Question: How do I configure a provisioned Amazon Aurora DB cluster to be publicly accessible?

"I have a provisioned Amazon Aurora DB cluster, and I want to configure it to be publicly accessible. Also, I want to secure my Aurora DB cluster from outside connections. How can I do this?"

Answer: "I have a provisioned Amazon Aurora DB cluster, and I want to configure it to be publicly accessible. Also, I want to secure my Aurora DB cluster from outside connections. How can I do this?Short descriptionTo connect to an Aurora DB cluster from outside the Amazon Virtual Private Cloud (Amazon VPC), the instances in the cluster must meet the following requirements:The DB instance has a public IP address.The DB instance is run in a publicly accessible subnet.In addition to configuring your DB instance to be connected from outside a VPC, you can secure the connections using Transport Layer Security (TLS).ResolutionSet Publicly Accessible setting of DB instance to YesThe Publicly Accessible setting for an Amazon Relational Database Service (Amazon RDS) DB instance controls the assignment of a public IP address to the DB instance.If this is set to No, then the DB instance does not have a public IP address.If this is set to Yes, then the DB instance has both public and private IP addresses.To change the Publicly Accessible setting of the DB instance to Yes, follow these steps:Open the Amazon RDS console.Choose Databases from the navigation pane, and then choose the DB instance.Choose Modify.Under Connectivity, extend the Additional configuration section, and then choose Publicly accessible.Choose Continue.Choose Modify DB InstanceNote: You don't need to choose Apply Immediately. For more information about how Apply Immediately can affect downtime, see Using the Apply Immediately parameter.Run DB instance in a public subnetA public subnet is a subnet that is associated with a route table that has a route to internet gateway, typically the default route, 0.0.0.0/0. This route turns on the DB instances in a subnet to communicate with resources outside the VPC.For Aurora DB instances, you can't choose a specific subnet. Instead, choose a DB subnet group when you create the instance.A DB subnet group is a collection of subnets that belong to a VPC. When it creates the underlying host, Amazon RDS randomly chooses a subnet from the DB subnet group. Typically, a VPC has both public and private subnets. If the DB subnet group contains public and private subnets, then launch the underlying host in a public subnet or a private subnet. You can't connect to the DB instance from outside of the VPC if the underlying host is launched in a private subnet.Instead, create a DB subnet group with subnets of similar network configuration. For example, create a DB subnet group for public subnets and a second DB subnet group for private subnets. For more information, see Working with a DB instance in a subnet group.Follow these steps to make sure that the subnet used by your DB instance has internet access:Verify that your VPC has an internet gateway attached to it.Verify that all the subnets in the DB subnet group use a route table with Internet Gateway.If the subnet uses the main route table of the VPC, then add the route for Internet Gateway (Destination is 0.0.0.0/0).If required, create a custom route table with route to Internet Gateway and associate it to the subnet.Add the source public IP address that you want to connect to the DB instance from in the inbound rules for the security group.For rule Type, choose MySQL/Aurora or PostgreSQL, depending on your engine type.For Source, enter the CIDR range manually, or choose My IP to connect to the DB instance from the same workstation.Secure the DB cluster from connections from outside the VPCYou can use TLS to encrypt connections that come from outside a VPC because the data transfer happens over the internet. To confirm that you're using the highest level of security, use the ssl-ca parameter to pass the CA certificate, and then turn on hostname validation. Use the following example commands for TLS connections, depending on the version of Aurora that you are using.Amazon Aurora MySQL-Compatible Edition 5.6 and later:mysql -h test-aurora-56.cluster-xxxxxxxxxxxx.us-east-1.rds.amazonaws.com -u master_user --ssl-ca=rds-combined-ca-bundle.pem --ssl-verify-server-certAurora MySQL-Compatible 5.7 and later:mysql -h test-aurora-57.cluster-xxxxxxxxxxxx.us-east-1.rds.amazonaws.com -u master_user --ssl-ca=rds-combined-ca-bundle.pem --ssl-mode=VERIFY_IDENTITYAmazon Aurora PostgreSQL-Compatible Edition:psql -h test-aurora-pg.cluster-xxxxxxxxxxxx.us-east-1.rds.amazonaws.com -p 5432 "dbname=postgres user=master_user sslrootcert=rds-combined-ca-bundle.pem sslmode=verify-full"Note: You can also enforce TLS for DB clusters. For Aurora MySQL, you must enforce TLS at the database user level. For Aurora PostgreSQL-Compatible, set the parameter rds.force_ssl to 1.Related informationUsing SSL/TLS with Aurora MySQL DB clustersSecuring Aurora PostgreSQL data with SSLHow can I connect to my Amazon RDS DB instance using a bastion host from my Linux/macOS machine?How can I configure private and public Aurora endpoints in the Amazon RDS console?Follow"


Question: "Why isn’t the Start menu, Action Center, or Cortana Search responding after I rebuilt my Windows 10 WorkSpace?"

"My Start menu, Action Center, or Windows Search isn't working after rebuilding my Amazon WorkSpaces Windows 10 WorkSpace. How can I fix this?"

Answer: "My Start menu, Action Center, or Windows Search isn't working after rebuilding my Amazon WorkSpaces Windows 10 WorkSpace. How can I fix this?Short descriptionWhen you rebuild a WorkSpace, a new WorkSpace is created from the custom bundle. However, the D:\ drive, which contains the user profile, restores from the latest Amazon Elastic Block Store (Amazon EBS) snapshot of the volume. The user profile's TileDataLayer database is closely integrated with the Start menu, Action Center, and Cortana Search. A WorkSpace rebuild can create a mismatch between the information that the new Operating System has and the modified database within the user profile.This issue can affect WorkSpaces that are launched or rebuilt from a custom bundle created before May 2019.Your Windows 10 WorkSpace might exhibit one of the following symptoms because of the information mismatch:Choosing the Windows Start menu doesn’t produce any effect.Choosing Windows Action Center doesn’t produce any effect.Windows Search doesn’t open from the taskbar.ResolutionRepair Search functionality1.    Connect to the WorkSpace from another user account using Remote Desktop Protocol (RDP).2.    Navigate to the following location within the assigned user’s profile: D:%userprofile%\Appdata\local\packages3.    Delete the Microsoft.Windows.Cortana_cw5n1h2txyewy folder.4.    Reboot the WorkSpace.5.    Connect to the WorkSpace using the Amazon WorkSpaces client.6.    Open Windows PowerShell as administrator, and then run the following command:Get-AppXPackage -AllUsers -Name Microsoft.windows.cortana | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "$($_.InstallLocation)\AppXManifest.xml" -Verbose}Expected output:VERBOSE: Performing the operation "Register package" on target "C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppXManifest.xml".VERBOSE: Operation completed for: C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\AppXManifest.xmlSearch functionality resumes immediately.Repair Start menu and Action Center functionality1.    Navigate to the following location within the assigned user’s profile: D:%userprofile%\AppData\local\packages2.    Delete the Microsoft.Windows.ShellExperienceHost_cw5n1h2txyewy folder.3.    Open Windows PowerShell as administrator, and then run the following command:Get-AppXPackage -AllUsers | Foreach {Add-AppxPackage -DisableDevelopmentMode -Register "C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\AppXManifest.xml"}Start menu functionality resumes immediately.Custom bundleIf you use a custom bundle, be sure to update the bundle for future rebuilds.Related informationWhy isn't the Start menu, Action Center, or Cortana Search responding after I rebuilt my Windows 10 BYOL WorkSpace?Follow"


Question: How do I resolve "Invalid permissions on Lambda function" errors from API Gateway REST APIs?

"When I invoke my AWS Lambda function using an Amazon API Gateway REST API, I get an "Invalid permissions on Lambda function" error. What's causing the error, and how do I resolve it?"

