Question: Why is my Amazon EKS pod stuck in the ContainerCreating state with the error "failed to create pod sandbox"?

My Amazon Elastic Kubernetes Service (Amazon EKS) pod is stuck in the ContainerCreating state with the error "failed to create pod sandbox".

Answer: "My Amazon Elastic Kubernetes Service (Amazon EKS) pod is stuck in the ContainerCreating state with the error "failed to create pod sandbox".ResolutionYour Amazon EKS pods might be stuck in the ContainerCreating state with a network connectivity error for several reasons. Use the following troubleshooting steps based on the error message that you get.Error response from daemon: failed to start shim: fork/exec /usr/bin/containerd-shim: resource temporarily unavailable: unknownThis error occurs because of an operating system limitation that's caused by the defined kernel settings for maximum PID or maximum number of files.Run the following command to get information about your pod:$ kubectl describe pod example_podExample output:kubelet, ip-xx-xx-xx-xx.xx-xxxxx-x.compute.internal  Failed to create pod sandbox: rpc error: code = Unknown desc = failed to start sandbox container for pod "example_pod": Error response from daemon: failed to start shim: fork/exec /usr/bin/containerd-shim: resource temporarily unavailable: unknownTo temporarily resolve the issue, restart the node.To troubleshoot the issue, do the following:Gather the node logs.Review the Docker logs for the error "dockerd[4597]: runtime/cgo: pthread_create failed: Resource temporarily unavailable".Review the Kubelet log for the following errors:"kubelet[5267]: runtime: failed to create new OS thread (have 2 already; errno=11)""kubelet[5267]: runtime: may need to increase max user processes (ulimit -u)".Identify the zombie processes by running the ps command. All the processes listed with the Z state in the output are the zombie processes.Network plugin cni failed to set up pod network: add cmd: failed to assign an IP address to containerThis error indicates that the Container Network Interface (CNI) can't assign an IP address for the newly provisioned pod.The following are reasons why the CNI fails to provide an IP address to the newly created pod:The instance used the maximum allowed elastic network interfaces and IP addresses.The Amazon Virtual Private Cloud (Amazon VPC) subnets have an IP address count of zero.The following is an example of network interface IP address exhaustion:Instance type    Maximum network interfaces    Private IPv4 addresses per interface    IPv6 addresses per interfacet3.medium        3                             6                                       6In this example, the instance t3.medium has a maximum of 3 network interfaces, and each network interface has a maximum of 6 IP addresses. The first IP address is used for the node and isn't assignable. This leaves 17 IP addresses that the network interface can allocate.The Local IP Address Management daemon (ipamD) logs show the following message when the network interface runs out of IP addresses:"ipamd/ipamd.go:1285","msg":"Total number of interfaces found: 3 ""AssignIPv4Address: IP address pool stats: total: 17, assigned 17""AssignPodIPv4Address: ENI eni-abc123 does not have available addresses"Run the following command to get information about your pod:$ kubectl describe pod example_podExample output:Warning FailedCreatePodSandBox 23m (x2203 over 113m) kubelet, ip-xx-xx-xx-xx.xx-xxxxx-x.compute.internal (combined from similar events): Failed create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" network for pod "provisioning-XXXXXXXXXXXXXXX": networkPlugin cni failed to set up pod "provisioning-XXXXXXXXXXXXXXX" network: add cmd: failed to assign an IP address to containerReview the subnet to identify if the subnet ran out of free IP addresses. You can view available IP addresses for each subnet in the Amazon VPC console under the Subnets section.Subnet: XXXXXXXXXXIPv4 CIDR Block 10.2.1.0/24   Number of allocated ips 254   Free address count 0To resolve this issue, scale down some of the workload to free up available IP addresses. If additional subnet capacity is available, then you can scale the node. You can also create an additional subnet. For more information, see How do I use multiple CIDR ranges with Amazon EKS? Follow the instructions in the Create subnets with a new CIDR range section.Error while dialing dial tcp 127.0.0.1:50051: connect: connection refusedThis error indicates that the aws-node pod failed to communicate with IPAM because the aws-node pod failed to run on the node.Run the following commands to get information about the pod:$ kubectl describe pod example_pod$ kubectl describe pod/aws-node-XXXXX -n kube-systemExample outputs:Warning  FailedCreatePodSandBox  51s  kubelet, ip-xx-xx-xx-xx.ec2.internal  Failed create pod sandbox: rpc error: code = Unknown desc = [failed to set up sandbox container "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" network for pod "example_pod": NetworkPlugin cni failed to set up pod "example_pod" network: add cmd: Error received from AddNetwork gRPC call: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp 127.0.0.1:50051: connect: connection refused", failed to clean up sandbox container"XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" network for pod "example_pod": NetworkPlugin cni failed to teardown pod "example_pod" network: del cmd: error received from DelNetwork gRPC call: rpc error: code = Unavailable desc = connection error: desc = "transport: Error while dialing dial tcp 127.0.0.1:50051: connect: connection refused"]To troubleshoot this issue, verify that the aws-node pod is deployed and is in the Running state:kubectl get pods --selector=k8s-app=aws-node -n kube-systemNote: Make sure that you're running the correct version of the VPC CNI plugin for the cluster version.The pods might be in Pending state due to Liveness and Readiness probe errors. Be sure that you have the latest recommended VPC CNI add-on version according to the compatibility table.Run the following command to view the last log message from the aws-node pod:kubectl -n kube-system exec -it aws-node-XXX-- tail -f /host/var/log/aws-routed-eni/ipamd.log | tee ipamd.logThe issue might also occur because the Dockershim mount point fails to mount. The following is an example message that you can receive when this issue occurs:Getting running pod sandboxes from \"unix:///var/run/dockershim.sock\Not able to get local pod sandboxes yet (attempt 1/5): rpc error: code = Unavailable desc = all SubConns are in TransientFailure, latest connection error: connection error: desc = "transport: Error while dialing dial unix /var/run/dockershim.sock: connect: no such file or directorThe preceding message indicates that the pod didn't mount var/run/dockershim.sock.To resolve this issue, try the following:Restart the aws-node pod to remap the mount point.Cordon the node, and scale the nodes in the node group.Upgrade the Amazon VPC network interface to the latest cluster version that's supported.If you added the CNI as a managed plugin in the AWS Management Console, then the aws-node fails the probes. Managed plugins overwrite the service account. However, the service account isn't configured with the selected role. To resolve this issue, turn off the plugin from the AWS Management Console, and create the service account using a manifest file. Or, edit the current aws-node service account to add the role that's used on the managed plugin.Network plugin cni failed to set up pod "my-app-xxbz-zz" network: failed to parse Kubernetes args: pod does not have label vpc.amazonaws.com/PrivateIPv4AddressYou get this error because of either of the following reasons:The pod isn't running properly.The certificate that the pod is using isn't created successfully.This error relates to the Amazon VPC admission controller webhook that's required on Amazon EKS clusters to run Windows workloads. The webhook is a plugin that runs a pod in the kube-system namespace. The component runs on Linux nodes and allows networking for incoming pods on Windows nodes.Run the following command to get the list of pods that are affected:kubectl get podsExample output:my-app-xxx-zz        0/1     ContainerCreating   0          58m   <none>            ip-XXXXXXX.compute.internal   <none>my-app-xxbz-zz       0/1     ContainerCreating   0          58m   <none>Run the following command to get information about the pod:$ kubectl describe pod my-app-xxbz-zzExample output:Failed to create pod sandbox: rpc error: code = Unknown desc = failed to set up sandbox container "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX" network for pod "<POD_ANME>": networkPlugin cni failed to set up pod "example_pod" network: failed to parse Kubernetes args: pod does not have label vpc.amazonaws.com/PrivateIPv4AddressReconciler worker 1 starting processing node ip-XXXXXXX.compute.internal.Reconciler checking resource vpc.amazonaws.com/PrivateIPv4Address warmpool size 1 desired 3 on node ip-XXXXXXX.compute.internal.Reconciler creating resource vpc.amazonaws.com/PrivateIPv4Address on node ip-XXXXXXX.compute.internal.Reconciler failed to create resource vpc.amazonaws.com/PrivateIPv4Address on node ip-XXXXXXX.compute.internal: node has no open IP address slots.Windows nodes support one network interface per node. Each Windows node can run as many pods as the available IP addresses per network interface, minus one. To resolve this issue, scale up the number of Windows nodes.If the IP addresses aren't the issue, then review the Amazon VPC admission controller pod event and logs.Run the following command to confirm that the Amazon VPC admission controller pod is created:$ kubectl get pods -n kube-system  OR kubectl get pods -n kube-system | grep "vpc-admission"Example output:vpc-admission-webhook-5bfd555984-fkj8z     1/1     Running   0          25mRun the following command to get information about the pod:$ kubectl describe pod vpc-admission-webhook-5bfd555984-fkj8z -n kube-systemExample output:  Normal  Scheduled  27m   default-scheduler  Successfully assigned kube-system/vpc-admission-webhook-5bfd555984-fkj8z to ip-xx-xx-xx-xx.ec2.internal  Normal  Pulling    27m   kubelet            Pulling image "xxxxxxx.dkr.ecr.xxxx.amazonaws.com/eks/vpc-admission-webhook:v0.2.7"  Normal  Pulled     27m   kubelet            Successfully pulled image "xxxxxxx.dkr.ecr.xxxx.amazonaws.com/eks/vpc-admission-webhook:v0.2.7" in 1.299938222s  Normal  Created    27m   kubelet            Created container vpc-admission-webhook  Normal  Started    27m   kubelet            Started container vpc-admission-webhookRun the following command to check the pod logs for any configuration issues:$ kubectl logs vpc-admission-webhook-5bfd555984-fkj8z -n kube-systemExample output:I1109 07:32:59.352298       1 main.go:72] Initializing vpc-admission-webhook version v0.2.7.I1109 07:32:59.352866       1 webhook.go:145] Setting up webhook with OSLabelSelectorOverride: windows.I1109 07:32:59.352908       1 main.go:105] Webhook Server started.I1109 07:32:59.352933       1 main.go:96] Listening on :61800 for metrics and healthzI1109 07:39:25.778144       1 webhook.go:289] Skip mutation for  as the target platform is .The preceding output shows that the container started successfully. The pod then adds the vpc.amazonaws.com/PrivateIPv4Address label to the application pod. However, the manifest for the application pod must contain a node selector or affinity so that the pod is scheduled on the Windows nodes.Other options to troubleshoot the issue include verifying the following:You deployed the Amazon VPC admission controller pod in the kube-system namespace.Logs or events aren't pointing to an expired certificate. If the certificate is expired and Windows pods are stuck in the Container creating state, then you must delete and redeploy the pods.There aren't any timeouts or DNS-related issues.If you don't create the Amazon VPC admission controller, then turn on Windows support for your cluster.Important: Amazon EKS doesn't require you to turn on the Amazon VPC admission controller to support Windows node groups. If you turned on the Amazon VPC admission controller, then remove legacy Windows support from your data plane.Related informationAmazon EKS networkingFollow"


Question: Why can't I connect to my S3 bucket using interface VPC endpoints?

