searching for the keywords "error" or "failure" in the following logs:/var/log/cloud-init-output.log/var/log/cloud-init.log/var/log/cfn-init.log/var/log/cfn-init-cmd.logTo parse all instances of the words "error" or "failure" in /var/log/cfn or /var/log/cloud-init files, run the following command:grep -ni 'error\|failure' $(sudo find /var/log -name cfn-init\* -or -name cloud-init\*)Note: The preceding command returns the file name, line number, and error message.Look for cfn-init.log. If you can't find it, then cfn-init wasn't run. You must also check cloud-init-output.log and cloud-init.log to see if there was a failure when running user data. After you identified the error, fix it based on the error message, and then recreate the stack.If cfn-init.log exists, then cfn-init was run, but a failure occurred. Check cfn-init.log to see what went wrong, and fix it based on the error message.To confirm that the UserData property is configured to run cfn-init, complete the following steps:In a code editor, open the AWS CloudFormation template for your stack, and then find the UserData property section.Check for errors, including syntax errors, missing spaces, misspellings, and other typos.Confirm that the values for the stack, resource, and Region properties are correct.For the Fn::Join intrinsic function of the UserData property, use the -v option to run cfn-init in verbose mode. See JSON and YAML example templates.Related informationSetting up VPC endpoints for AWS CloudFormationAWS::CloudFormation::InitHow do I resolve the error "Failed to receive X resource signal(s) within the specified duration" in AWS CloudFormation?Follow"


Question: "How do I convert a .pem file to .ppk, or from .ppk to .pem, on Windows and Linux?"

"I want to convert my Amazon Elastic Compute Cloud (Amazon EC2) Privacy Enhanced Mail (.pem) file to a PuTTY Private Key (.ppk) file. Or, I want to convert a .ppk file to a .pem file."

Answer: "I want to convert my Amazon Elastic Compute Cloud (Amazon EC2) Privacy Enhanced Mail (.pem) file to a PuTTY Private Key (.ppk) file. Or, I want to convert a .ppk file to a .pem file.Short descriptionPuTTY doesn't natively support the private key format (.pem) generated by Amazon EC2. You must convert your private key into a .ppk file before you can connect to your instance using PuTTY. Use the PuTTYgen tool for this conversion.ResolutionWindows - install PuTTYgenMost Windows operating systems have PuTTY installed. If your system doesn't, then download and install PuTTYgen from the SSH website.Windows - convert a .pem file to a .ppk fileStart PuTTYgen, and then convert the .pem file to a .ppk file. For detailed steps, see Convert your private key using PuTTYgen.Windows - convert a .ppk file to a .pem file1.    Start PuTTYgen. For Actions, choose Load, and then navigate to your .ppk file.2.    Choose the .ppk file, and then choose Open.3.    (Optional) For Key passphrase, enter a passphrase. For Confirm passphrase, re-enter your passphrase.Note: Although a passphrase isn't required, it's a best practice to specify one. This is a security measure to protect the private key from unauthorized use. A passphrase makes automation difficult, because users must manually log in to an instance or copy files to an instance.4.    From the menu at the top of the PuTTY Key Generator, choose Conversions, Export OpenSSH Key.Note: If you didn't enter a passphrase, then you receive a PuTTYgen warning. Choose Yes.5.    Name the file and add the .pem extension.6.    Choose Save.Unix or Linux - install PuTTYInstall PuTTY, if it's not already on your system.Important: The Extra Packages for Enterprise Linux (EPEL) repository contains the PuTTY package. You must activate the EPEL repository before you install PuTTY.To install PuTTY, run one of the following commands:RPM-based$ sudo yum install puttyDpkg-based$sudo apt-get install putty-toolsUnix or Linux - convert a .pem file to a .ppk fileOn the instance shell, run the puttygen command to convert your .pem file to a .ppk file:$ sudo puttygen pemKey.pem -o ppkKey.ppk -O privateUnix or Linux - convert a .ppk file to a .pem fileRun the puttygen command to convert a .ppk file into a .pem file:$ sudo puttygen ppkkey.ppk -O private-openssh -o pemkey.pemRelated informationAmazon EC2 key pairs and Linux instancesFollow"


Question: How do I troubleshoot SSML issues in Amazon Connect?