Answer: "When I invoke my AWS Lambda function using an Amazon API Gateway REST API, I get an "Invalid permissions on Lambda function" error. What's causing the error, and how do I resolve it?Short descriptionIf your API Gateway REST API tries to invoke your Lambda function without Lambda invoke permission, then API Gateway returns the following error: "Invalid permissions on Lambda function"If you set up CloudWatch logging for your REST API, then API Gateway also logs one of the following error messages:CloudWatch error message example for REST APIs with a Lambda integration"Sending request to https://lambda.xx.amazonaws.com/2015-03-31/functions/arn:aws:lambda:xx:xx:function:xxx/invocationsExecution failed due to configuration error: Invalid permissions on Lambda functionMethod completed with status: 500"CloudWatch error message example for REST APIs with a Lambda authorizer"Sending request to https://lambda.xx.amazonaws.com/2015-03-31/functions/arn:aws:lambda:xx:xxx:function:xx/invocationsExecution failed due to configuration error: Invalid permissions on Lambda functionExecution failed due to configuration error: Authorizer error"ResolutionTo resolve these errors, do one of the following:Add a resource-based Lambda invoke permission to your REST API using one of the methods described in this article.-or-Configure an AWS Identity and Access Management (IAM) execution role that grants your REST API permission to invoke your function.For more information, see API Gateway permissions model for invoking an API.Note:If you receive a 401 Unauthorized error, follow the instructions in Why am I getting API Gateway 401 Unauthorized errors after creating a Lambda authorizer?If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.To add Lambda invoke permission to a REST API with a Lambda integration using the API Gateway console1.    In the API Gateway console, on the APIs pane, choose the name of your REST API.2.    On the Resources pane, choose the configured HTTP method.3.    On the Method Execution pane, choose Integration Request.4.    For Integration type, choose Lambda Function.5.    Expand the Lambda Region dropdown list. Then, choose the AWS Region that your Lambda function is in.6.    Choose the Lambda Function dropdown list. Then, choose the name of your Lambda function.7.    A prompt appears that gives you the option to Add Permission to Lambda Function. Choose OK.8.    Choose Save. Then, choose Deploy the API to add the Lambda invoke permission to your API.To add Lambda invoke permission to a REST API with a Lambda integration using a CloudFormation templateAdd the following code snippet to your CloudFormation template:Important: Replace <api-id> with your apiID. Replace the FunctionName value with the name of your Lambda function. Replace the SourceArn value with your API's source Amazon Resource Name (ARN).SampleApiPermission:    Type: AWS::Lambda::Permission    Properties:      Action: "lambda:InvokeFunction"      FunctionName: !Ref MyLambdaFnA1      Principal: "apigateway.amazonaws.com"      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:<api-id>/*/<method>/<resource>"For more information on how to declare various CloudFormation template parts, see Template snippets.To add Lambda invoke permission to a REST API with a Lambda integration using the AWS CLIRun the following add-permission AWS CLI command:Important: Replace the function-name value with the name of your Lambda function. Replace the source-arn value with the source ARN of your API. Replace the statement-id value with a statement identifier that differentiates the statement from others in the same policy.aws lambda add-permission   \--function-name "$FUNCTION_NAME"   \--source-arn "arn:aws:execute-api:$API_GW_REGION:$YOUR_ACCOUNT:$API_GW_ID/*/$METHOD/$RESOURCE"   \--principal apigateway.amazonaws.com   \--statement-id $STATEMENT_ID   \--action lambda:InvokeFunctionTo add Lambda invoke permission to a REST API with a Lambda authorizer using the API Gateway console1.    Create an IAM role for API Gateway that allows the "lambda:InvokeFunction" action. Then, copy the IAM role ARN to your clipboard.2.    In the API Gateway console, on the APIs pane, choose the name of your REST API.3.    On the Authorizers pane, choose the configured Lambda authorizer. Then, choose Edit.4.    For Lambda Invoke Role, enter the IAM role ARN you copied to your clipboard.5.    Choose Save. Then, choose Deploy the API.To add Lambda invoke permission to a REST API with a Lambda authorizer using a CloudFormation templateAdd the following code snippet to your CloudFormation template:Important: Replace <api-id> with your apiID. Replace the FunctionName value with the name of your Lambda function. Replace <auth-id> with your Lambda authorizer's authorizerId.SampleApiAuthPermission:    Type: AWS::Lambda::Permission    Properties:      Action: "lambda:InvokeFunction"      FunctionName: !Ref MyLambdaFnA1      Principal: "apigateway.amazonaws.com"      SourceArn: !Sub "arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:<api-id>/authorizers/<auth-id>"For more information on how to declare various CloudFormation template parts, see Template snippets.To add Lambda invoke permission to a REST API with a Lambda authorizer using the AWS CLIRun the following add-permission AWS CLI Command:Important: Replace the function-name value with the name of your Lambda function. Replace the source-arn value with the source ARN of your API. Replace the statement-id value with a statement identifier that differentiates the statement from others in the same policy.aws lambda add-permission   \--function-name "$FUNCTION_NAME"   \--source-arn "arn:aws:execute-api:$API_GW_REGION:$YOUR_ACCOUNT:$API_GW_ID/authorizers/$AUTHORIZER_ID"   \--principal apigateway.amazonaws.com   \--statement-id $STATEMENT_ID   \--action lambda:InvokeFunctionRelated informationUsing resource-based policies for LambdaHow can I set up access logging for API Gateway?Follow"


Question: How do I troubleshoot issues with AWS Systems Manager Session Manager?

"When I try to use AWS Systems Manager Session Manager, my session fails."

Answer: "When I try to use AWS Systems Manager Session Manager, my session fails.ResolutionThe steps to troubleshoot Session Manager issues vary depending on the reason for the session failure.When a session fails because your Amazon Elastic Compute Cloud (Amazon EC2) instance isn't available as a managed instance, troubleshoot your managed instance availability.When a session fails and your EC2 instance is available as a managed instance, troubleshoot Session Manager to resolve these issues:Session Manager doesn't have permission to start a session.Session Manager doesn't have permission to change session preferences.A managed node isn't available or isn't configured for Session Manager.Session Manager plugins aren't added to the command line path (Windows).The system sends a TargetNotConnected error.Session Manager displays a blank screen when you start a session.When a session fails and displays one of the following error messages, apply the appropriate troubleshooting guidance."Your session has been terminated for the following reasons: ----------ERROR------- Encountered error while initiating handshake. Fetching data key failed: Unable to retrieve data key, Error when decrypting data key AccessDeniedException: The ciphertext refers to a AWS KMS key that does not exist, does not exist in this region, or you are not allowed to access. status code: 400, request id: xxxxxxxxxxxx"You receive this error when the users and EC2 instances in your account don't have the required AWS Key Management Service (AWS KMS) key permissions. To resolve this error, turn on AWS KMS encryption for your session data, and then follow these steps:1.    Grant the required KMS key permissions to the users who start sessions and the instances that the sessions connect to. Then, configure AWS Identity and Access Management (IAM) to provide the users and instances with permissions to use the KMS key with Session Manager:To add KMS key permissions for users, see Quickstart default IAM policies for Session Manager.To add KMS key permissions for instances, see Verify or create an IAM role with Session Manager permissions.For Default Host Management Configuration, add a policy to an IAM role that provides KMS key permissions.Note: Starting with AWS Systems Manager Agent (SSM Agent) version 3.2.582.0, Default Host Management Configuration automatically manages EC2 instances without an IAM instance profile. The instances must use Instance Metadata Service Version 2 (IMDSv2)."Your session has been terminated for the following reasons: Couldn't start the session because we are unable to validate encryption on Amazon S3 bucket. Error: AccessDenied: Access Denied status code: 403"You receive this error when you choose Allow only encrypted S3 buckets for S3 logging in your Session Manager preferences. Follow one of these procedures to resolve the error:Open the Systems Manager console, and then choose Session Manager, Preferences, Edit. Under S3 logging, clear Allow only encrypted S3 buckets, and then save your changes. For more information, see Logging session data using Amazon Simple Storage Service (Amazon S3) (console).For instances that you manage using an IAM instance profile, add a policy to the instance profile to provide permissions to upload encrypted logs to Amazon S3. For instructions, see Creating an IAM role with permissions for Session Manager and Amazon S3 and Amazon CloudWatch Logs (console).For instances that you manage using Default Host Management Configuration, add a policy to the IAM role to provide permissions to upload encrypted logs to Amazon S3. For instructions, see Creating an IAM role with permissions for Session Manager and Amazon S3 and CloudWatch Logs (console)."Your session has been terminated for the following reasons: We couldn't start the session because encryption is not set up on the selected CloudWatch Logs log group. Either encrypt the log group or choose an option to enable logging without encryption."You receive this error when you choose Allow only encrypted CloudWatch log groups for CloudWatch logging in your Session Manager preferences. Follow one of these procedures to resolve the error:Open the Systems Manager console, and then choose Session Manager, Preferences, Edit. Under CloudWatch logging, clear Allow only encrypted CloudWatch log groups, and then save your changes. For more information, see Logging session data using Amazon CloudWatch Logs (console).For instances that you manage using an IAM instance profile, add a policy to the instance profile to provide permissions to upload encrypted logs to Amazon CloudWatch. For instructions, see Creating an IAM role with permissions for Session Manager and Amazon S3 and CloudWatch Logs (console).For instances that you manage using Default Host Management Configuration, add a policy to the IAM role to provide permissions to upload encrypted logs to CloudWatch. For instructions, see Creating an IAM role with permissions for Session Manager and Amazon S3 and CloudWatch Logs (console).Related informationHow do I attach or replace an instance profile on an Amazon EC2 instance?Logging session activitySetting up Session ManagerFollow"