I can't connect to my Amazon Simple Storage Service (Amazon S3) bucket using interface Amazon Virtual Private Cloud (Amazon VPC) endpoints. How can I troubleshoot this?

Answer: "I can't connect to my Amazon Simple Storage Service (Amazon S3) bucket using interface Amazon Virtual Private Cloud (Amazon VPC) endpoints. How can I troubleshoot this?Short descriptionTo troubleshoot this error, check the following:Verify the policy associated with the interface VPC endpoint and the S3 bucket.Verify that your network can connect to the S3 endpoints.Verify that your DNS can resolve to the S3 endpoints IP addresses.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.ResolutionVerify the policy associated with the interface VPC endpoint and the S3 bucketBy default, an S3 bucket doesn't have a policy associated with it when you create a bucket. A policy associated with an S3 interface endpoint during the time of creation allows any action to any S3 bucket by default. For information on viewing the policy associated with your endpoint, see View your interface endpoint.Verify that your network can connect to the S3 endpointsCheck connectivity between the source and the destination. For example, check the network access control list (ACL) and the security group associated with the S3 interface endpoints to confirm that traffic is allowed to the interface endpoint.Use the following telnet command to test connectivity between the AWS resource or from an on-premises host and the S3 endpoint. In the following command, replace S3_interface_endpoint_DNS with the DNS of your S3 interface endpoint.telnet bucket.S3_interface_endpoint_DNS 443Trying a.b.x.y...Connected to bucket.vpce-0a1b2c3d4e5f6g-m7o5iqbh.s3.us-east-2.vpce.amazonaws.comYou can also test telnet connectivity using a test Amazon Elastic Compute Cloud (Amazon EC2) instance. Test the connectivity in the subnet where you have the endpoint from the source (on-premises host or another instance) to verify that layer 3 connectivity exists from the source to the destination AWS resource. Make sure that you use the same security group in the test instance that's associated with the S3 interface endpoint. Testing this connectivity helps to determine if the issue is with the security group or the network ACL.Verify that the DNS can resolve to the S3 endpointsMake sure that you can resolve the interface endpoint DNS from the source. You can use tools such as nslookup, dig, and so, on to do this. The following example uses dig. In the following command, replace S3_interface_endpoint_DNS with the DNS of your S3 interface endpoint.dig *s3_interface_endpoint_DNS@local_nameserverNote: Amazon-provided DNS server is the .2 IP address of the VPC CIDR. Your on-premises host is the local name server of the host listed in the /etc/resolv.conf file.Related informationAccessing buckets and S3 access points from S3 interface endpointsFollow"


Question: How can I restrict users in certain locations from accessing web content served by my CloudFront distribution?

I want to restrict users in certain countries from accessing the web content served by my Amazon CloudFront distribution.

Answer: "I want to restrict users in certain countries from accessing the web content served by my Amazon CloudFront distribution.ResolutionTurn on CloudFront geo restriction for your distribution by following these steps:Open the CloudFront console.Choose the distribution that you want to apply geo restriction to.Choose the Geographic Restrictions tab.Choose Edit.To allow access to countries, for Restriction type choose Allow List. To block access from certain countries, choose Block List.For Countries, select the countries that you want to allow or block. Then, choose Add.Choose Save Changes.Note: You can set your CloudFront distribution to return a custom error message when a user from a blocked country tries to access content.Consider these additional ways to restrict access to your content served through CloudFront:Be sure that any AWS security groups on your CloudFront origin have restricted HTTP or HTTPS access to the CloudFront IP address ranges. This prevents access to those IP addresses from outside of CloudFront. For more information, see Automatically update security groups for Amazon CloudFront IP ranges using AWS Lambda.You can use AWS WAF to monitor and restrict HTTP and HTTPS requests, and to control access to your content.Related informationHow AWS Shield worksFollow"


Question: How do I increase security in Amazon Cognito by using MFA settings for users and user pools?

I want to increase security for my Amazon Cognito users and user pools by implementing multi-factor authentication (MFA). How do I do this?

Answer: "I want to increase security for my Amazon Cognito users and user pools by implementing multi-factor authentication (MFA). How do I do this?Short descriptionMFA settings for Amazon Cognito can be set to off, optional, or required for users and user pools.If MFA is off, then no users are prompted with an MFA challenge during sign in. If MFA is optional, then MFA is added at the user level. Only users who have MFA configured are prompted with an MFA challenge during sign in. If MFA is required, then each user is prompted with an MFA challenge during sign in.SMS text messages and time-based one-time passwords (TOTP) are both second authentication factor options for Amazon Cognito users and user pools.Resolution1.    Set up MFA for your Amazon Cognito user pool.Important: The user pool’s MFA settings can change the authentication flow. For more information, see User pool authentication flow.2.    Set up a second authentication factor for Amazon Cognito users.To configure SMS text messages as the second factor for users:Make sure that each user has a phone number. Phone numbers are marked as verified after SMS text messages are acknowledged.Set up an SMS text message MFA.Set up SMS text messages in Amazon Cognito user pools.Use the AdminSetUserMFAPreference API or the SetUserMFAPreference API, depending on the use case. For SMSMfaSettings, set both Enabled and PreferredMfa to True.Provide any other required parameters depending on the API, then invoke the API.To configure TOTP as the second factor for users:Set up a TOTP software token MFA.Use the AdminSetUserMFAPreference API or the SetUserMFAPreference API, depending on the use case. For SoftwareTokenMfaSettings, set both Enabled and PreferredMfa to True.Provide any other required parameters depending on the API, then invoke the API.Note: You can use the AWS Command Line Interface (AWS CLI) to associate a TOTP software token MFA and then set TOTP as the second authentication factor. For more information, see How do I activate TOTP MFA for Amazon Cognito user pools?Follow"


Question: How do I restore a CloudHSM cluster from a previous backup?

I want to restore my hardware security module (HSM) in my AWS CloudHSM cluster to a previous version.

Answer: "I want to restore my hardware security module (HSM) in my AWS CloudHSM cluster to a previous version.Short descriptionCloudHSM periodically makes a backup of your cluster, and also automatically creates a backup when you delete an HSM. The backups are stored in an Amazon Simple Storage Service (Amazon S3) bucket in the same AWS Region as your cluster.If you don't need your HSM, you can delete it. When you are ready to use that HSM again, you can create a new HSM in the same cluster as the HSM that you deleted. If you deleted your cluster, you can create a new one from the backup. For more information, see AWS CloudHSM cluster backups.ResolutionFollow the instructions for Creating AWS CloudHSM cluster from backups. Then, create an HSM in that cluster.Follow"


Question: Why can't I delete my Amazon SNS topic subscription?

"I want to delete my Amazon Simple Notification Service (Amazon SNS) topic subscription. However, I either get an error message or the option to delete the subscription is deactivated in the console."

Answer: "I want to delete my Amazon Simple Notification Service (Amazon SNS) topic subscription. However, I either get an error message or the option to delete the subscription is deactivated in the console.Short descriptionThere are three situations when Amazon SNS doesn't let you delete your Amazon SNS topic subscription:Your topic subscription is in the Pending Confirmation  status.Your topic subscription is in the Deleted status.The AWS Identity and Access Management (IAM) entity that's trying to delete your topic subscription doesn't have the required permissions to unsubscribe.Note: After three days, Amazon SNS automatically removes subscriptions that are in the Deleted and Pending Confirmation status from your account.If your topic subscription is in the Pending Confirmation status, then the Delete button is deactivated in the Amazon SNS console.If your topic subscription is in the Deleted status and you try to delete the subscription, then Amazon SNS returns the following error message:"Error code: InvalidParameter - Error message: Invalid parameter: SubscriptionArn Reason: An ARN must have at least 6 elements, not 1”If the IAM entity that's trying to delete your subscription doesn't have the required permissions to unsubscribe, then Amazon SNS returns a Permissions Denied error.ResolutionCheck if your Amazon SNS topic subscription is in the Deleted or Pending Confirmation statusImportant: If subscriptions are in the Deleted or Pending Confirmation status when you delete their topic, then you can't manually remove the subscriptions from your account. You must wait three days for Amazon SNS to automatically remove the subscriptions from your account.1.    Open the Amazon SNS console.2.    In the left navigation pane, choose Subscriptions.3.    On the Subscriptions page, find the subscription that you want to delete. Then, in the Status column, check if the subscription is in either the Deleted or Pending Confirmation status.4.    Complete the steps in one of the following sections depending on whether your subscription is in the Deleted or Pending Confirmation status. If your subscription isn't in Deleted or Pending Confirmation status, then complete the steps in the To troubleshoot Permissions Denied errors section.Your Amazon SNS topic subscription is in the Deleted statusThere are two reasons that a topic subscription is in the Deleted status without being removed from your account:A member of an Amazon SNS topic mailing list selects the unsubscribe link in an email message sent from the topic.An Amazon Simple Queue Service (Amazon SQS) queue in another AWS account that's subscribed to the topic deletes the cross-account subscription.A member of the topic mailing list selects the unsubscribe link in an email sent from the topicTake one of the following actions:1.    In your email inbox, open the email that has the following subject line: AWS Notification - Unsubscribe Confirmation.2.    At the bottom of the email, select the Resubscribe link. After you select the Resubscribe link, the email subscription is reconfirmed and you can delete it from the Amazon SNS console.-or-Recreate the deleted email subscription, and then confirm it. After you create and confirm the subscription, you can delete it from the Amazon SNS console.Note: Email spam filters can also unsubscribe the mailing list's email address.An Amazon SQS queue in another account that's subscribed to the topic deletes the cross-account subscriptionComplete the following steps:1.    Follow the instructions in How do I recreate a "Deleted" Amazon SNS topic subscription for an Amazon SQS queue in another AWS account?2.    Use the AWS account that owns the subscription to delete the subscription.Your Amazon SNS topic subscription is in the Pending Confirmation statusThere are four reasons that a topic subscription is in the Pending Confirmation status without being removed from your account:The subscription is added but isn't yet confirmed.The email address that's added to the subscription isn't valid.The delivery rate for email messages exceeds the default quota of 10 messages per second.The HTTP or HTTPS endpoint isn't automatically processing the Subscription Confirmation request that Amazon SNS made.The HTTP or HTTPS endpoint isn't valid.When any of the following endpoint types are subscribed to an SNS topic, the subscription remains in the Pending Confirmation status until it's confirmed:EmailHTTPHTTPSCross-account Amazon SQSTo confirm a subscription that's associated with the preceding types of endpoints, select the Confirm Subscription link that was sent to the endpoint. After the subscription is confirmed, you can delete it from the Amazon SNS console.For all other scenarios, you must resubscribe the endpoint to the SNS topic, and then complete the following steps to delete it:1.    Open the Amazon SNS console.2.    In the left navigation pane, choose Subscriptions.3.    On the Subscriptions page, find the subscription that you want to delete. Then, choose Request confirmation. A confirmation request is sent to the designated endpoint.4.    Based on the type of endpoint that you're using, take one of the following actions to confirm the subscription:For email endpointsIn your email inbox, open the email that has the following subject line: AWS Notification - Subscription Confirmation. Then, choose Confirm Subscription.Note: If you don't see the subscription confirmation email, then check your email's spam and junk folders.For cross-account Amazon SQS endpointsFind the subscription confirmation message in the Amazon SQS queue. Then, send an HTTP GET request to the SubscribeURL that's in the message body. For more information, see Sending Amazon SNS messages to an Amazon SQS queue in a different account.For HTTP and HTTPS endpointsMake sure that your endpoint can handle the HTTP POST requests that Amazon SNS uses to send subscription confirmation and notification messages. For more information, see Make sure your endpoint is ready to process Amazon SNS messages.5.    When the subscription is in the Confirmed status, delete the subscription.Note: For email, HTTP, and HTTPS endpoints, three days must elapse before the subscription is removed from your account after you delete it.To troubleshoot Permissions Denied errorsCheck unsubscribe permissionComplete the following steps to confirm that the IAM entity that's trying to delete your topic subscription has the required permissions to unsubscribe:1.    Open the IAM Policy Simulator console.2.    In the left Users, Groups, and Roles pane, choose the IAM entity that you're using to delete the topic subscription.3.    In the Policy Simulator pane, for the Select service dropdown list, select SNS.4.    For the Select actions dropdown list, select Unsubscribe.5.    Choose Run Simulation.6.    Under Action Settings and Results, in the Permission column, check if the unsubscribe permission is Allowed or Denied.If your IAM entity doesn't allow the sns:Unsubscribe action, contact your system administrator and ask them to add the required permissions. For more information, see Adding and removing IAM identity permissions.Follow"