The Speech Synthesis Markup Language (SSML) syntax in my Play prompt contact block isn’t working. How do I troubleshoot issues with SSML tags in Amazon Connect?

Answer: "The Speech Synthesis Markup Language (SSML) syntax in my Play prompt contact block isn’t working. How do I troubleshoot issues with SSML tags in Amazon Connect?ResolutionTo resolve issues with SSML syntax in Amazon Connect, first review this article to identify the specific issue that you’re experiencing. Then, follow the troubleshooting steps listed for that issue.Note: This article covers the most common reasons why SSML issues can occur in Amazon Connect only. Additional troubleshooting steps might be needed for your specific use case.If your contact flow skips the Play prompt block after you’ve configured the block to interpret text to speech as SSMLReview your SSML syntax to identify any reserved characters. Then, replace each reserved character with its corresponding escape code.For a list of reserved characters and their corresponding escape codes, see Reserved Characters in SSML.SSML escape code examplePlain text: You’ve ordered bananas & apples.SSML syntax: <speak>You've ordered bananas & apples.</speak>If the contact attributes in your SSML tags aren’t workingReview the contact attributes in your SSML tags to verify the following:That you’re using supported SSML tags onlyThat the tags include quotes around each contact attributeThat the contact attributes you're using in your tags exist, and that they don't include any typosSSML tag example that includes the "$Attributes.time" contact attribute<speak>Your order for <break time="$.Attributes.time"/> $.Attributes.ordername is completed. No further action needed.</speak>If your prompt is still played in an English accent (voice) after you’ve added a <lang> tag for another languageThe default voice for the Amazon Connect text-to-speech (TTS) feature is configured to American English (en-US). This default voice isn't changed when you change the language of your message using SSML syntax.To change the default voice, you must use a Set voice contact block by doing the following:1.    In your contact flow, add a Set voice block before the Play prompt block.2.    Choose the block title (Set voice). The block's settings menu opens.3.    For Language, select the language that you want customers to hear from the dropdown list.4.    For Voice, select the voice that you want customers to hear from the dropdown list.Note: For a list of AWS Regions that support neural voices, see Feature and Region compatibility in the Amazon Polly developer guide.5.    Choose Save.Follow"


Question: How do I configure security groups and network ACLs when creating a VPC interface endpoint for endpoint services?

I want to configure my security groups and network access control lists (ACLs) when I create an Amazon Virtual Private Cloud (Amazon VPC) interface endpoint to connect an endpoint service.