Question: How do I use Overview details to access my AWS DMS task information?

How can I use the Overview details section to view and access my AWS Database Migration Service (AWS DMS) task information?

Answer: "How can I use the Overview details section to view and access my AWS Database Migration Service (AWS DMS) task information?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Open the AWS DMS console.Choose Database migration tasks from the navigation pane.Choose the name of your task, and then review the Overview details section.The Overview details section contains information about your task. This includes the basic configuration, such as Task ARN, Status, Migration type, Last failure message, Migration task logs, and Task settings. For more information, see Monitoring AWS DMS tasks.You can modify a task to change the table mapping, task settings, or other properties. For example, to modify the target table preparation mode, choose the task in the AWS DMS console, and then choose Modify.To modify other task settings, such as logging, use the AWS CLI to modify a replication task. For more information, see Specifying task settings for AWS Database Migration Service tasks.Related informationHow can I monitor an AWS DMS task?Follow"


Question: How do I diagnose high CPU utilization on an EC2 Windows instance?

"My Amazon Elastic Compute Cloud (Amazon EC2) Windows instance is experiencing high CPU utilization, and I want to understand why."

Answer: "My Amazon Elastic Compute Cloud (Amazon EC2) Windows instance is experiencing high CPU utilization, and I want to understand why.ResolutionFirst, determine your Amazon EC2 instance type to identify the correct resolution:Open the Amazon EC2 console, and then choose Instances from the navigation pane.Select the instance that you want to troubleshoot. On the Description tab, note the Instance type.(T2 or T3 instances only) For Actions, choose Instance Settings, Change T2/T3 Unlimited. Note whether T2/T3 Unlimited is enabled or disabled.Follow the instructions in the section below that corresponds to your instance type and use case.After you determine the specific process causing high CPU utilization, you can troubleshoot that application.T2/T3 Unlimited is disabled on my T2 or T3 instance, and I'm not sure if my CPU is being throttledYou can check the CPU Credit Balance and the CPU within the operating system (OS) to verify if your CPU is being throttled. For instructions, see How can I find out if the CPU on my T2 or T3 EC2 Windows instance is being throttled?T2/T3 Unlimited is disabled on my T2 or T3 instance, and I know that my CPU is being throttledIf your CPU is throttled, you can either activate T2/T3 Unlimited, or change the instance type. For more information, see How can I resolve high CPU utilization on my T2 or T3 EC2 Windows instance if my CPU is being throttled?T2/T3 Unlimited is enabled on my T2 or T3 instance-or-My T2 or T3 instance isn't being throttled, and I need help with investigating at the OS level-or-My instance type isn't T2 or T3When CPU throttling isn't the source of the problem, you can investigate at the OS level. For instructions, seeHow do I diagnose high CPU utilization on my EC2 Windows instance when my CPU is not being throttled?Related informationAmazon EC2 instance typesWhat steps do I need to take before changing the instance type of my EC2 Linux instance?Follow"


Question: Why can't I view my latest billing data when I query my Cost and Usage Reports using Amazon Athena?

I can't view my latest billing data when I query my Cost and Usage Reports using Amazon Athena.