Question: How do I sign in to the AWS Management Console?

I want to access AWS resources through the AWS Management Console. How do I sign in?

Answer: "I want to access AWS resources through the AWS Management Console. How do I sign in?ResolutionSigning in as the AWS account root userIf you're a root user, open the Sign in page, select Root user, and sign in using your AWS account root user credentials.Signing in as the AWS Identity and Access Management (IAM) user with a custom URLSign in using a custom URL https://account_alias_or_id.signin.aws.amazon.com/console/. You must replace account_alias_or_id with the account alias or account ID provided by the root user.Signing in as the IAM user on the Sign-in pageIf you have previously signed in as the IAM user on the browser, you might see the Sign in as IAM user page when you open the Sign-in page. Your account ID or account alias might already be saved. In that case, just enter your IAM user credentials, and then choose Sign in.If you are signing in on the browser for the first time, open the Sign in page, select IAM user, and then enter the 12-digit AWS account ID or account alias. Choose Next. In the Sign in as IAM user page, enter your IAM user credentials, and then choose Sign in.If you have trouble signing in as the IAM user, contact your account administrator for the specialized URL and account credentials to use.For the AWS GovCloud (US) Region, sign in to the AWS Management Console for the AWS GovCloud (US) using your IAM account credentials.If you have trouble signing in to your AWS account, see I'm having trouble signing in to or accessing my AWS account.Note: For security purposes, AWS Support doesn't have access to view, provide, or change your account credentials.Related informationWhat is the AWS Management Console?Signing in to the AWS Management Console as an IAM user or root userAWS Management Console for the AWS GovCloud (US) RegionTroubleshooting AWS sign-in or account issuesEnable access to the AWS Management Console with AD credentialsFollow"


Question: Why can't I configure ACM certificates for my website hosted on an EC2 instance?

I want to configure AWS Certificate Manager (ACM) certificates for my website hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance.

Answer: "I want to configure AWS Certificate Manager (ACM) certificates for my website hosted on an Amazon Elastic Compute Cloud (Amazon EC2) instance.Short descriptionConfiguring an Amazon Issued ACM public certificate for a website that's hosted on an EC2 instance requires exporting the certificate. However, you can't export the certificate because ACM manages the private key that signs and creates the certificate. For more information, see Security for certificate private keys.Instead, you can associate an ACM certificate with a load balancer or an ACM SSL/TLS certificate with a CloudFront distribution. Before you begin, follow the instructions for requesting a public certificate.Note: You must request or import an ACM certificate in the same AWS Region as your load balancer. CloudFront distributions must request the certificate in the US East (N. Virginia) Region.ResolutionFollow these steps to associate your certificate:Create an Application Load Balancer, Network Load Balancer, Classic Load Balancer, or CloudFront distribution.Note: If you already have an Application Load Balancer, Network Load Balancer, Classic Load Balancer, or CloudFront distribution, then you can skip this step.Associate the certificate with your ELB, or configure a CloudFront distribution to use an SSL/TLS certificate.Put the EC2 instance behind your ELB or CloudFront distribution.Route traffic to your ELB or CloudFront distribution.Create an ELB or CloudFront distributionFollow the instructions for your use case:Create an Application Load BalancerCreate a Network Load BalancerCreate a Classic Load BalancerCreate a CloudFront distributionAssociate the certificate with ELB or configure it with a CloudFront distributionFollow the instructions for your use case:Associate the certificate with a Classic, Application, or Network Load BalancerConfigure your CloudFront distribution to use an SSL/TLS certificatePut the EC2 instance behind your ELB or CloudFront distributionFollow the instructions for your use case:Register targets with your target group for your Application or Network Load BalancerRegister or deregister EC2 instances for your Classic Load BalancerUse Amazon EC2 with CloudFront distributionsRoute traffic to your ELB or CloudFront distributionFollow the instructions for your use case:Route traffic to a load balancerRoute traffic to a CloudFront distributionNote: Public ACM certificates can be installed on Amazon EC2 instances that are connected to a Nitro Enclave, but not to other Amazon EC2 instances.Related informationEmail validationDNS validationMaking Amazon Route 53 the DNS service for an existing domainFollow"


Question: How do I set up a Lambda function to invoke when a state changes in AWS Step Functions?

I want to invoke an AWS Lambda function whenever a state changes in AWS Step Functions. How do I do that?

Answer: "I want to invoke an AWS Lambda function whenever a state changes in AWS Step Functions. How do I do that?ResolutionNote: These instructions describe how to use an Amazon EventBridge events rule to invoke a Lambda function whenever a state changes in Step Functions. As you follow the steps, make sure that you do the following:Confirm the event change that you use to invoke the Lambda function is a supported API action.Create the Step Functions state machine, Lambda function, and EventBridge events rule in the same AWS Region.Create IAM roles for Step Functions and Lambda1.    Create an AWS Identity and Access Management (IAM) role for Step Functions. When you create the IAM role, do the following:Grant the IAM role permissions to perform any actions required for your use case.Allow the action, lambda:InvokeFunction, to have your state machine invoke your Lambda function.Note: The managed policy, AWSLambdaRole, includes the permissions required to invoke Lambda functions.2.    Create a Lambda execution role that grants your function permission to upload logs to Amazon CloudWatch.Note: The managed policy, AWSLambdaBasicExecutionRole, grants your function the basic permissions to upload logs to CloudWatch.Create a Step Functions state machineCreate a state machine in the Step Functions console. For IAM role for executions, choose the existing role that you created for Step Functions.For more information, see What is AWS Step Functions?Create a Lambda function that's configured to print the event it receives1.    Create a function in the Lambda console. For Execution role, choose the existing role that you created for Lambda.2.    In the Lambda console, use the code editor to update the function code so that when it runs, the function prints the event that it receives.Example Python code that tells a Lambda function to print the events it receivesimport jsondef lambda_handler(event, context):print("Received event: " + json.dumps(event)) return {'statusCode': 200,'body': json.dumps("Hello")}For more information, see Building Lambda functions with Python.Create an EventBridge events rule that invokes your Lambda function whenever a state changes in Step Functions1.    Open the EventBridge console.2.    In the left navigation pane, under Events, choose Rules.3.    Choose Create rule.4.    For Name, enter a name for the rule.5.    For Define pattern, choose Event Pattern.6.    For Event matching pattern, choose Pre-defined pattern by service.7.    For Service provider, choose AWS.8.    For Service Name, choose Step Functions.9.    For Event Type, choose Step Functions Execution Status Change.Note: You can also choose to have All Events for Step Functions initiate the rule. Or, you can choose AWS API Call through CloudTrail to initiate the rule for certain Step Functions API call events, such as StartExecution. For more information, see Events from AWS services.10.    Choose the statuses, state machine Amazon Resource Names (ARNs), and execution ARNs that you want to initiate the event. You can choose Any for each type of trigger, or identify Specific statuses or ARNs for each trigger.11.    Under Select targets, confirm that Lambda function is the target type.12.    For Function, choose the Lambda function that you created13.    Choose Create rule.For more information, see Amazon EventBridge events and EventBridge for Step Functions execution status changes.Test your setup1.    In the Step Functions console, start a new execution of your state machine.2.    In the CloudWatch console, in the left navigation pane, under Logs, choose Log groups.3.    Choose the log stream created by your Lambda function.4.    Verify the event details in the log stream.Note: It can take several minutes for the log stream to appear after the new execution starts.Related informationMonitoring Step Functions using CloudWatchCreating a Step Functions state machine that uses LambdaFollow"


Question: How do I troubleshoot NXDOMAIN responses when using Route 53 as the DNS service?

"I'm receiving an NXDOMAIN response from the DNS resolver, or a DNS_PROBE_FINISHED_NXDOMAIN error when resolving Amazon Route 53 records."