Answer: "I want to configure my security groups and network access control lists (ACLs) when I create an Amazon Virtual Private Cloud (Amazon VPC) interface endpoint to connect an endpoint service.Short descriptionWhen you create an Amazon VPC interface endpoint with an endpoint service, an elastic network interface is created inside of the subnet that you specify. This VPC interface endpoint inherits the network ACL of the associated subnet. You must also associate a security group with the interface endpoint to protect incoming traffic.When you associate a Network Load Balancer with an endpoint service, the Network Load Balancer forwards requests to the registered target. The requests are forwarded as if the target was registered by IP address. In this case, the source IP addresses are the private IP addresses of the load balancer nodes. If you have access to the Amazon VPC endpoint service, then verify that:The Inbound security group rules of the Network Load Balancer’s targets allow communication from the private IP address of the Network Load Balancer nodesThe rules within the network ACL associated with the Network Load Balancer’s targets allow communication from the private IP address of the Network Load Balancer nodesResolutionFind the network ACL associated with your interface endpointSign in to the Amazon VPC console.Choose Endpoints.Select your endpoint’s ID from the list of endpoints.Choose the Subnets view.Select the associated subnets, which redirects you to the Subnets section of the Amazon VPC console.Note the network ACL associated with the subnets.Find the security group associated with your interface endpointSign in to the Amazon VPC console.Choose Endpoints.Select your endpoint’s ID from the list of endpoints.Choose the Security Groups view.Note the IDs of the associated security groups.Configure the security group associated with the interface endpointA security group acts as a virtual firewall for your Elastic Network Interfaces to control inbound and outbound traffic.Note: Security groups are stateful. When you define a rule in one direction, return traffic is automatically allowed.Configure an inbound rule:For Port Range, enter the same port as your endpoint service.For Source, enter the IP address or network of the initiating client.Note: You don't need to create a rule in the outbound direction of the security group associated with the interface endpoint.Repeat these steps for each security group associated with your interface endpoint.Configure the network ACL associated with the interface endpointA network access control list (ACL) is an optional layer of security for your VPC that acts as a firewall for controlling traffic in subnets.Note: Network ACLs are stateless. You must define rules for both outbound and inbound traffic.For the network ACL that you noted previously, edit the rules.Configure an inbound rule to allow traffic from the client:For Port Range, enter the same port as your endpoint service.For Source, enter the client’s IP address or network.Configure an outbound rule to allow return traffic from the interface endpoint.For Port Range, enter 1024-65535.For Destination, enter the client’s IP address or network.If you have separate network ACLs defined for each subnet, then repeat the steps for each network ACL associated with your interface endpoint.Note: When configuring the security group of the source client, verify that the outbound rules allow connectivity to the private IP addresses of the interface endpoint. The inbound direction of the client's security group is irrelevant. For the Network ACL of the source client, configure rules as follows:Inbound rule:For Port Range, enter the ephemeral port range 1024-65535For Source, enter the interface endpoint's private IP addressOutbound rule:For Port Range, enter the same port as your endpoint serviceFor Destination, enter the interface endpoint's private IP addressRelated informationWhy can't I connect to an endpoint service from my interface endpoint in an Amazon VPC?Why can't I connect to a service when the security group and network ACL allow inbound traffic?Follow"


Question: Why did my ACM certificate request fail?

I requested a public certificate AWS Certificate Manager (ACM) but the request failed. How can I troubleshoot this?

Answer: "I requested a public certificate AWS Certificate Manager (ACM) but the request failed. How can I troubleshoot this?Short descriptionTo troubleshoot failed ACM certificate requests, check the following:Available contactsUnsafe domainsAdditional verification requiredPublic domains that aren't validAmazon-owned domainsResolutionAvailable contactsIf you used email validation to request the certificate, then make sure that:You have a working email address that is registered in WHOIS and that the address is visible with a WHOIS lookup.Your domain is configured to receive email. Your domain's name server must have a mail exchanger record (MX record) so ACM's email servers know where to send the domain validation email.For more information, see Error message: No Available Contacts.Unsafe domainsIf the requested certificate contains at least one domain in its domain scope that was reported as unsafe by VirusTotal, the certificate request fails. To correct the issue, do the following:Search for your domain name on the VirusTotal website to see if it's reported as suspicious.If you believe that the result is a false positive, then notify the organization that is reporting the domain. VirusTotal is an aggregate of several antivirus and URL scanners and can't remove your domain for you.After you correct the problem and the VirusTotal registry is updated, request a new public certificate.For more information, see Error message: Domain Not Allowed.Additional verification requiredThis occurs as a fraud-protection measure if your domain ranks within the Alexa top 1000 websites.Use the AWS Support Center to contact AWS Support. AWS Support will assist you with adding your domains to an allow list. For more information, see Error message: Additional Verification Required.Public domains that aren't validIf the requested certificate includes a public domain that isn't valid, then the certificate fails with the following error:"One or more domain names is not a valid public domain."Request a new certificate, and then make sure that the top-level domains of all domains specified in the certificate’s domain scope are valid.Amazon-owned domainsIf the requested certificate includes an Amazon-owned domain, such as those ending in amazonaws.com, then the certificate request will fail with the following error:"Additional verification required to request certificates for one or more domain names in this request."Request a new certificate with a domain name that isn't owned by Amazon. For more information, see Error message: Additional Verification Required.Related informationCertificate request failsACM certificate characteristicsWhy am I not receiving validation emails when using ACM to issue or renew a certificate?Follow"


Question: How can I resolve the "Cannot initialize SFTP Protocol" error when I connect to an AWS Transfer Family SFTP-enabled server?