Answer: "I can't view my latest billing data when I query my Cost and Usage Reports using Amazon Athena.ResolutionThe most common reason for this issue is missing partitions in the Cost and Usage Reports table. To resolve this issue, choose one or more of the following solutions.Be sure to load table partitions for manually created Cost and Usage Reports tableIf you manually created the Cost and Usage Reports table, then load table partitions by running the MCSK REPAIR TABLE command in the Amazon Athena console. Or, you can upload the partitions from the Amazon Athena console.If you have set up an AWS Glue crawler to periodically add partitions to your table, then be sure that the crawler is scheduled to run before generating the report. Otherwise, you might not view latest billing data in query results.Be sure to check the Amazon Simple Storage Service (Amazon S3) path and AWS Glue crawlerYou can use an AWS CloudFormation template to integrate your Cost and Usage Reports with Athena. This template includes an AWS Glue crawler, an AWS Glue database, and an AWS Lambda event. The Lambda function initiates an AWS Glue crawler when new Cost and Usage Reports files are delivered to the Amazon S3 path. Then, the crawler automatically adds partitions to the table based on the data in the Cost and Usage Reports files. If you can't view the latest billing data when you query the table, then check your S3 path. Make sure that the Cost and Usage Reports files are delivered. Also, check your AWS Glue crawler to be sure that it's not in RUNNING or FAILED status.Use partition projection to populate the partitions automaticallyYou can create the Cost and Usage Reports table using partition projection. In partition projection, partition values and locations are calculated dynamically instead of being physically stored in the AWS Glue Data Catalog. Therefore, you don't need to manually add the partitions to view the latest data. You can query the report files immediately after they are delivered to your Amazon S3 bucket.To create a Cost and Usage Reports table using partition projection, do the following:Note: Be sure that you selected Athena for Enable report data integration for when you created the Cost and Usage Reports. By selecting Athena for integration with the report, the report files are delivered to the target account in partitioned parquet format. It might take up to 24 hours for the report files to be delivered to the target files. The file paths look similar to the following:s3://example-report-prefix/example-report-name/example-report-name/year=2021/month=1s3://example-report-prefix/example-report-name/example-report-name/year=2021/month=21.    Open the Amazon Athena console.2.    On the Query editor tab, enter a command similar to the following:CREATE EXTERNAL TABLE test_cur_partitionprojection(  `identity_line_item_id` string,  `identity_time_interval` string,  `bill_invoice_id` string,  `bill_billing_entity` string,  `bill_bill_type` string,  `bill_payer_account_id` string,  `bill_billing_period_start_date` timestamp,  `bill_billing_period_end_date` timestamp,  `line_item_usage_account_id` string,  `line_item_line_item_type` string,  `line_item_usage_start_date` timestamp,  `line_item_usage_end_date` timestamp,  `line_item_product_code` string,  `line_item_usage_type` string,  `line_item_operation` string,  `line_item_availability_zone` string,  `line_item_usage_amount` double,  `line_item_normalization_factor` double,  `line_item_normalized_usage_amount` double,  `line_item_currency_code` string,  `line_item_unblended_rate` string,  `line_item_unblended_cost` double,  `line_item_blended_rate` string,  `line_item_blended_cost` double,  `line_item_line_item_description` string,  `line_item_tax_type` string,  `line_item_legal_entity` string,  `product_product_name` string,  `product_alarm_type` string,  `product_availability` string,  `product_bundle` string,  `product_bundle_description` string,  `product_bundle_group` string,  `product_capacitystatus` string,  `product_clock_speed` string,  `product_component` string,  `product_compute_type` string,  `product_content_type` string,  `product_cputype` string,  `product_current_generation` string,  `product_database_engine` string,  `product_dedicated_ebs_throughput` string,  `product_deployment_option` string,  `product_description` string,  `product_durability` string,  `product_ecu` string,  `product_edition` string,  `product_engine_code` string,  `product_enhanced_networking_supported` string,  `product_event_type` string,  `product_free_query_types` string,  `product_free_trial` string,  `product_from_location` string,  `product_from_location_type` string,  `product_gpu` string,  `product_gpu_memory` string,  `product_group` string,  `product_group_description` string,  `product_instance_family` string,  `product_instance_name` string,  `product_instance_type` string,  `product_instance_type_family` string,  `product_intel_avx2_available` string,  `product_intel_avx_available` string,  `product_intel_turbo_available` string,  `product_license` string,  `product_license_model` string,  `product_location` string,  `product_location_type` string,  `product_logs_destination` string,  `product_max_iops_burst_performance` string,  `product_max_iopsvolume` string,  `product_max_throughputvolume` string,  `product_max_volume_size` string,  `product_maximum_extended_storage` string,  `product_maximum_storage_volume` string,  `product_memory` string,  `product_memorytype` string,  `product_message_delivery_frequency` string,  `product_message_delivery_order` string,  `product_min_volume_size` string,  `product_minimum_storage_volume` string,  `product_network_performance` string,  `product_normalization_size_factor` string,  `product_operating_system` string,  `product_operation` string,  `product_origin` string,  `product_physical_cpu` string,  `product_physical_gpu` string,  `product_physical_processor` string,  `product_pre_installed_sw` string,  `product_processor_architecture` string,  `product_processor_features` string,  `product_product_family` string,  `product_queue_type` string,  `product_recipient` string,  `product_region` string,  `product_resource_type` string,  `product_rootvolume` string,  `product_routing_target` string,  `product_routing_type` string,  `product_running_mode` string,  `product_servicecode` string,  `product_servicename` string,  `product_sku` string,  `product_software_included` string,  `product_software_type` string,  `product_standard_storage_retention_included` string,  `product_storage` string,  `product_storage_class` string,  `product_storage_media` string,  `product_storage_type` string,  `product_subscription_type` string,  `product_tenancy` string,  `product_to_location` string,  `product_to_location_type` string,  `product_transfer_type` string,  `product_usagetype` string,  `product_uservolume` string,  `product_vcpu` string,  `product_version` string,  `product_volume_api_name` string,  `product_volume_type` string,  `pricing_rate_id` string,  `pricing_currency` string,  `pricing_public_on_demand_cost` double,  `pricing_public_on_demand_rate` string,  `pricing_term` string,  `pricing_unit` string,  `reservation_amortized_upfront_cost_for_usage` double,  `reservation_amortized_upfront_fee_for_billing_period` double,  `reservation_effective_cost` double,  `reservation_end_time` string,  `reservation_modification_status` string,  `reservation_normalized_units_per_reservation` string,  `reservation_number_of_reservations` string,  `reservation_recurring_fee_for_usage` double,  `reservation_start_time` string,  `reservation_subscription_id` string,  `reservation_total_reserved_normalized_units` string,  `reservation_total_reserved_units` string,  `reservation_units_per_reservation` string,  `reservation_unused_amortized_upfront_fee_for_billing_period` double,  `reservation_unused_normalized_unit_quantity` double,  `reservation_unused_quantity` double,  `reservation_unused_recurring_fee` double,  `reservation_upfront_value` double,  `savings_plan_total_commitment_to_date` double,  `savings_plan_savings_plan_a_r_n` string,  `savings_plan_savings_plan_rate` double,  `savings_plan_used_commitment` double,  `savings_plan_savings_plan_effective_cost` double,  `savings_plan_amortized_upfront_commitment_for_billing_period` double,  `savings_plan_recurring_commitment_for_billing_period` double)PARTITIONED BY (  `year` int,  `month` int)ROW FORMAT SERDE  'org.apache.hadoop.hive.ql.io.parquet.serde.ParquetHiveSerDe'STORED AS INPUTFORMAT  'org.apache.hadoop.mapred.TextInputFormat'OUTPUTFORMAT  'org.apache.hadoop.hive.ql.io.HiveIgnoreKeyTextOutputFormat'LOCATION  's3://example-report-prefix/example-report-name/example-report-name'TBLPROPERTIES (  'projection.enabled'='true',  'projection.month.range'='1,12',  'projection.month.type'='integer',  'projection.year.range'='1900,2050',  'projection.year.type'='integer',  'storage.location.template'='s3://example-report-prefix/example-report-name/example-report-name/year=${year}/month=${month}')3.    Choose Save as to save the query.4.    Choose Run query to create the table test_cur_partitionprojection.You can query the table immediately after the table is created. For more information, see Querying Cost and Usage Reports using Amazon Athena.Follow"


Question: How can I configure CloudFront to forward the Authorization header to the origin?

"The origin of my Amazon CloudFront distribution requires that requests include the Authorization header. Because of this, my distribution must forward the Authorization header to the origin."

Answer: "The origin of my Amazon CloudFront distribution requires that requests include the Authorization header. Because of this, my distribution must forward the Authorization header to the origin.Short descriptionConfigure your distribution to forward the Authorization header to the origin in one of these ways:Create a cache policy. Then, associate the cache policy with the cache behavior that must forward the Authorization header.Note: You can't use an origin request policy to forward the Authorization header. The header must be a part of the cache key to prevent the cache from satisfying unauthorized requests. CloudFront returns an HTTP 400 error if you create an origin request policy that forwards the Authorization header.Edit an existing cache behavior with legacy cache settings.Important: For Amazon Simple Storage Service (Amazon S3) origins, caching based on the Authorization header isn't supported. For more information, see Selecting the headers to base caching on.ResolutionCreate a cache policyFollow the steps to create a cache policy using the CloudFront console.Under Cache key settings, for Headers, choose Include the following headers. Then, under Add Headers, select Authorization.Complete all other settings of the cache policy based on the requirements of the behavior that you're attaching the policy to. Then, choose Create.After you create the cache policy, follow the steps to attach the policies to the relevant behavior of your CloudFront distribution.Edit an existing cache behavior with legacy cache settingsOpen the CloudFront console, and then choose your distribution.Choose the Behaviors tab, and then select the path that you want to forward the Authorization header to.Choose Edit.Under Headers, choose Include the following headers. Then, under Add Headers, select Authorization.Choose Save changes.Follow"


Question: Why did my Secrets Manager Lambda function rotation fail with a “pg module not found“ error?

My AWS Secrets Manager AWS Lambda function failed with a “pg module not found“ error in Amazon CloudWatch Logs.

Answer: "My AWS Secrets Manager AWS Lambda function failed with a “pg module not found“ error in Amazon CloudWatch Logs.Short descriptionYou might receive this error if you're running an earlier Lambda function that was automatically upgraded from Python 3.7 to a newer version of Python.ResolutionChange the Lambda function version back to Python 3.7, and redeploy the Lambda function.Check the Lambda function Python version1.    Open the Lambda console.2.    In the navigation pane, choose Functions, and then select the Lambda function name that failed to rotate.3.    Choose the Code tab.4.    In Runtime settings, note the Python version.5.    Choose Actions, choose Export function, and then choose Download deployment package.6.    Run the following Linux find command from the directory of the uncompressed .zip file:find ./ -name “*cpython-*-x86_64-linux-gnu.so”7.    Check that the version of the Python runtime is in the name of the .so file. For example _cffi_backend.cpython-37m-x86_64-linux-gnu.so.If the .so version isn't Python 3.7, then Lambda can't import the library.Modify the AWS Cloudformation templateTo resolve the Lambda function failure, modify the CloudFormation template that you used to create the Lambda function. Add the Runtime property to the HostedRotationLambda object in AWS::SecretsManager::RotationSchedule. Then, redeploy the CloudFormation stack. CloudFormation changes the Lambda rotation function back to Python 3.7.Note: For Python 3.7, the Runtime key value must be python3.7.Related informationTroubleshooting AWS Secrets ManagerFollow"


Question: How do I configure Amazon EKS worker nodes to clean up the image cache at a specified percent of disk usage?