Answer: "I'm receiving an NXDOMAIN response from the DNS resolver, or a DNS_PROBE_FINISHED_NXDOMAIN error when resolving Amazon Route 53 records.ResolutionDetermine if the domain is in the active or suspended state1.    Run a whois query against the domain.Note: Make sure that whois is installed before running the following commands.For Windows: Open a Windows command prompt, and then enter whois -v example.com.For Linux: Open your SSH client. In the command prompt, enter whois example.com.Note: If the domain is registered with Amazon Registrar, then you can use the Amazon Registrar whois lookup tool.2.    Check the status of the domain. If the value of Domain Status is clientHold, then the domain is suspended.Example whois output:whois example.com   Domain Name: EXAMPLE.COM   Registry Domain ID: 87023946\_DOMAIN\_COM-VRSN   Registrar WHOIS Server: whois.godaddy.com   Registrar URL: http://www.godaddy.com   Updated Date: 2020-05-08T10:05:49Z   Creation Date: 2002-05-28T18:22:16Z   Registry Expiry Date: 2021-05-28T18:22:16Z   Registrar: GoDaddy.com, LLC   Registrar IANA ID: 146   Registrar Abuse Contact Email: abuse@godaddy.com   Registrar Abuse Contact Phone: 480-624-2505   Domain Status: clientDeleteProhibited https://icann.org/epp#clientDeleteProhibited   Domain Status: clientHold https://icann.org/epp#clientHold     Domain Status: clientTransferProhibited https://icann.org/epp#clientTransferProhibited   Domain Status: clientUpdateProhibited https://icann.org/epp#clientUpdateProhibited   Name Server: ns-1470.awsdns-55.org.   Name Server: ns-1969.awsdns-54.co.uk.   Name Server: ns-736.awsdns-28.net.   Name Server: ns-316.awsdns-39.com.To make a domain available on the internet again, remove it from suspended status. The following are the most common reasons that a domain might be suspended:You registered a new domain, but you didn't click the link in the confirmation email.You turned off automatic renewal for the domain, and the domain expired.You changed the email address for the registrant contact, but you didn't verify that the new email address is valid.For more information, see My domain is suspended (status is ClientHold).Confirm that the correct name servers are configured on the domain registrar1.    In the whois output, note the Name Servers that are authoritative for your domain. See the preceding whois output for an example.You can also use the dig utility to check the configured name servers.Example dig +trace output:dig +trace example.com; <<>> DiG 9.11.4-P2-RedHat-9.11.4-26.P2.amzn2.2 <<>> +trace example.com;; global options: +cmd.                       518400  IN      NS      H.ROOT-SERVERS.NET..                       518400  IN      NS      I.ROOT-SERVERS.NET..                       518400  IN      NS      J.ROOT-SERVERS.NET..                       518400  IN      NS      K.ROOT-SERVERS.NET.;; Received 239 bytes from 10.0.0.2#53(10.0.0.2) in 0 mscom.                    172800  IN      NS      a.gtld-servers.net.com.                    172800  IN      NS      m.gtld-servers.net.com.                    172800  IN      NS      h.gtld-servers.net.C41A5766com.                    86400   IN      RRSIG   DS 8 1 86400 20210329220000 20210316210000 42351 . ;; Received 1174 bytes from 192.112.36.4#53(G.ROOT-SERVERS.NET) in 104 msexample.com.         172800  IN      NS      ns-1470.awsdns-55.org.  ------>Name servers of interest.example.com.         172800  IN      NS      ns-1969.awsdns-54.co.uk.example.com.         172800  IN      NS      ns-736.awsdns-28.net.example.com.         172800  IN      NS      ns-316.awsdns-39.com.;; Received 732 bytes from 192.33.14.30#53(b.gtld-servers.net) in 91 msexample.com.         3600    IN      A       104.200.22.130example.com.         3600    IN      A       104.200.23.95example.com.         3600    IN      NS      ns-1470.awsdns-55.org.example.com.         3600    IN      NS      ns-1969.awsdns-54.co.uk.example.com.         3600    IN      NS      ns-736.awsdns-28.net.example.com.         3600    IN      NS      ns-316.awsdns-39.com.;; Received 127 bytes from 173.201.72.25#53(ns-1470.awsdns-55.org) in 90 ms2.    Open the Route 53 console.3.    In the navigation pane, choose Hosted zones.4.    On the Hosted zones page, select the radio button (not the name) for the hosted zone. Then, choose View details.5.    On the details page for the hosted zone, choose Hosted zone details.6.    Confirm that the Name Servers listed in the hosted zone details are identical to the Name Servers in the whois or dig +trace output.Important: If the name servers aren't identical, then update them at the domain registrar. For domains registered with Route 53, see Adding or changing name servers and glue records for a domain. For domains registered with a third party, refer to the provider's documentation for steps on how to update the name servers.Confirm that the requested record existsCheck that the hosted zone for the domain contains the requested record. For example, if you're receiving an NXDOMAIN response when trying to resolve www.example.com, then check the example.com hosted zone for the www.example.com record. For steps on how to list records in Route 53, see Listing records.If you have a CNAME record pointing to another domain name, make sure that the canonical name exists and is resolvable.Exampleexample.com CNAME record is configured with a value of blog.example.com. In this case, verify that the record blog.example.com exists and is resolvable.Check for subdomain delegation issues1.    Check the parent hosted zone for a Name Server (NS) record for the domain name that you're resolving. If an NS record for a subdomain exists, then the authority for the domain and its subdomains is delegated to another zone. For example, if an NS record for www.example.com exists, then the authority for www is delegated to the name servers in the NS record. If the delegation is valid, then you must create the record for the domain in the delegated zone, not the parent zone of example.com.2.    If the delegation isn't valid, then delete the NS record for the domain. Confirm that the parent hosted zone (example.com) contains a record for the domain name that you're trying to resolve.3. Resolvers that implement QNAME minimization include minimum detail in each query, as is required for that step in the resolution process. This might cause an NXDOMAIN issue in some resolvers. When you configure multiple levels of subdomain delegation, follow strict delegation at every level. For more information, see Routing traffic for additional levels of subdomains.Determine if the DNS resolution issue exists only in the VPC1.    Check the resolver IP address that's configured on the client operating system (OS). For Linux, check the /etc/resolv.conf file. For Windows, check the DNS servers in the ipconfig /all output. Look for the default virtual private cloud (VPC) DNS resolver (VPC CIDR+2). For example, if the VPC CIDR is 10.0.0.0/8, then the DNS resolver IP address is 10.0.0.2. If you don't see the VPC DNS resolver in /etc/resolv.conf, then check the custom DNS resolver.2.    If you're using the VPC DNS resolver, then check the private hosted zones and Route 53 resolver rules.When using resolver rules and private hosted zonesIf the resolver rule and private hosted zone domain name match, then the resolver rule takes precedence. For more information, see Considerations when working with a private hosted zone. In this case, the DNS query is sent to the target IP address that's configured as the target in the resolver rule.When using a private hosted zone and no resolver ruleVerify that there's a private hosted zone with matching domain names associated with the VPC. For example, you might have a public hosted zone and a private hosted zone for the domain that's associated with a VPC. This is a split-view or split-horizon DNS. In this case, clients in the VPC can't resolve records created in the public hosted zone. If the record isn't present in the private hosted zone, then the VPC DNS doesn't fall back to the public hosted zone.When using only resolver rules and no private hosted zoneCheck the Route 53 resolver rules. If there's a rule that matches the domain name, then the query for the domain routes to the configured target IP addresses. This means that the query isn't routed to the default public resolvers.Determine if your issue is the result of negative cachingNegative caching is the process of storing a negative response from an authoritative name server in the cache. An NXDOMAIN response is considered a negative response. Consider the following example:A client makes a DNS query for neg.example.com and receives a response code of NXDOMAIN because the record neg.example.com doesn't exist.This user also owns example.com, so they create a new record for neg.example.com. The user continues to receive an NXDOMAIN response when users in other networks can successfully resolve the record.When the user makes a query to neg.example.com before creating the new record, they receive an NXDOMAIN response. If the user turned on negative caching in their resolver settings, then the resolver caches this response. After the user creates the new record, they make the query again. The resolver previously received this query and cached it, so it returned the response from the cache.There's no record returned in the answer of a negative response, so there's no Time to Live (TTL) value compared to a positive response. In this case, the resolver uses the lowest value from the following:The minimum TTL value of the Start of Authority (SOA) record.The TTL value of the SOA record to cache the NXDOMAIN response.To confirm this issue, send a query directly to the name server to see if you're getting a response. For example:dig www.example.com @ns-1470.awsdns-55.orgFollow"


Question: Why am I seeing high CPU usage on my Amazon Redshift leader node?

My Amazon Redshift cluster's leader node is experiencing high CPU utilization. Why is this happening?