"I created an AWS Transfer Family SFTP-enabled server. Then, I created a server user and I added a public key to the user. However, when the user connects to the server using WinSCP, they get the error message "Cannot initialize SFTP Protocol. Is the host running an SFTP server?" How can I fix this?Note: This error message varies across SFTP clients. For example, if you're using Cyberduck, the error is "EOF while reading packet. Please contact your web hosting service provider for assistance." If you're using OpenSSH, the error is "Exit status 1 (Connection closed).""

Answer: "I created an AWS Transfer Family SFTP-enabled server. Then, I created a server user and I added a public key to the user. However, when the user connects to the server using WinSCP, they get the error message "Cannot initialize SFTP Protocol. Is the host running an SFTP server?" How can I fix this?Note: This error message varies across SFTP clients. For example, if you're using Cyberduck, the error is "EOF while reading packet. Please contact your web hosting service provider for assistance." If you're using OpenSSH, the error is "Exit status 1 (Connection closed)."ResolutionThis error typically occurs when the logging role of your AWS Transfer Family server is configured incorrectly. To resolve the error, confirm that the AWS Transfer Family service has permission to assume the logging role that's associated with your server. Verify that the logging role's trust policy allows "Action": "sts:AssumeRole" for the Principal "Service": "transfer.amazonaws.com", similar to the following example statement:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "Service": "transfer.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}Follow"


Question: How do I resolve the DELETE_FAILED error when deleting the capacity provider in Amazon ECS?

I get an error when I use the AWS Command Line Interface (AWS CLI) or an API to delete a capacity provider for my Amazon Elastic Container Service (Amazon ECS) cluster.

Answer: "I get an error when I use the AWS Command Line Interface (AWS CLI) or an API to delete a capacity provider for my Amazon Elastic Container Service (Amazon ECS) cluster.Short descriptionIf you try to delete a capacity provider for your cluster using either the AWS CLI or an API, you might receive one of the following errors:"updateStatus": "DELETE_FAILED""updateStatusReason": "The capacity provider cannot be deleted because it is associated with cluster: your-cluster-name. Remove the capacity provider from the cluster and try again."You might receive these errors for the following reasons:The capacity provider that you're trying to delete is in use by an Amazon ECS service in the capacity provider strategy. The AWS Management Console doesn't let you delete a capacity provider that's in use by an Amazon ECS service. In this scenario, you receive this error message: "The specified capacity provider is in use and cannot be removed" in the console. You can disassociate an existing capacity provider from a cluster only if it's not in use by any existing tasks. If you run the DeleteCapacityProvider AWS CLI command, then the capacity provider transitions into DELETE_FAILED status. To resolve this issue, complete the steps in the Check if your capacity provider is in use by an Amazon ECS service in the capacity provider strategy section.Your capacity provider is used by the default strategy. If you don't choose a capacity provider strategy or launch type when you run a task or create a service, then a capacity provider strategy is associated with your cluster by default. However, the association happens only if the capacity provider is set as the default capacity provider strategy for the cluster. You can delete only the capacity providers that aren't associated with a cluster. To resolve this issue, complete the steps in the Check if your capacity provider is set in the default capacity provider strategy for the cluster section.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.ResolutionCheck if your capacity provider is in use by an Amazon ECS service in the capacity provider strategy1.    If you have multiple services in a cluster, then use the following script to verify the services that are using the capacity provider.Before you run the script, do the following:Set the cluster and capacity provider parameters to your values. Set your AWS CLI credentials to your AWS Region. Install jq from the jq website.#! /bin/bashcluster=clustername capacityprovider=capacityprovidernameservices=$(aws ecs list-services --cluster ${cluster} | jq --raw-output '.serviceArns[]')aws ecs describe-services \    --cluster ${cluster} \    --services ${services} \    | jq -r --arg capacityprovider "${capacityprovider}" \    '.services[] | select(.capacityProviderStrategy[]?.capacityProvider == $capacityprovider) | .serviceName'Note: If the script returns a blank output, then none of the services in the cluster are using the capacity provider. Skip to the Check if your capacity provider is set in the default capacity provider strategy for the cluster section.2.    Update the services that are returned in the output from the script with a new capacity provider.3.    Delete the old capacity provider.Important: You can't update a service using a capacity provider strategy or launch type. You must update the service with another capacity provider.Check if your capacity provider is set in the default capacity provider strategy for the cluster1.    To find the default capacity provider for your cluster, run the following command:$ aws ecs describe-clusters --cluster mycluster | jq '.clusters[].defaultCapacityProviderStrategy'[  {    "capacityProvider": "oldCP",    "weight": 0,    "base": 0  }]2.    To delete the capacity provider, you must modify the default capacity provider strategy for your cluster using either the Amazon ECS console or the AWS CLI.Using the Amazon ECS console:1.    Open the Amazon ECS console.2.    In the navigation pane, choose Clusters, and then choose your cluster.3.    Choose Update Cluster.Using the AWS CLI:$ aws ecs put-cluster-capacity-providers \     --cluster mycluster \     --capacity-providers newCP \     --default-capacity-provider-strategy capacityProvider=newCP \     --region us-east-1$ aws ecs delete-capacity-provider --capacity-provider oldCP$ aws ecs describe-capacity-providers --capacity-provider oldCPNote: In the preceding code example, replace mycluster with your cluster. Replace newCP with the new capacity provider that you want to add. Replace oldCP with the capacity provider that you want to delete.4.    Delete the old capacity provider.Any existing capacity providers associated with a cluster that are omitted from the PutClusterCapacityProviders API call are disassociated from the cluster. The same rules apply to the cluster's default capacity provider strategy.Follow"