I want to use Amazon Elastic Kubernetes Service (Amazon EKS) worker nodes to clean up the image cache at a specified percent of disk usage.

Answer: "I want to use Amazon Elastic Kubernetes Service (Amazon EKS) worker nodes to clean up the image cache at a specified percent of disk usage.Short descriptionTo clean up the image cache with Amazon EKS worker nodes, use the following kubelet garbage collection (from the Kubernetes website) arguments:The --image-gc-high-threshold argument defines the percent of disk usage that initiates image garbage collection. The default is 85%.The --image-gc-low-threshold argument defines the percent of disk usage that image garbage collection tries to free. The default is 80%.Note: In the following resolution, the kubelet garbage collection arguments clean up the image cache in the worker node when the disk usage reaches 70%. The --image-gc-high-threshold is set to 70%. The --image-gc-low-threshold is set to 50%.To add kubelet garbage collection arguments to a new worker node, complete the steps in the following sections:Add the kubelet garbage collection arguments to the default kubelet-config file in the Amazon Machine Image (AMI) using UserData for a new worker nodeVerify that the new kubelet garbage collection arguments are in the node configz endpointTo add kubelet garbage collection arguments to an existing worker node, complete the steps in the following sections:Add the kubelet garbage collection arguments to an existing worker nodeVerify that the new kubelet garbage collection arguments are in the node configz endpointResolutionNote: The following resolution applies to Amazon EKS-optimized Linux AMIs.Add the kubelet garbage collection arguments to the default kubelet-config file in the AMI using UserData for a new worker node1.    Launch an Amazon Elastic Compute Cloud (Amazon EC2) instance.Use the sed commands to add --image-gc-low-threshold and --image-gc-high-threshold in the kubelet-config.json file in the Amazon EKS-optimized Linux AMI. The sed commands are in the UserData section of Step 3: Configure instance details.For example:#!/bin/bashset -o xtrace# Inject imageGCHighThresholdPercent value unless it has already been set.if ! grep -q imageGCHighThresholdPercent /etc/kubernetes/kubelet/kubelet-config.json; then     sed -i '/"apiVersion*/a \ \ "imageGCHighThresholdPercent": 70,' /etc/kubernetes/kubelet/kubelet-config.jsonfi# Inject imageGCLowThresholdPercent value unless it has already been set.if ! grep -q imageGCLowThresholdPercent /etc/kubernetes/kubelet/kubelet-config.json; then     sed -i '/"imageGCHigh*/a \ \ "imageGCLowThresholdPercent": 50,' /etc/kubernetes/kubelet/kubelet-config.jsonfi/etc/eks/bootstrap.sh your-cluster-nameNote: Replace your-cluster-name with your Amazon EKS cluster name. If you're using a different kubelet config file, then update the file name in the sed commands.2.    Add the worker node to your Amazon EKS cluster.3.    To verify the changes, follow the steps in the Verify that the new kubelet garbage collection arguments are in the node configz endpoint section.Add the kubelet garbage collection arguments to an existing worker nodeImportant: The following steps require that you connect to an existing worker node with SSH and have sudo access. You must complete these steps on all the existing worker nodes in your Amazon EKS cluster.1.    Connect to an existing worker node using SSH.2.    Open the /etc/kubernetes/kubelet/kubelet-config.json file in your worker nodes.If you launched the worker node using EKSCTL, then open /etc/eksctl/kubelet.yaml. See the following example:sudo vi /etc/kubernetes/kubelet/kubelet-config.json#WORKER NODES LAUNCHED USING EKSCTLsudo vi /etc/eksctl/kubelet.yaml3.    Add the kubelet garbage collection arguments to the kubelet-config.json file or kubelet.yaml  file, depending on how you launched your worker nodes. Then, save the file. See the following example:{  "kind": "KubeletConfiguration",  "apiVersion": "kubelet.config.k8s.io/v1beta1",  .  .  .  "imageGCHighThresholdPercent": 70,         ==> Add the argument under the same alignment as the "kind"  "imageGCLowThresholdPercent": 50,  "maxPods": ...}#WORKER NODES LAUNCHED USING EKSCTLkind: KubeletConfigurationkubeReserved:  cpu: 70m  ephemeral-storage: 1Gi  memory: 1843MiserverTLSBootstrap: trueimageGCHighThresholdPercent: 70        ==> Add the arguments under the alignment "Kind" in the yaml fileimageGCLowThresholdPercent: 504.    To restart the kubelet service in the worker node, run the following command:sudo service kubelet restart5.    To verify the changes, follow the steps in the Verify that the new kubelet garbage collection arguments are in the node configz endpoint section.Verify that the new kubelet garbage collection arguments are in the node configz endpoint1.    To get the name of your worker nodes, run the following command:kubectl get nodes2.    To open a connection to the API server, run the following command:kubectl proxy3.    To check the node configz, open a new terminal, and then run the following command:curl -sSL "http://localhost:8001/api/v1/nodes/node_name/proxy/configz" | python3 -m json.toolNote: Replace node_name with your node name from the list of nodes retrieved in step 1. If curl and python aren't available, then open the URL in a web browser.The preceding command returns output from the kubeletconfig. This output includes your settings from the bootstrap.sh file. See the following example:{"kubeletconfig": {  .  .  "imageGCHighThresholdPercent": 70,          <=== The new value is set to 70 as given in UserData  "imageGCLowThresholdPercent": 50,           <=== The new value is set to 50 as given in UserData  .  .}}Follow"


Question: How can I analyze custom VPC Flow Logs using CloudWatch Logs Insights?

I have configured custom VPC Flow Logs. How can I discover patterns and trends with Amazon CloudWatch Logs Insights?