Answer: "My Amazon Redshift cluster's leader node is experiencing high CPU utilization. Why is this happening?Short descriptionYour Amazon Redshift cluster's leader node parses and develops execution plans to carry out database operations. The leader node also performs final processing of queries and merging or sorting of data before returning that data to the client. Depending on how complex or resource-intensive the database operations are, the CPU utilization can spike for your cluster's leader node.In particular, your leader node's CPU utilization can spike for the following reasons:Increase in database connectionsQuery compilation and recompilationHigh number of concurrent connectionsHigh number of concurrent queries running in WLMLeader node-only functions and catalog queriesNote: You can't check for specific processes that occupy your leader node. Use the STV_RECENTS table to check for the queries that are running at a particular time.ResolutionIncrease in database connectionsThe client server communicates with the Amazon Redshift cluster through the leader node. If there are a growing number of database connections, the CPU utilization increases to process those connections. Check Amazon CloudWatch metrics to make sure the DatabaseConnections limit hasn't been exceeded.Query compilation and recompilationAmazon Redshift generates and compiles code for each query execution plan. Query compilation and recompilation are resource-intensive operations, and this can result in high CPU usage of the leader node. However, CPU performance will return to normal when the query compilation or recompilation operations are complete.Note also that Amazon Redshift caches compiled code. When a query is submitted, Amazon Redshift reuses whatever segments are available while the remaining segments are recompiled. As a result, this process can contribute to high CPU usage of the leader node.Note: After an Amazon Redshift cluster reboots, the compiled segment stills persists, even though the results cache gets cleared. Amazon Redshift doesn't run the query if your query was previously cached. All caches are removed when a patch is applied.To check the compilation time (in seconds) and segment execution location for each query segment, use the SVL_COMPILE system view:select userid,xid,pid,query,segment,locus,starttime, endtime,datediff(second,starttime,endtime) as TimetoCompile,compile from svl_compile;High number of concurrent connectionsMore connections can lead to a higher concurrency and an increase in transactions of your Amazon Redshift cluster. The increase in transactions can result in high CPU utilization of the leader node.To check for concurrent connections, run the following query:select s.process as process_id,c.remotehost || ':' || c.remoteport as remote_address,s.user_name as username,s.starttime as session_start_time,s.db_name,i.starttime as current_query_time,i.text as query from stv_sessions sleft join pg_user u on u.usename = s.user_nameleft join stl_connection_log con c.pid = s.processand c.event = 'authenticated'left join stv_inflight i           on u.usesysid = i.userid          and s.process = i.pidwhere username <> 'rdsdb'order by session_start_time desc;Then, use PG_TERMINATE_BACKEND to close any active sessions.High number of concurrent queries running in WLMAll client connections are processed through the leader node. Before returning data to the client server, Amazon Redshift's leader node parses, optimizes, and then compiles queries. The leader node also distributes tasks to compute nodes, performing final sorting or aggregation. With high query concurrency, CPU usage can increase at the leader node level. Additionally, some database operations can be applied only at the leader node level. For example, a query with a LIMIT clause might consume high CPU because the limit is applied to the leader node before data is redistributed.To confirm whether there is correlation between the number of concurrent queries and CPU usage, first check the WLMRunningQueries and CPUutilization metrics in Amazon CloudWatch.Then, check to see which queries are consuming high CPU:SELECT userid, query, xid, aborted,ROUND(query_cpu_time::decimal,3),query_execution_time,segment_execution_time,substring(querytxt,1,250)FROM stl_queryJOIN(SELECT query,query_cpu_time,query_execution_time,segment_execution_timeFROM svl_query_metrics_summaryORDER BY 2 DESC) a USING (query)WHERE userid>1AND starttime BETWEEN '2019-12-02 22:00:00' and '2019-12-05 23:59:59'ORDER BY 5 DESC;Review the output to confirm which queries are processed by the leader node and any other outlier queries that increase CPU usage.Note: It's a best practice to tune query performance for your queries. Consider increasing your leader node capacity and choosing large node types (rather than adding more compute nodes).Leader node-only functions and catalog queriesAmazon Redshift implements certain SQL functions supported on the leader node. If there are complex queries with leader node functions and overloading catalog queries, then CPU utilization can spike on a leader node. For more information, see SQL functions supported on the leader node.To identify steps referencing catalog tables (which are executed only on a leader node), check the EXPLAIN plan:explain select * from pg_class;                           QUERY PLAN                          ---------------------------------------------------------------- LD Seq Scan on pg_class  (cost=0.00..24.57 rows=557 width=243)Check for the LD prefix in your output. In this example, the LD prefix appears in "LD Seq Scan on pg_class (cost=0.00..24.57 rows=557 width=243)". The LD prefix indicates that a query is running exclusively on a leader node, which can cause a spike in your CPU usage.Follow"


Question: How long does object replication take on Amazon S3?

I configured object replication from one Amazon Simple Storage Service (Amazon S3) bucket to another bucket. How long does it take to replicate objects?

Answer: "I configured object replication from one Amazon Simple Storage Service (Amazon S3) bucket to another bucket. How long does it take to replicate objects?ResolutionMost objects replicate within 15 minutes. However, sometimes replication can take a couple of hours. In rare cases, the replication can take longer.There are several factors that can affect replication time, including (but not limited to):The size of the objects to be replicated.For cross-Region replication, the pairing of the source and destination AWS Regions.If you don't see object replicas in the destination bucket after you configure replication, see Troubleshooting replication.Follow"


Question: How can I resolve connection issues between the CloudHSM client and the CloudHSM cluster?

I want to troubleshoot and resolve connection issues between my AWS CloudHSM cluster and HSM client.

Answer: "I want to troubleshoot and resolve connection issues between my AWS CloudHSM cluster and HSM client.ResolutionVerify that the CloudHSM client package installedCloudHSM clients must have the CloudHSM client software installed to communicate with the HSM. Verify that the CloudHSM client package is installed using one of the following commands:Red Hat Enterprise Linux (RHEL) and Amazon Linux:rpm -qa | grep cloudhsmUbuntu:dpkg --list | grep cloudhsmWindows PowerShell:Get-Service -Name AWSCloudHSMClientIf the CloudHSM client software isn't installed, follow the instructions to install it. For Linux distributions, see Install and configure the AWS CloudHSM client (Linux). For Windows, see Install and configure the AWS CloudHSM client (Windows).Verify that the CloudHSM security group is associated with the CloudHSM client instanceWhen you create a cluster, CloudHSM automatically creates a security group named cloudhsm-cluster-clusterID-sg, and then associates the groups with the cluster. Client instances must be associated with this cluster security group to access the HSM.1.    Open the CloudHSM console, and choose Clusters.2.    Choose the Cluster ID.3.    In General configuration under Security group, note the cloudhsm-cluster-clusterID-sg security group ID.4.    Open the Amazon EC2 console, and then choose Instances.5.    Choose your Instance ID, and then choose the Description tab.6.    Check the Security groups associated with the instance.7.    If the cloudhsm-cluster-clusterID-sg security group ID isn't associated with the EC2 instance, follow the instructions to Connect the Amazon EC2 instance to the AWS CloudHSM cluster.Verify that the CloudHSM client daemon is runningIf the CloudHSM client daemon is not running, then application hosts can't connect to HSMs. Verify that the CloudHSM client daemon is running using one of the following commands:Amazon Linux 2, CentOS 7, RHEL 7, and Ubuntu 16.04 LTS:sudo systemctl is-active cloudhsm-clientCentOS 6, Amazon Linux, and RHEL 6:sudo status cloudhsm-clientWindows PowerShell:Get-Service -Name AWSCloudHSMClient | Format-Table DisplayName,Status -AutoSizeIf the output shows the CloudHSM client daemon status as stopped, then follow the instructions to Start the AWS CloudHSM Client.Update the configuration file for the CloudHSM client elastic network interface IP address1.    Open the CloudHSM console, and then choose Clusters.2.    Choose Cluster ID.3.    Choose the HSMs tab, and then note ENI IP address.Note: You can also use the AWS Command Line Interface (AWS CLI) describe-clusters command.4.    For instructions to update the client's configuration file with the ENI IP address from step 3, see Lost connection to the cluster.For more information, see Troubleshooting AWS CloudHSM.Related informationWhich CloudHSM certificates are used for the client-server end-to-end encrypted connection?Follow"


Question: How can I troubleshoot high replica lag with Amazon RDS for MySQL?

I want to find the cause of replica lag when using Amazon Relational Database Service (Amazon RDS) for MySQL. How can I do this?