Question: How do I set up cross-account access from Amazon QuickSight to an Amazon S3 bucket in another account?

I'm trying to create a dataset in Amazon QuickSight using data from an Amazon Simple Storage Service (Amazon S3) bucket in another account. How can I do this?

Answer: "I'm trying to create a dataset in Amazon QuickSight using data from an Amazon Simple Storage Service (Amazon S3) bucket in another account. How can I do this?Short descriptionComplete the following steps to create cross-account access from Amazon QuickSight (Account A) to an encrypted Amazon S3 bucket in another account (Account B):Update your S3 bucket policy in Account B (where your S3 bucket resides).Add the S3 bucket as a resource that the QuickSight service role (Account A) can access.Allow the QuickSight service role access to the AWS Key Management Service (KMS) key for the S3 bucket.Note: This article assumes that your S3 bucket is encrypted. It's also a best practice to encrypt your S3 bucket with an AWS KMS key. For more information about how to enable default encryption for Amazon S3, see Enabling Amazon S3 default bucket encryption.ResolutionUpdate your S3 bucket policy in Account BTo set up cross-account access from QuickSight to Amazon S3, complete the following steps:1.    Update the bucket policy of your S3 bucket in Account B. For example:{  "Version": "2012-10-17",  "Id": "BucketPolicy",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::<Account A>:role/service-role/aws-quicksight-service-role-v0"      },      "Action": [        "s3:ListBucket",        "s3:GetObject",        "s3:GetObjectVersion"      ],      "Resource": [        "arn:aws:s3:::cross-account-qstest-bucket",        "arn:aws:s3:::cross-account-qstest-bucket/*"      ]    }  ]}Note: If the aws-quicksight-s3-consumers-role-v0 role exists in Account A, then make sure to use this role instead. Replace aws-quicksight-service-role-v0 with aws-quicksight-s3-consumers-role-v0 to avoid connection issues with Amazon S3.2.    Add the QuickSight service role from Account A to the list of users that can access the S3 bucket's AWS KMS key:aws kms create-grant --key-id aws_kms_key_arn --grantee-principal quickSight_role_arn --operations DecryptNote: Replace aws_kms_key_arn with your AWS KMS key's ARN, and quicksight_role_arn with your QuickSight role's ARN.To get your AWS KMS key ARN:Open the Amazon S3 console.Go to the S3 bucket that contains your data file.Choose the Properties tab. The AWS KMS key ARN is located under Default encryption.To get your QuickSight service role ARN:Open the AWS Identity Access Management (IAM) console in Account A.In the left navigation pane, choose Roles.Search for aws-quicksight-service-role.Select your QuickSight service role, and copy its ARN.Note: If the aws-quicksight-s3-consumers-role-v0 role exists in Account A, make sure to use this role instead. Otherwise, you might receive an error when you try to connect to Amazon S3.Add the S3 bucket as a resource that the QuickSight service role can accessTo allow the QuickSight service role access to the S3 bucket in Account B, complete the following steps:Open your Amazon QuickSight console.Choose Manage QuickSight.Choose Security & permissions.Choose Add or remove.Choose Details.Choose Select S3 buckets.Choose the S3 buckets that you can access across AWS tab to verify that your S3 bucket is listed for QuickSight access.