Answer: "I have configured custom VPC Flow Logs. How can I discover patterns and trends with Amazon CloudWatch Logs Insights?Short descriptionYou can use CloudWatch Logs Insights to analyze VPC Flow Logs. CloudWatch Log Insights automatically discovers fields in many Amazon provided logs, as well as JSON formatted log events, to allow for easy query construction and log exploration. VPC Flow Logs that are in the default format are automatically discovered by CloudWatch Logs Insights.But, VPC Flow Logs are deployed in a custom format. Because of this, they aren't automatically discovered, so you must modify the queries. This article gives several examples of queries that you can customize and extend to match your use cases.This custom VPC Flow Logs format is used:${account-id} ${vpc-id} ${subnet-id} ${interface-id} ${instance-id} ${srcaddr} ${srcport} ${dstaddr} ${dstport} ${protocol} ${packets} ${bytes} ${action} ${log-status} ${start} ${end} ${flow-direction} ${traffic-path} ${tcp-flags} ${pkt-srcaddr} ${pkt-src-aws-service} ${pkt-dstaddr} ${pkt-dst-aws-service} ${region} ${az-id} ${sublocation-type} ${sublocation-id}ResolutionRetrieve latest VPC Flow LogsBecause log fields are not automatically discovered by CloudWatch Logs Insights, you must use the parse keyword to isolate desired fields. In this query, the results are sorted by the flow log event start time, and restricted to the two most recent log entries.Query#Retrieve latest custom VPC Flow Logsparse @message "* * * * * * * * * * * * * * * * * * * * * * * * * * *" as account_id, vpc_id, subnet_id, interface_id,instance_id, srcaddr, srcport, dstaddr, dstport, protocol, packets, bytes, action, log_status, start, end, flow_direction, traffic_path, tcp_flags, pkt_srcaddr, pkt_src_aws_service, pkt_dstaddr, pkt_dst_aws_service, region, az_id, sublocation_type, sublocation_id| sort start desc| limit 2Resultsaccount_id vpc_id  subnet_id interface_idinstance_idsrcaddrsrcport123456789012 vpc-0b69ce8d04278ddd subnet-002bdfe1767d0ddb0eni-0435cbb62960f230e- 172.31.0.10455125123456789012 vpc-0b69ce8d04278ddd1 subnet-002bdfe1767d0ddb0eni-0435cbb62960f230e- 91.240.118.8149422Summarize data transfers by source/destination IP address pairsNext, summarize the network traffic by source/destination IP address pairs. In this example, the sum statistic is used to perform an aggregation on the bytes field. This calculates a cumulative total of the data transferred between hosts. For more context, the flow_direction is included. The results of this aggregation are then assigned to the Data_Transferred field, temporarily. Then, the results are sorted by Data_Transferred in descending order, and the two largest pairs are returned.Queryparse @message "* * * * * * * * * * * * * * * * * * * * * * * * * * *" as account_id, vpc_id, subnet_id, interface_id,instance_id, srcaddr, srcport, dstaddr, dstport, protocol, packets, bytes, action, log_status, start, end, flow_direction, traffic_path, tcp_flags, pkt_srcaddr, pkt_src_aws_service, pkt_dstaddr, pkt_dst_aws_service, region, az_id, sublocation_type, sublocation_id| stats sum(bytes) as Data_Transferred by srcaddr, dstaddr, flow_direction| sort by Data_Transferred desc| limit 2Resultssrcaddrdstaddrflow_directionData_Transferred172.31.1.2473.230.172.154egress346952038172.31.0.463.230.172.154egress343799447Analyze data transfers by EC2 instance IDYou can use custom VPC Flow Logs to analyze an Amazon Elastic Compute Cloud (Amazon EC2) instance ID, directly. Taking the previous query, you can now determine the most active EC2 instances by using the instance_id field.Queryparse @message "* * * * * * * * * * * * * * * * * * * * * * * * * * *" as account_id, vpc_id, subnet_id, interface_id,instance_id, srcaddr, srcport, dstaddr, dstport, protocol, packets, bytes, action, log_status, start, end, flow_direction, traffic_path, tcp_flags, pkt_srcaddr, pkt_src_aws_service, pkt_dstaddr, pkt_dst_aws_service, region, az_id, sublocation_type, sublocation_id| stats sum(bytes) as Data_Transferred by instance_id| sort by Data_Transferred desc| limit 5Resultsinstance_idData_Transferred-1443477306i-03205758c9203c979517558754i-0ae33894105aa500c324629414i-01506ab9e9e90749d198063232i-0724007fef3cb06f354847643Filter for rejected SSH trafficTo better understand the traffic that was denied by your security group and network access control lists (ACL), filter on reject VPC Flow Logs. You can further narrow this filter down to include protocol and target port. To identify hosts that are rejected on SSH traffic, extend the filter to include TCP protocol (for example, protocol 6) and traffic with a destination port of 22.Queryparse @message "* * * * * * * * * * * * * * * * * * * * * * * * * * *" as account_id, vpc_id, subnet_id, interface_id,instance_id, srcaddr, srcport, dstaddr, dstport, protocol, packets, bytes, action, log_status, start, end, flow_direction, traffic_path, tcp_flags, pkt_srcaddr, pkt_src_aws_service, pkt_dstaddr, pkt_dst_aws_service, region, az_id, sublocation_type, sublocation_id| filter action = "REJECT" and protocol = 6 and dstport = 22| stats sum(bytes) as SSH_Traffic_Volume by srcaddr| sort by SSH_Traffic_Volume desc| limit 2ResultssrcaddrSSH_Traffic_Volume23.95.222.129160179.43.167.7480Isolate HTTP data stream for a specific source/destination pairTo further investigate trends in your data using CloudWatch Logs Insights, isolate bidirectional traffic between two IP addresses. In this query, ["172.31.1.247","172.31.11.212"] returns flow logs using either IP address as the source or destination IP address. To isolate HTTP traffic, the filter statements match VPC Flow Log events with protocol 6 (TCP) and port 80. Use the display keyword to return a subset of all available fields.Query#HTTP Data Stream for Specific Source/Destination Pairparse @message "* * * * * * * * * * * * * * * * * * * * * * * * * * *" as account_id, vpc_id, subnet_id, interface_id,instance_id, srcaddr, srcport, dstaddr, dstport, protocol, packets, bytes, action, log_status, start, end, flow_direction, traffic_path, tcp_flags, pkt_srcaddr, pkt_src_aws_service, pkt_dstaddr, pkt_dst_aws_service, region, az_id, sublocation_type, sublocation_id| filter srcaddr in ["172.31.1.247","172.31.11.212"] and dstaddr in ["172.31.1.247","172.31.11.212"] and protocol = 6 and (dstport = 80 or srcport=80)| display interface_id,srcaddr, srcport, dstaddr, dstport, protocol, bytes, action, log_status, start, end, flow_direction, tcp_flags| sort by start desc| limit 2Resultsinterface_idsrcaddrsrcportdstaddrdstportprotocolbytesactionlog_statuseni-0b74120275654905e172.31.11.21280172.31.1.2472937665160876ACCEPTOKeni-0b74120275654905e172.31.1.24729376172.31.11.21280697380ACCEPTOKIsolate HTTP data stream for specific source/destination pairYou can use CloudWatch Logs Insights to visualize results as a bar or pie chart. If the results include the bin() function, then query results are returned with a timestamp. This timeseries can then be visualized with a line or stacked area graph.Building on the previous query, you can use stats sum(bytes) as Data_Trasferred by bin(1m) to calculate the cumulative data transferred over one-minute intervals. To view this visualization, toggle between the Logs and Visualization tables in the CloudWatch Logs Insights console.Queryparse @message "* * * * * * * * * * * * * * * * * * * * * * * * * * *" as account_id, vpc_id, subnet_id, interface_id,instance_id, srcaddr, srcport, dstaddr, dstport, protocol, packets, bytes, action, log_status, start, end, flow_direction, traffic_path, tcp_flags, pkt_srcaddr, pkt_src_aws_service, pkt_dstaddr, pkt_dst_aws_service, region, az_id, sublocation_type, sublocation_id| filter srcaddr in ["172.31.1.247","172.31.11.212"] and dstaddr in ["172.31.1.247","172.31.11.212"] and protocol = 6 and (dstport = 80 or srcport=80)| stats sum(bytes) as Data_Transferred by bin(1m)Resultsbin(1m)Data_Transferred2022-04-01 15:23:00.000172257872022-04-01 15:21:00.000177244992022-04-01 15:20:00.00011255002022-04-01 15:19:00.0001015252022-04-01 15:18:00.00081376Related informationSupported logs and discovered fieldsAnalyzing log data with CloudWatch Logs InsightsCloudWatch Logs Insights query commandsTutorial: Run a query that produces a time series visualizationFollow"


Question: How do I migrate from Classic Load Balancer to Application Load Balancer or Network Load Balancer?

I want to migrate my Classic Load Balancer to an Application Load Balancer or Network Load Balancer. How can I do this? What are some best practices to consider before migrating? Will there be any downtime during the migration?