Answer: "I want to find the cause of replica lag when using Amazon Relational Database Service (Amazon RDS) for MySQL. How can I do this?Short descriptionAmazon RDS for MySQL uses asynchronous replication. This means that sometimes, the replica isn't able to keep up with the primary DB instance. As a result, replication lag can occur.When you use an Amazon RDS for MySQL read replica with binary log file position-based replication, you can monitor replication lag. In Amazon CloudWatch, check the ReplicaLag metric for Amazon RDS. The ReplicaLag metric reports the value of the Seconds_Behind_Master field of the SHOW SLAVE STATUS command.The Seconds_Behind_Master field shows the difference between the current timestamp on the replica DB instance. The original timestamp logged on the primary DB instance for the event that is being processed on the replica DB instance is also shown.MySQL replication works with three threads: the Binlog Dump thread, the IO_THREAD, and the SQL_THREAD. For more information about how these threads function, see the MySQL documentation for Replication threads. If there is a delay in replication, identify whether the lag is caused by the replica IO_THREAD or the replica SQL_THREAD. Then, you can identify the root cause of the lag.ResolutionTo identify which replication thread is lagging, see the following examples:1.    Run the SHOW MASTER STATUS command on the primary DB instance, and review the output:mysql> SHOW MASTER STATUS;+----------------------------+----------+--------------+------------------+-------------------+| File                       | Position | Binlog_Do_DB | Binlog_Ignore_DB | Executed_Gtid_Set |+----------------------------+----------+--------------+------------------+-------------------+| mysql-bin-changelog.066552|      521 |              |                  |                   |+----------------------------+----------+--------------+------------------+-------------------+1 row in set (0.00 sec)Note: In the example output, the source or primary DB instance is writing the binary logs to the file mysql-bin.066552.2.    Run the SHOW SLAVE STATUS command on the replica DB instance and review the output:Example 1:mysql> SHOW SLAVE STATUS\G;*************************** 1. row ***************************Master_Log_File: mysql-bin.066548Read_Master_Log_Pos: 10050480Relay_Master_Log_File: mysql-bin.066548Exec_Master_Log_Pos: 10050300Slave_IO_Running: YesSlave_SQL_Running: YesIn Example 1, the Master_Log_File: mysql-bin.066548 indicates that the replica IO_THREAD is reading from the binary log file mysql-bin.066548. The primary DB instance is writing the binary logs to the mysql-bin.066552 file. This output shows that the replica IO_THREAD is behind by four binlogs. But, the Relay_Master_Log_File is mysql-bin.066548, which indicates that the replica SQL_THREAD is reading from same file as the IO_THREAD. This means that the replica SQL_THREAD is keeping up, but the replica IO_THREAD is lagging behind.Example 2:mysql> SHOW SLAVE STATUS\G*************************** 1. row ***************************Master_Log_File: mysql-bin.066552Read_Master_Log_Pos: 430Relay_Master_Log_File: mysql-bin.066530Exec_Master_Log_Pos: 50360Slave_IO_Running: YesSlave_SQL_Running: YesExample 2 shows that the primary instance's log file is mysql-bin-changelog.066552. The output shows that IO_THREAD is keeping up with the primary DB instance. In the replica output, the SQL thread is performing Relay_Master_Log_File: mysql-bin-changelog.066530. As a result, SQL_THREAD is lagging behind by 22 binary logs.Normally, IO_THREAD doesn't cause large replication delays, because the IO_THREAD only reads the binary logs from the primary or source instance. But, network connectivity and network latency can affect the speed of the reads between the servers. The IO_THREAD replica might be performing slower because of high bandwidth usage.If the replica SQL_THREAD is the source of replication delays, then those delays could be caused by the following:Long-running queries on the primary DB instanceInsufficient DB instance class size or storageParallel queries run on the primary DB instanceBinary logs synced to the disk on the replica DB instanceBinlog_format on the replica is set to ROWReplica creation lagLong-running queries on the primary instanceLong-running queries on the primary DB instance that take an equal amount of time to run on the replica DB instance can increase seconds_behind_master. For example, if you initiate a change on the primary instance and it takes an hour to run, then the lag is one hour. Because the change might also take one hour to complete on the replica, by the time the change is complete, the total lag is approximately two hours. This is an expected delay, but you can minimize this lag by monitoring the slow query log on the primary instance. You can also identify long-running statements to reduce lag. Then, break long-running statements into smaller statements or transactions.Insufficient DB instance class size or storageIf the replica DB instance class or storage configuration is lower than the primary, then the replica might throttle because of insufficient resources. The replica is unable to keep up with the changes made on the primary instance. Make sure that the DB instance type of the replica is the same or higher than the primary DB instance. For replication to operate effectively, each read replica requires the same amount of compute and storage resources as the source DB instance. For more information, see DB instance classes.Parallel queries run on the primary DB instanceIf you run queries in parallel on the primary, they are committed in a serial order on the replica. This is because the MySQL replication is single threaded (SQL_THREAD), by default. If a high volume of writes to the source DB instance occurs in parallel, then the writes to the read replica are serialized using a single SQL_THREAD. This can cause a lag between the source DB instance and read replica.Multi-threaded (parallel) replication is available for MySQL 5.6, MySQL 5.7, and higher versions. For more information about multi-threaded replication, see the MySQL documentation for Binary logging options and variables.Multi-threaded replication can cause gaps in replication. For example, multi-threaded replication isn't a best practice when skipping the replication errors, because it's difficult to identify which transactions you are skipping. This can lead to gaps in data consistency between the primary and replica DB instances.Binary logs synced to the disk on the replica DB instanceTurning on automatic backups on the replica might result in overhead to sync the binary logs to the disk on the replica. The default value of the parameter sync_binlog is set to 1. If you change this value to 0, then you also turn off the synchronization of the binary log to the disk by the MySQL server. Instead of logging to the disk, the operating system (OS) occasionally flushes the binary logs to disk.Turning off the binary log synchronization can reduce the performance overhead required to sync the binary logs to disk on every commit. But, if there is a power failure or the OS crashes, some of the commits might not be synchronized to the binary logs. This asynchronization can affect point in time restore (PITR) capabilities. For more information, see the MySQL documentation for sync_binlog.Binlog_format is set to ROWIf you set binlog_format on the primary DB instance to ROW, and the source table is missing a primary key, then the SQL thread will perform a full table scan on replica. This is because the default value of parameter slave_rows_search_algorithms is TABLE_SCAN,INDEX_SCAN. To resolve this issue in the short term, change the search algorithm to INDEX_SCAN,HASH_SCAN to reduce the overhead of full table scan. For the long term, it's a best practice to add an explicit primary key to each table.For more information about the slave-rows-search-algorithms parameter, see the MySQL documentation for slave_rows_search_algorithms.Replica creation lagAmazon RDS creates a read replica of a MySQL primary instance by taking a DB snapshot. Then, Amazon RDS restores the snapshot to create a new DB instance (replica) and establishes replication between the two.Amazon RDS takes time to create new read replicas. When the replication is established, there is a lag for the duration of the time that it takes to create a backup of the primary. To minimize this lag, create a manual backup before calling for the replica creation. Then, the snapshot taken by the replica creation process is an incremental backup, which is faster.When you restore a read replica from a snapshot, the replica doesn't wait for all the data to be transferred from the source. The replica DB instance is available to perform the DB operations. The new volume is created from existing Amazon Elastic Block Store (Amazon EBS) snapshot loads in the background.Note: For Amazon RDS for MySQL replicas (EBS-based volumes), the replica lag can increase initially. This is because the lazy loading effect can influence the replication performance.Consider turning on the InnoDB cache warming feature. This can provide performance gains by saving the current state of the buffer pool of the primary DB instance. Then, reload the buffer pool on a restored read replica.Related informationWorking with MySQL replication in Amazon RDSWorking with MySQL read replicasFollow"


Question: How do I troubleshoot connecting to my EC2 Linux instance using a secondary IP address?

I can't connect to my Amazon Elastic Compute Cloud (Amazon EC2) Linux instance using a secondary IP address. How do I troubleshoot this?

Answer: "I can't connect to my Amazon Elastic Compute Cloud (Amazon EC2) Linux instance using a secondary IP address. How do I troubleshoot this?Short descriptionTo connect to your instance through SSH using a secondary IP address, make sure that your instance meets the following prerequisites:If you launched your instances in a private subnet, then connect through SSH using the secondary private IP address. Make sure to choose the secondary IPv4 address from the IPv4 CIDR block range of the subnet for the network interface.If you launched your instances in a public subnet, then allocate an Elastic IP address to the secondary private IP address attached to your instance.Make sure that the operating system on your EC2 instance recognizes the secondary private IP address.For Amazon Linux, see Configure the operating system on your instance to recognize secondary private IPv4 addresses.For Ubuntu, see How can I make my secondary network interface work in my Ubuntu EC2 instance?For other Linux distributions, see the network configuration documentation for your distribution.If your instance meets these prerequisites, then do the following to troubleshoot connecting through SSH:Connect through SSH with verbose messaging on to identify the error.Review the system logs to look for errors.ResolutionNote: Review the general connection prerequisites before beginning.Connect through SSH with verbose messaging on to identify the errorFor detailed instructions, see How do I troubleshoot problems connecting to my Amazon EC2 Linux instance using SSH?Review the system logs to look for errorsIf the preceding steps don't resolve the issue, then review the instance's system logs. There are two methods for accessing the logs on your instance:Method 1: Use the EC2 Serial ConsoleIf you enabled EC2 Serial Console for Linux, then you can use it to troubleshoot supported Nitro-based instance types. The serial console helps you troubleshoot boot issues, network configuration, and SSH configuration issues. The serial console connects to your instance without the need for a working network connection. You can access the serial console using the Amazon EC2 console or the AWS Command Line Interface (AWS CLI).Before using the serial console, you must grant access to it at the account level and create AWS Identity and Access Management (IAM) policies granting access to your IAM users. Also, every instance using the serial console must include at least one password-based user. If your instance is unreachable and you haven’t configured access to the serial console, follow the instructions in Method 2. For information on configuring the EC2 Serial Console for Linux, see Configure access to the EC2 Serial Console.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Method 2: Access the logs using a rescue instanceWarning: Before starting this procedure, be aware that:Stopping the instance erases any data on instance store volumes. Be sure that you backup any data on the instance store volume that you want to keep. For more information, see Determine the root device type of your instance.Stopping and then starting the instance changes the public IP address of your instance. It's a best practice to use an Elastic IP address instead of a public IP address when routing external traffic to your instance.1.    Open the Amazon EC2 console.2.    Choose Instances from the navigation pane, and select instance that you're trying to connect to.3.    Choose Instance State, Stop Instance, and then select Stop. Make a note of the Instance ID.Note: If you're not using the New EC2 Experience, then select the instance that you're trying to connect to. Then choose Actions, Instance State, Stop, Stop.4.    Detach the root Amazon Elastic Block Store (Amazon EBS) volume from the stopped instance. Make a note of the device name of the root EBS volume. The device name is required when you reattach the volume after troubleshooting.5.    Launch a new EC2 instance in the same Availability Zone as the original instance. The new instance becomes your "rescue" instance.Note: It's a best practice to use an Amazon Linux 2 instance as the rescue instance. Using an Amazon Linux 2 instance prevents the rescue instance from booting up from the attached EBS volume because the UUID or name of the EBS volume are the same.6.    After the rescue instance launches, choose Volumes from the navigation pane, and then select the detached root volume of the impaired instance.Note: If the impaired instance's root volume has Marketplace codes and the rescue instance isn't Amazon Linux, then stop the rescue instance before attaching the root EBS volume. An instance might have Marketplace codes if you launched the instance from an official RHEL or CentOS AMI, for example.7.    Choose Actions, Attach Volume.8.    Select Instances in the navigation pane, and then select the rescue instance.9.    Choose Instance state, Start instance.Note: If you're not using the New EC2 Experience console, then select the instance that you're trying to connect to, then choose Actions, Instance State, Start.11.    Connect to the rescue instance through SSH.12.    Run the following command to verify that the EBS volume successfully attached to the rescue instance. In the following command, the volume attached as /dev/sdf.$ lsblkThe following is an example of the command output:NAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTxvda    202:0    0   20G  0 disk └─xvda1 202:1    0   20G  0 part /xvdf    202:80   0  100G  0 disk13.    Use the following commands to create a mount point directory, and then mount the attached volume to the rescue instance. In the following example, the mount point directory is /test.$ sudo su$ mkdir /test$ mount /dev/xvdf1 /test$ df -h$ cd /test14.    Locate errors in the system logs and authentication-related logs that are timestamped with the times that you attempted access.Amazon Linux, RHEL, CentOS$ sudo cat /test/var/log/messagesAmazon Linux, RHEL, CentOS (Authentication-related issues)$ sudo cat /test/var/log/secureUbuntu, Debian (System Logs)$ sudo cat /test/var/log/syslogUbuntu, Debian (Authentication-related issues)$ sudo cat /test/var/log/auth.log15.    After reviewing the configurations and addressing any errors, unmount and detach the EBS root volume from the rescue instance.$ umount /test16.    Attach the volume to the original instance. The device name is /dev/xvda.Related informationConnect to your Linux instance using an SSH clientFollow"


Question: How do I troubleshoot packet loss on my AWS VPN connection?

I'm having constant or intermittent packet loss and high latency issues with my AWS Virtual Private Network (AWS VPN) connection. What tests can I run to be sure that the issue isn't occurring inside my Amazon Virtual Private Cloud (Amazon VPC)?