(Optional) If your S3 bucket isn't listed, then add your bucket under Use a different bucket.Choose Finish.Allow the QuickSight service role access to the AWS KMS key for the S3 bucketAdd the following inline IAM policy to the QuickSight service role in Account A:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ExampleStmt3",      "Effect": "Allow",      "Action": [        "kms:Decrypt"        ],      "Resource": ""arn:aws:kms:us-east-1:<account ID of your S3 bucket>:key/<KEYID>"    }  ]}Note: The preceding inline policy allows the QuickSight service role to access your AWS KMS key in Account B. Replace ExampleStmt3 with your statement ID.Important: If the aws-quicksight-s3-consumers-role-v0 role exists in Account A, then you must attach the AWS KMS policy to the role. The AWS KMS policy decrypts the data in your S3 bucket. If you attach the updated role policy to your QuickSight service role instead, then you might encounter a permissions error. For information on how to resolve the permissions error, see How do I troubleshoot AWS resource permission errors in Amazon QuickSight?Additional considerationsWhen you're setting up cross-account access from QuickSight to an S3 bucket in another account, consider the following:Check the IAM policy assignments in your QuickSight account. The IAM role policies must grant the QuickSight service role access to the S3 bucket. For more information about viewing your policy assignments, see Setting granular access to AWS services through IAM.Use your manifest file to connect to your S3 bucket, and create a dataset using S3 files. Make sure to use a supported format for your S3 manifest file.Related informationEditing keysI can't connect to Amazon S3Troubleshooting Amazon QuickSightViewing a key policy (console)Follow"


Question: What do I do if I get the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message from Amazon SES?

What do I do if I get the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message from Amazon Simple Email Service (Amazon SES)?

Answer: "What do I do if I get the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message from Amazon Simple Email Service (Amazon SES)?ResolutionIf you exceed the maximum sending quota per day or per second, Amazon SES returns the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message. To address this error message:Use the Amazon SES console to review your account's current sending quotas.Review your sending application and requirements to see if you can stay within the quotas by downscaling or implementing an exponential backoff mechanism.Note: If you receive a "Maximum sending rate exceeded" error, you can retry your request.If you determine that your current sending quotas don't meet your sending requirements, you can do one of the following:Move out of the Amazon SES sandboxAll new Amazon SES accounts are in the Amazon SES sandbox. To see if your account is in the sandbox, use the Amazon SES console.In the sandbox, your account has the following sending quotas:You can send a maximum of 200 messages per day.You can send a maximum of one message per second.Note: If your account is in the Amazon SES sandbox, then you can send messages only to and from verified email addresses.To request to move your account out of the sandbox, open a support case. In the same support case, you can also include a request to increase your sending quota by filling out the Requests section.Request an increase in your sending quotaIf your account is in production mode (not sandbox), you can monitor your quota usage and request a sending quota increase when you need it. To request an increase in your sending quota, open a support case and complete the fields in the Requests section.Note the following important considerations when requesting an increase in your sending quota:If your Amazon SES account is in production mode and you're sending high-quality emails, you might qualify for an automatic increase in your sending quota.When you request a new sending quota, be sure to request only the amount that you need. Your requested quota increase isn't guaranteed.Your sending quota increase can be denied if your Amazon SES account is under review.Follow"