Answer: "I want to migrate my Classic Load Balancer to an Application Load Balancer or Network Load Balancer. How can I do this? What are some best practices to consider before migrating? Will there be any downtime during the migration?ResolutionMigrating your Classic Load Balancer to an Application Load Balancer or Network Load BalancerUse the migration wizard to create and configure an Application Load Balancer or Network Load Balancer. If your Classic Load Balancer has a TCP listener, then the wizard creates a Network Load Balancer. If the Classic Load Balancer has an HTTP(S) listener, then the wizard creates an Application Load Balancer. After the load balancer is created, test your newly created load balancer. If your newly created load balancer works without any issues, then redirect the traffic from your Classic Load Balancer to the newly created load balancer.Note: The wizard creates a new load balancer. The wizard doesn't convert the existing Classic Load Balancer to an Application Load Balancer or Network Load Balancer. You must manually redirect the traffic to the newly created load balancer.Then, update any policies, scripts, and code. After you redirect all the traffic to the new load balancer and all existing requests on the old load balancer are completed, delete the old load balancer.Migration considerationsIf your load balancer has only one subnet, then make sure to specify a second subnet when you create the Application Load Balancer. An Application Load Balancer requires a minimum of two subnets.If you're uncertain about which load balancer to migrate to, consider using a Network Load Balancer. If your Classic Load Balancer uses an HTTP or HTTPS listener, then migrate to an Application Load Balancer. If your Classic Load Balancer uses TCP listeners, then migrate to a Network Load Balancer. For more information about the different load balancer features, see Elastic Load Balancing features.A Classic Load Balancer allows you to turn off cross-zone load balancing. By default, an Application Load Balancer has cross-zone load balancing turned on, and that load balancing can't be turned off. With Network Load Balancer, you can turn off cross-zone load balancing.An Application Load Balancer can support request redirection on the load balancer itself. If a Classic Load Balancer's backend connections are configured for HTTP redirection, redirection can be turned off or removed during a migration to a new load balancer.A Network Load Balancer doesn't support security groups at the load balancer level. You can use the security groups associated with the targets to restrict traffic. At the Network Load Balancer level, you can use the subnet's network access control lists (ACLs) to restrict traffic.A Network Load Balancer is able to preserve the client IP address. If you use security groups to restrict traffic on the targets, be aware that the source IP of the packets includes the client IP address.Downtime during a load balancer migrationIf the new load balancer setup has errors, then downtime during migration can occur. To minimize or reduce any downtime, consider the following approaches:Before shifting any production traffic, run tests against the new load balancer. Make sure that the new load balancer can handle traffic requests.Use Amazon Route 53's weighted routing policy to gradually route traffic to the new load balancer. If you see issues with the new load balancer, then assign the traffic weight a value of "0".If Route 53 isn't in use as the DNS provider, then keep the old load balancer running. Reduce the time to live (TTL) value of the existing record to "0". Then, wait for the previous TTL value to reset and update the record to point to the new load balancer DNS name. If any issues appear with the new load balancer, update the DNS record to point back to the DNS name of the Classic Load Balancer. The TTL value of "0" prevents the record from being cached. After the issue is resolved, return the TTL value to the original value.If the new load balancer is performing without any issues, delete the old load balancer.Note: The new generation of load balancers don't have support for HTTP/HTTPS and TCP listeners at the same time. If you are using a Classic Load Balancer with HTTP/HTTPS and TCP listeners at the same time, it is best practice to use a Network Load Balancer with all TCP/TLS listeners. With this change, you lose HTTP/ HTTPS level logging, as there is no application level routing in NLB to provide that. An alternative is to continue using a Classic Load Balancer.Follow"


Question: How can I configure HTTPS for my Elastic Beanstalk environment?

I want to configure HTTPS for my AWS Elastic Beanstalk environment so that I can encrypt data from my load balancer to my Amazon Elastic Compute Cloud (Amazon EC2) instance.


Question: How can I automate the configuration of HTTP proxy for Amazon EKS containerd nodes?

I want to automate the configuration of HTTP proxy for Amazon Elastic Kubernetes Service (Amazon EKS) nodes with containerd runtime. How can I do that?

Answer: "I want to automate the configuration of HTTP proxy for Amazon Elastic Kubernetes Service (Amazon EKS) nodes with containerd runtime. How can I do that?Short descriptionImportant: For managed node groups that are created in Amazon EKS versions 1.23 or earlier, the default container runtime is Docker. If this applies to you, then be sure to follow all steps in the resolution to specify a containerd runtime. For managed node groups that are created in Amazon EKS version 1.24 or later, the default container runtime in containerd.To use containerd in your managed node group instead of dockerd, you must specify a containerd runtime in userdata.After you switch your managed node group to a containerd runtime, create a custom launch template with your AMI ID. You can then configure the settings for your HTTP proxy and the environment values of your cluster.Note: The following resolution applies only to nodes where the underlying runtime is containerd, and doesn't apply to nodes with Docker runtime. For nodes with Docker runtime, see How can I automate the configuration of HTTP proxy for Amazon EKS worker nodes with user data?ResolutionCreate a custom launch template1.    Specify containerd as the runtime in your managed node group. In userdata, use the --container-runtime=containerd option for bootstrap.sh.2.    Create a custom launch template with the AMI ID. Otherwise, the managed nodes group merges userdata automatically when the AMI ID isn’t specified.3.    Set the proxy configuration to containerd, sandbox-image, and kubelet. Sandbox-image is the service unit that pulls the sandbox image for containerd. To set this configuration, see the sandbox-image.service and pull-sandbox-image.sh scripts on GitHub.   You can now describe your userdata with the following fields:Note: Be sure to replace XXXXXXX:3128, YOUR_CLUSTER_CA, API_SERVER_ENDPOINT, and EKS_CLUSTER_NAME with your relevant proxy, cluster CA, server endpoint, and cluster name. You can add AWS service endpoints to NO_PROXY and no_proxy after you create their VPC endpoints.MIME-Version: 1.0Content-Type: multipart/mixed; boundary="==BOUNDARY=="--==BOUNDARY==Content-Type: text/cloud-boothook; charset="us-ascii"#Set the proxy hostname and portPROXY=XXXXXXX:3128MAC=$(curl -s http://169.254.169.254/latest/meta-data/mac/)VPC_CIDR=$(curl -s http://169.254.169.254/latest/meta-data/network/interfaces/macs/$MAC/vpc-ipv4-cidr-blocks | xargs | tr ' ' ',')#Create the containerd and sandbox-image systemd directorymkdir -p /etc/systemd/system/containerd.service.dmkdir -p /etc/systemd/system/sandbox-image.service.d#[Option] Configure yum to use the proxycloud-init-per instance yum_proxy_config cat << EOF >> /etc/yum.confproxy=http://$PROXYEOF#Set the proxy for future processes, and use as an include filecloud-init-per instance proxy_config cat << EOF >> /etc/environmenthttp_proxy=http://$PROXYhttps_proxy=http://$PROXYHTTP_PROXY=http://$PROXYHTTPS_PROXY=http://$PROXYno_proxy=$VPC_CIDR,localhost,127.0.0.1,169.254.169.254,.internal,.eks.amazonaws.comNO_PROXY=$VPC_CIDR,localhost,127.0.0.1,169.254.169.254,.internal,.eks.amazonaws.comEOF#Configure Containerd with the proxycloud-init-per instance containerd_proxy_config tee <<EOF /etc/systemd/system/containerd.service.d/http-proxy.conf >/dev/null[Service]    EnvironmentFile=/etc/environmentEOF#Configure sandbox-image with the proxycloud-init-per instance sandbox-image_proxy_config tee <<EOF /etc/systemd/system/sandbox-image.service.d/http-proxy.conf >/dev/null[Service]    EnvironmentFile=/etc/environmentEOF#Configure the kubelet with the proxycloud-init-per instance kubelet_proxy_config tee <<EOF /etc/systemd/system/kubelet.service.d/proxy.conf >/dev/null[Service]EnvironmentFile=/etc/environmentEOFcloud-init-per instance reload_daemon systemctl daemon-reload --==BOUNDARY==Content-Type:text/x-shellscript; charset="us-ascii"#!/bin/bashset -o xtrace#Set the proxy variables before running the bootstrap.sh scriptset -asource /etc/environment#Run the bootstrap.sh scriptB64_CLUSTER_CA=YOUR_CLUSTER_CAAPI_SERVER_URL=API_SERVER_ENDPOINT/etc/eks/bootstrap.sh EKS_CLUSTER_NAME --b64-cluster-ca $B64_CLUSTER_CA --apiserver-endpoint $API_SERVER_URL --container-runtime containerd--==BOUNDARY==--Configure the proxy setting for aws-node and kube-proxyCreate a ConfigMap to configure the environment values. Then, apply it in your cluster. Use the following script as an example for your ConfigMap:Note: Be sure to replace KUBERNETES_SERVICE_CIDR_RANGE and VPC_CIDR_RANGE with the relevant values for your CIDR ranges. For example, replace KUBERNETES_SERVICE_CIDR_RANGE with 10.100.0.0/16, and replace VPC_CIDR_RANGE with 192.168.0.0/16. You can add AWS service endpoints to NO_PROXY and no_proxy after you create their VPC endpoints.apiVersion: v1kind: ConfigMapmetadata:   name: proxy-environment-variables   namespace: kube-systemdata:   HTTP_PROXY: http://XXXXXXX:3128   HTTPS_PROXY: http://XXXXXXX:3128   NO_PROXY: KUBERNETES_SERVICE_CIDR_RANGE,localhost,127.0.0.1,VPC_CIDR_RANGE,169.254.169.254,.internal,.eks.amazonaws.comThen, set your HTTP proxy configuration to aws-node and kube-proxy:$ kubectl patch -n kube-system -p '{ "spec": {"template":{ "spec": { "containers": [ { "name": "aws-node", "envFrom": [ { "configMapRef": {"name": "proxy-environment-variables"} } ] } ] } } } }' daemonset aws-node$ kubectl patch -n kube-system -p '{ "spec": {"template":{ "spec": { "containers": [ { "name": "kube-proxy", "envFrom": [ { "configMapRef": {"name": "proxy-environment-variables"} } ] } ] } } } }' daemonset kube-proxy Create a managed node groupCreate a new managed node group that uses the custom launch template that you previously created. Follow the steps inCreating a managed node group.Test your proxyUse the following commands to check the status of your nodes:$ kubectl get nodes$ kubectl run test-pod --image=amazonlinux:2 --restart=Never -- sleep 300$ kubectl get pods -AYou receive an output similar to the following:$ kubectl get nodes -o wideNAME                                                 STATUS   ROLES    AGE     VERSION                INTERNAL-IP       EXTERNAL-IP   OS-IMAGE         KERNEL-VERSION                 CONTAINER-RUNTIMEip-192-168-100-114.ap-northeast-1.compute.internal   Ready    <none>   2m27s   v1.23.13-eks-fb459a0   192.168.100.114   <none>        Amazon Linux 2   5.4.219-126.411.amzn2.x86_64   containerd://1.6.6$ kubectl run test-pod --image=amazonlinux:2 --restart=Never -- sleep 300pod/test-pod created$ kubectl get pods -ANAMESPACE     NAME                       READY   STATUS    RESTARTS   AGEdefault       test-pod                   1/1     Running   0          14skube-system   aws-node-cpjcl             1/1     Running   0          3m34skube-system   coredns-69cfddc4b4-c7rpd   1/1     Running   0          26mkube-system   coredns-69cfddc4b4-z5jxq   1/1     Running   0          26mkube-system   kube-proxy-g2f4g           1/1     Running   0          3m34sCheck your proxy log for additional information on your nodes’ connectivity:192.168.100.114 TCP_TUNNEL/200 6230 CONNECT registry-1.docker.io:443 - HIER_DIRECT/XX.XX.XX.XX -192.168.100.114 TCP_TUNNEL/200 10359 CONNECT auth.docker.io:443 - HIER_DIRECT/XX.XX.XX.XX -192.168.100.114 TCP_TUNNEL/200 6633 CONNECT registry-1.docker.io:443 - HIER_DIRECT/XX.XX.XX.XX -192.168.100.114 TCP_TUNNEL/200 10353 CONNECT auth.docker.io:443 - HIER_DIRECT/XX.XX.XX.XX -192.168.100.114 TCP_TUNNEL/200 8767 CONNECT registry-1.docker.io:443 - HIER_DIRECT/XX.XX.XX.XX -Related informationHow do I provide access to other IAM users and roles after cluster creation in Amazon EKS?Follow"