Answer: "I'm having constant or intermittent packet loss and high latency issues with my AWS Virtual Private Network (AWS VPN) connection. What tests can I run to be sure that the issue isn't occurring inside my Amazon Virtual Private Cloud (Amazon VPC)?Short descriptionPacket loss issues vary with AWS VPN Internet traffic hops between the on-premises network and the Amazon VPC. It's a best practice to isolate and confirm where the packet loss is coming from.ResolutionCheck the source and destination hosts for resource utilization issues such as CPUUtilization, NetworkIn/NetworkOut, NetworkPacketsIn/NetworkPacketsOut to verify that you aren't hitting network limits.Use MTR to check for ICMP or TCP packet loss and latencyMTR provides a continuous updated output that allows you to analyze network performance over time. It combines the functionality of traceroute and ping in a single network diagnostic tool.Install the MTR network tool on your EC2 instance in the VPC to check for ICMP or TCP packet loss and latency.Amazon Linux:sudo yum install mtrUbuntu:sudo apt-get install mtrWindows:Download and install WinMTR.Note: For Windows OS, WinMTR doesn't support TCP-based MTR.Run the following tests between the private and public IP address for your EC2 instances and on-premises host bi-directionally. The path between nodes on a TCP/IP network can change when the direction is reversed. It's a best practice to get MTR results bi-directionally.Note:Make sure that the security group and NACL rules allow ICMP traffic from the source instance.Make sure that the test port is open on the destination instance, and the security group and NACL rules allow traffic from the source on the protocol and port.The TCP-based result determine if there is application-based packet loss or latency on the connection. MTR version 0.85 and higher have the TCP option.Private IP EC2 instance on-premises host report:mtr -n -c 200Private IP EC2 instance on-premises host report:mtr -n -T -c 200 -P 443 -m 60Public IP EC2 instance on-premises host report:mtr -n -c 200Public IP EC2 instance on-premises host report:mtr -n -T -c 200 -P 443 -m 60Use traceroute to determine latency or routing issuesThe Linux traceroute utility identifies the path taken from a client node to the destination node. The utility records the time in milliseconds for each router to respond to the request. The traceroute utility also calculates the amount of time each hop takes before reaching its destination.To install traceroute, run the following commands:Amazon Linux:sudo yum install tracerouteUbuntu:sudo apt-get install traceroutePrivate IP address of EC2 instance and on-premises host test:Amazon Linux:sudo traceroutesudo traceroute -T -p 80Windows:tracerttracetcpNote: The arguments -T -p 80 -n perform a TCP-based trace on port 80. Be sure that you have port 80 or the port that you are testing open bi-directionally.The Linux traceroute option to specify a TCP-based trace instead of ICMP is useful because most internet devices deprioritize ICMP-based trace requests. A few timed-out requests are common, so watch for packet loss to the destination or in the last hop of the route. Packet loss over several hops might indicate an issue.Note: It's a best practice to run the traceroute command bi-directionally from the client to the server and then from the server back to the client.Use hping3 to determine end-to-end TCP packet loss and latency problemsHping3 is a command-line oriented TCP/IP packet assembler and analyzer that measures end-to-end packet loss and latency over a TCP connection. In addition to ICMP echo requests, hping3 supports TCP, UDP, and RAW-IP protocols. Hping3 also includes a traceroute mode that can send files between a covered channel. Hping3 is designed to scan hosts, assist with penetration testing, test intrusion detection systems, and send files between hosts.MTRs and traceroute capture per-hop latency. However, hping3 yields results that show end-to-end min/avg/max latency over TCP in addition to packet loss. To install hping3, run the following commands:Amazon Linux:sudo yum --enablerepo=epel install hping3Ubuntu:sudo apt-get install hping3Run the following commands:hping3 -S -c 50 -V <Public IP of EC2 instance or on-premises host>hping3 -S -c 50 -V <Private IP of EC2 instance or on-premises host>Note: By default, hping3 sends TCP headers to the target host's port 0 with a winsize of 64 without the tcp flag on.Packet capture samples using tcpdump or WiresharkPerforming simultaneous packet captures between your test EC2 instance in the VPC and your on-premises host when duplicating the issue helps to determine if there are any application or network layer issues on the VPN connection. You can install tcpdump on your Linux instance or Wireshark on a Windows instance to perform packet captures.Install tcpdump on Amazon Linux:sudo yum install tcpdumpInstall tcpdump on Ubuntu:sudo apt-get install tcpdumpInstall Wireshark on Windows OS:Install Wireshark and take a packet capture.Explicit Congestion Notification (ECN)For connecting to Windows instances, enabling ECN might cause packet losses or performance issues. Disable ECN to improve performance.Run the following command to determine if ECN capability is enabled:netsh interface tcp show globalIf ECN capability is enabled, run the following command to disable it:netsh interface tcp set global ecncapability=disabledRelated informationHow do I troubleshoot network performance issues between Amazon EC2 Linux instances in a VPC and an on-premises host over the internet gateway?How can I determine whether my DNS queries to the Amazon provided DNS server are failing due to VPC DNS throttling?Follow"


Question: How do I set up an AWS Network Firewall with a NAT gateway?

I want to configure my AWS Network Firewall to inspect traffic using a NAT gateway.

Answer: "I want to configure my AWS Network Firewall to inspect traffic using a NAT gateway.Short descriptionAWS Network Firewall provides more granular control over traffic to and from the resources inside your Amazon Virtual Private Cloud (Amazon VPC). To protect your Amazon VPC resources, you can deploy your Network Firewall endpoints in their own subnets and route the workload instance traffic through them. This can be done by:Creating a VPCCreating a firewallConfiguring the traffic routingNote: Network Firewall cannot inspect workloads in the same subnet where the firewall endpoints are deployed.ResolutionCreating a VPCOpen the Amazon VPC console.On the VPC dashboard, click Create VPC.Under VPC settings, enter the following:Choose VPC and more.Under Name tag auto-generation, enter a name for the VPC. For this example, the VPC is named Protected_VPC_10.0.0.0_16-vpc. If the Auto-generate option is selected, the name will be added as a name tag to all resources in the VPC.For IPv4 CIDR block, enter 10.0.0.0/16.For IPv6 CIDR block, choose No IPv6 CIDR block.For Tenancy, choose Default.For Number of Availability Zones (AZs), choose 2.Under Customize AZs, choose two Availability Zones. For this example, us-east-2a and us-east-2b are selected.For Number of public subnets, choose 2.For Number of private subnets, choose 4. Two of the private subnets are for the firewall and two are for the workload subnets.For NAT gateways ($), choose 1 per AZ. The NAT gateways are deployed in the public subnets automatically.For VPC endpoints, choose None.Choose Create VPC.Name the subnets according to their purpose:The two public subnets are for the NAT gateways and are named Public_Subnet_AZa and Public_Subnet_AZb for this example.For the private subnets, two are for the firewall endpoints and are named Firewall_Subnet_AZa and Firewall_Subnet_AZb for this example.The other two private subnets are for the workload endpoints and are named Private_Subnet_AZa and Private_Subnet_AZb for this example.Create a firewallOn the navigation pane, under Network Firewall, choose Firewalls.Choose Create firewall.Under Create firewall, enter the following:Enter a name for the firewall. For this example, the firewall is named Network-Firewall-Test.For VPC, choose Protected_VPC_10.0.0.0_16-vpc.For Firewall subnets, choose the first Availability Zone (us-east-2a) and choose Firewall_Subnet_AZa for the subnet. Then, choose Add new subnet and repeat for the second Availability Zone (us-east-2b) and choose Firewall_Subnet_AZb for the subnet.For Associated firewall policy, choose Create and associate an empty firewall policy.For New firewall policy name, enter a name for the new policy.Choose Create firewall. Each subnet must have a unique routing table. The four private subnets have a unique routing table associated with it, while the public subnets share a routing table. You must create a new routing table with a static route to an internet gateway and associate it to one of the public subnets.Configure the traffic routingThe traffic flows as follows:Traffic initiated from workload instance in AZa is forwarded to firewall endpoint in AZa.The firewall endpoint in AZa will route the traffic to the NAT gateway in AZa.NAT gateway in AZa forwards the traffic to the internet gateway associated with the VPC.The internet gateway forwards the traffic out to the internet.The reverse traffic follows the same path in the opposite direction:Return traffic from the internet reaches the internet gateway attached to the VPC. There can only be one internet gateway attached to a VPC.The internet gateway forwards the traffic to the NAT gateway in AZa. The internet gateway makes this decision based on the workload Availability Zone. Because the destination of the traffic is in AZa, the internet gateway picks the NAT gateway in AZa to forward the traffic. There is no need to maintain a route table for internet gateway.The NAT gateway in AZa forward the traffic to the firewall endpoint in AZa.The firewall endpoint in AZa forward the traffic to the workload in AZa.Note: Internet gateways can identify the NAT gateway for packets returning from the internet to the workload instances.After creating the VPC and firewall, you must configure the routing tables. When configuring the routing tables, keep the following in mind:The private subnet in AZa (Private_Subnet_AZa) forwards all traffic destined to the internet to the firewall endpoint in AZa (Firewall_Subnet_AZa). This is repeated with the private subnet in AZb and the firewall endpoint in AZb.The firewall subnet in AZa (Firewall_Subnet_AZa) forwards all traffic destined to the internet to a NAT gateway in AZa ( Public_Subnet_AZa). This is repeated with the firewall subnet in AZb and the NAT gateway in AZb.The public subnet in AZa (Public_Subnet_AZa) forwards all traffic to the internet gateway attached to the VPC.Return traffic follows the same path in reverse.Note: Traffic is kept in the same Availability Zone so that the network firewall has both the egress and ingress traffic route through the same firewall endpoint. This allows the firewall endpoints in each Availability Zone to make stateful inspections of the packets.The following are example configurations of the routing tables:Public_Subnet_RouteTable_AZa (Subnet association: Public_Subnet_AZa)DestinationTarget0.0.0.0/0Internet gateway10.0.0.0/16Local10.0.128.0/20Firewall endpoint in AZaNote: In this example, 10.0.128.0/20 is the CIDR of Private_Subnet_AZa.Public_Subnet_RouteTable_AZb (Subnet association: Public_Subnet_AZb)DestinationTarget0.0.0.0/0Internet gateway10.0.0.0/16Local10.0.16.0/20Firewall endpoint in AZbNote: In this example, 10.0.16.0/20 is the CIDR of Private_Subnet_AZb.Firewall_Subnet_RouteTable_AZa (Subnet association: Firewall_Subnet_AZa)DestinationTarget0.0.0.0/0NAT gateway in Public_Subnet_AZa10.0.0.0/16LocalFirewall_Subnet_RouteTable_AZb (Subnet association: Firewall_Subnet_AZb)DestinationTarget0.0.0.0/0NAT gateway in Public_Subnet_AZb10.0.0.0/16LocalPrivate_Subnet_RouteTable_AZa (Subnet association: Private_Subnet_AZa)DestinationTarget0.0.0.0/0Firewall endpoint in AZa10.0.0.0/16LocalPrivate_Subnet_RouteTable_AZb (Subnet association: Private_Subnet_AZb)DestinationTarget0.0.0.0/0Firewall endpoint in AZb10.0.0.0/16LocalTo verify if your routing was configured correctly, you can deploy an EC2 instance in one of your private subnets to test your internet connectivity. Without any rules configured in the network firewall policy, traffic will not be inspected and can reach the internet. After confirming your routing, security group, and network access control lists (network ACLs) are configured, add rules to your firewall policy.Note: You can also set up Network Firewall to route traffic from the internet through the firewall, then the NAT gateway. For more information, see Architecture with an internet gateway and a NAT gateway.Related informationLogging and monitoring in AWS Network FirewallRoute table conceptsDeployment models for AWS Network Firewall with VPC routing enhancementsFollow"


Question: How do I assign a static hostname to an Amazon EC2 instance running SLES?

"I changed the hostname of my Amazon Elastic Compute Cloud (Amazon EC2) instance. However, when I reboot or stop and then start the instance, the hostname changes back. How do I make the hostname persist?"

Answer: "I changed the hostname of my Amazon Elastic Compute Cloud (Amazon EC2) instance. However, when I reboot or stop and then start the instance, the hostname changes back. How do I make the hostname persist?Short descriptionTo make a hostname persist when rebooting or stopping and starting your EC2 instance, add the hostname to the appropriate configuration files on the instance.Note: The following steps apply to SLES. For instructions that apply to other distributions, see one of the following:Changing the system hostnameHow do I assign a static hostname to an Amazon EC2 instance running RHEL 5 or 6, CentOS 5 or 6, or Amazon Linux?How do I assign a static hostname to an Amazon EC2 instance running Ubuntu Linux?How do I assign a static hostname to an Amazon EC2 instance running RHEL 7 or CentOS 7?Resolution1.    Connect to your EC2 Linux instance using SSH. For more information, see Connecting to your Linux instance using SSH.2.    Switch to the root user.sudo su3.    Use the hostnamectl command to set the new hostname. Replace new-hostname with your hostname.SLES 11:hostname new-hostnameSLES 12 and SLES 15:hostnamectl set-hostname new-hostname4.    Use the vim editor to update the /etc/hosts file with the new hostname.vim /etc/hosts5.    Find the localhost string and append the new hostname. Again, replace new-hostname with your hostname.127.0.0.1 localhost new-hostname6.    Save and exit the vim editor by pressing Shift + : (colon) to open a new command entry box in the vim editor. Type wq and then press Enter to save changes and exit the vim editor.SLES 11 (additional step for this OS version only)Use the vim editor to update the /etc/HOSTNAME file with the new hostname.vim /etc/HOSTNAMEFind the current hostname string and replace it with the new hostname.Press Shift + : (colon) to open a new command entry box in the vim editor, type wq, and then press Enter to save changes and exit vim.7.    Use the vim editor to update the /etc/cloud/cloud.cfg file on your SLES Linux instance.vim /etc/cloud/cloud.cfg8.    Find the preserve_hostname string and change the default setting to true so that the hostname is preserved between restarts or reboots.preserve_hostname: true9.    Save and exit the vim editor by pressing Shift + : (colon) to open a new command entry box in the vim editor. Type wq and then press Enter to save changes and exit the vim editor.10.    Reboot the instance.sudo reboot11.    Connect to your EC2 instance, and then run the Linux hostname command without any parameters to verify that the hostname change persisted.hostnameThe command returns the new hostname.Related informationChanging the hostname of your Linux instanceFollow"


Question: Why do I get Access Denied errors when I use a Lambda function to upload files to an Amazon S3 bucket in another AWS account?

I get an Access Denied error when I use an AWS Lambda function to upload files to an Amazon Simple Storage Service (Amazon S3) bucket. The Amazon S3 bucket is in another AWS account.

Answer: "I get an Access Denied error when I use an AWS Lambda function to upload files to an Amazon Simple Storage Service (Amazon S3) bucket. The Amazon S3 bucket is in another AWS account. Short descriptionIf the permissions between a Lambda function and an Amazon S3 bucket are incomplete or incorrect, then Lambda returns an Access Denied error.To set up permissions between a Lambda function in one account (account 1) and an S3 bucket in another account (account 2), do the following:1.    (In account 1) Create a Lambda execution role that allows the Lambda function to upload objects to Amazon S3.2.    (In account 2) Modify the S3 bucket's bucket policy to allow the Lambda function to upload objects to the bucket.ResolutionImportant: The following solution requires a Lambda function in one AWS account and an S3 bucket in another account.Example code for a Lambda function that uploads files to an S3 bucket (Python version 3.8)import json            import boto3                        s3 = boto3.client('s3')                        def lambda_handler(event,context):            bucket = 'AccountBBucketName'            transactionToUpload = {}            transactionToUpload['transactionId'] = '12345'            transactionToUpload['type'] = 'PURCHASE'            transactionToUpload['amount'] = 20            transactionToUpload['customerId'] = 'CID-1111'                        filename = 'CID-1111'+'.json'            uploadByteStream = bytes(json.dumps(transactionToUpload).encode('UTF-8'))            s3.put_object(Bucket=bucket, Key=filename, Body=uploadByteStream, ACL='bucket-owner-full-control')            print("Put Complete")Note: Before passing the bucket-owner-full-control ACL in the upload request, confirm that ACLs aren't deactivated on the bucket. Do this in the ownership settings of the S3 bucket. For more information, see Controlling ownership of objects and disabling ACLs for your bucket. (In account 1) Create a Lambda execution role that allows the Lambda function to upload objects to Amazon S31.    Create an AWS Identity and Access Management (IAM) role for your Lambda function.2.    Copy the IAM role's Amazon Resource Name (ARN).Note: You must get the IAM role's ARN before you can update the S3 bucket's bucket policy. One way to get the IAM role's ARN is to run the AWS Command Line Interface (AWS CLI) get-role command. If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.3.    Attach a policy to the IAM role that grants the permission to upload objects (s3:PutObject) to the bucket in Account 2.Example IAM policy that grants an IAM role s3:PutObject and s3:PutObjectAcl permissions{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:PutObject",        "s3:PutObjectAcl"      ],      "Resource": "arn:aws:s3:::AccountBBucketName/*"    }  ]}4.    Change your Lambda function's execution role to the IAM role that you created. For instructions, see Configuring Lambda function options.(In account 2) Modify the S3 bucket's bucket policy to allow the Lambda function to upload objects to the bucketUpdate the bucket policy so that it specifies the Lambda execution role's ARN as a Principal that has access to the action s3:PutObject.Example S3 bucket policy that allows a Lambda function to upload objects to the bucketNote: The following policy also grants the Lambda function's execution role the permission to s3:PutObjectAcl.{            "Version": "2012-10-17",            "Statement": [            {            "Effect": "Allow",            "Principal": {            "AWS": "arn:aws:iam::AccountA:role/AccountARole"            },            "Action": [            "s3:PutObject",            "s3:PutObjectAcl"            ],            "Resource": "arn:aws:s3:::AccountBBucketName/*",            "Condition": {            "StringEquals": {            "s3:x-amz-acl": "bucket-owner-full-control"            }            }            }            ]            }Related informationHow do I troubleshoot 403 Access Denied errors from Amazon S3?Follow"


Question: How do I build a Lambda deployment package for C# .NET?

"I created an AWS Lambda function deployment package in C#. However, when I try to invoke the function, Lambda returns one of the following errors: "module not found," "module cannot be loaded," or "cannot find class." How do I troubleshoot the issue?"

Answer: "I created an AWS Lambda function deployment package in C#. However, when I try to invoke the function, Lambda returns one of the following errors: "module not found," "module cannot be loaded," or "cannot find class." How do I troubleshoot the issue?Short descriptionIf your C# Lambda function returns any of the following errors, then the function's deployment package's folder structure isn't configured correctly:module not foundmodule cannot be loadedcannot find classTo resolve the issue, you must build a C# Lambda function deployment package that has the correct folder structure. There are two ways you can build and deploy a C# Lambda function deployment package with the correct folder structure:The .NET Core command line interface (.NET Core CLI) and the Amazon.Lambda.Tools extensionThe AWS Toolkit for Visual StudioResolutionTo use the .NET Core CLI and the Amazon.Lambda.Tools extension1.    Install the default Lambda .NET templates and add the Amazon.Lambda.Tools extension to the .NET Core CLI by running the following command:dotnet new -i 'Amazon.Lambda.Templates::*'2.    Either create a new Lambda function using one of the templates you installed, or add the Amazon.Lambda.Tools extension to an existing project.To create a new Lambda function using one of the templates you installedFrom the .NET Core CLI in the Lambda function's project root directory, run the following command:Important: Replace {function-name} with your function's name. Replace {aws-region} with the AWS Region that you want your function in.dotnet new lambda.EmptyFunction --name {function-name} --profile default --region {aws-region}To add the Amazon.Lambda.Tools extension to an existing projectFrom the .NET Core CLI in the Lambda function's project root directory, run the following command:dotnet tool install -g Amazon.Lambda.ToolsNote: The Amazon.Lambda.Tools extension will prompt you to provide any required parameters that are missing.3.    Download your deployment package's dependencies by running the following command:Important: Replace {your-function-directory} with your function directory's name.cd {your-function-directory}dotnet restoreNote: If you get a not compatible error, make sure that you're using a version of .NET Core that's compatible with Lambda tools. To download earlier versions of .NET Core, see the .NET Download Archives website.4.    Build your Lambda deployment package by running the following command:dotnet lambda deploy-functionNote: Or, you can build a Lambda deployment package from scratch and deploy it separately. For instructions, see Deploying an AWS Lambda project with the .NET Core CLI.5.    The .NET Core CLI prompts you to enter a function name and assign an AWS Identity and Access Management (IAM) role to the function. Enter a name for your function and assign the function an IAM role. Your function is then created.To use the AWS Toolkit for Visual Studio1.    Download and install the AWS Toolkit for Visual Studio.2.    Create and build an AWS Lambda Project (.NET Core) project. For instructions, see Using the AWS Lambda templates in the AWS Toolkit for Visual Studio and AWS Toolkit for Visual Studio in the AWS Lambda developer guide.Important: Make sure that the function handler signature is in the following format:ASSEMBLY::TYPE::METHODTo confirm that the function is formatted correctly, review the files under your function's src/{function-name} directory. For more information, see .NET Core CLI and AWS Lambda function handler in C#.Follow"