Question: "How do I use webhooks to publish Amazon SNS messages to Amazon Chime, Slack, or Microsoft Teams?"

"I want to use webhooks to connect my AWS environment to my Amazon Chime chat room, or to my Slack or Microsoft Teams channel. How do I send notifications from Amazon Simple Notification Service (Amazon SNS) to a webhook?"

Answer: "I want to use webhooks to connect my AWS environment to my Amazon Chime chat room, or to my Slack or Microsoft Teams channel. How do I send notifications from Amazon Simple Notification Service (Amazon SNS) to a webhook?Short descriptionYou can use Amazon SNS to send notification messages to HTTP or HTTPS endpoints, such as webhook URLs. However, some webhooks expect JSON key-value pairs that Amazon SNS doesn't support when confirming the HTTP or HTTPS subscription.For example, Amazon Chime webhooks expect a JSON request with a message string corresponding to a "Content" key. Similarly, Slack and Microsoft Teams webhooks both expect a JSON request with a message string corresponding to a "text" key.To transform the Amazon SNS message body JSON document for the webhook endpoint to process, use an AWS Lambda function.Note: For a list of the key-value pairs in the Amazon SNS message body JSON document, see HTTP and HTTPS notification JSON format.ResolutionCreate an SNS topicIf you haven't done so already, create an SNS topic with a unique name.Create a Lambda functionFor instructions to create a Lambda function, see Getting Started with AWS Lambda. For more information, see Using AWS Lambda with Amazon SNS.Your Lambda function code must include logic to transform your SNS topic's notification messages for the type of webhook endpoint that you're using. For examples, see the following Python code snippets for Amazon Chime, Slack, and Microsoft Teams webhooks. These code examples are provided as-is. They're compatible with the Python 3.7 runtime .Example Python code snippet for Amazon ChimeAmazon Chime webhooks expect a JSON request with a message string corresponding to a "Content" key. For more information, see Webhooks for Amazon Chime.Note: In this example function code for Amazon Chime webhooks, replace https://hooks.chime.aws/incomingwebhooks/xxxxxxx with the webhook URL.import urllib3import jsonhttp = urllib3.PoolManager()def lambda_handler(event, context):    url = "https://hooks.chime.aws/incomingwebhooks/xxxxxxx"    msg = {"Content": event["Records"][0]["Sns"]["Message"]}    encoded_msg = json.dumps(msg).encode("utf-8")    resp = http.request("POST", url, body=encoded_msg)    print(        {            "message": event["Records"][0]["Sns"]["Message"],            "status_code": resp.status,            "response": resp.data,        }    )Example Python code snippet for SlackSlack Incoming Webhooks expect a JSON request with a message string corresponding to a "text" key. They also support message customization, such as adding a user name and icon, or overriding the webhook's default channel. For more information, see Sending messages using incoming webhooks on the Slack website.Note: In this example function code for Slack Incoming Webhooks, replace https://hooks.slack.com/services/xxxxxxx with the Incoming Webhook URL. Also replace #CHANNEL_NAME with the destination channel's name.import urllib3import jsonhttp = urllib3.PoolManager()def lambda_handler(event, context):    url = "https://hooks.slack.com/services/xxxxxxx"    msg = {        "channel": "#CHANNEL_NAME",        "username": "WEBHOOK_USERNAME",        "text": event["Records"][0]["Sns"]["Message"],        "icon_emoji": "",    }    encoded_msg = json.dumps(msg).encode("utf-8")    resp = http.request("POST", url, body=encoded_msg)    print(        {            "message": event["Records"][0]["Sns"]["Message"],            "status_code": resp.status,            "response": resp.data,        }    )Example Python code snippet for Microsoft TeamsMicrosoft Teams incoming webhooks also expect a JSON request with a message string corresponding to a "text" key. For more information, see Create and send messages on the Microsoft Docs website.Note: In this example function code for Microsoft Teams incoming webhooks, replace https://outlook.office.com/webhook/xxxxxxx with the webhook URL.import urllib3import jsonhttp = urllib3.PoolManager()def lambda_handler(event, context):    url = "https://outlook.office.com/webhook/xxxxxxx"    msg = {"text": event["Records"][0]["Sns"]["Message"]}    encoded_msg = json.dumps(msg).encode("utf-8")    resp = http.request("POST", url, body=encoded_msg)    print(        {            "message": event["Records"][0]["Sns"]["Message"],            "status_code": resp.status,            "response": resp.data,        }    )Test the Lambda functionOn the Functions page of the Lambda console, choose your function.Choose the Test dropdown list. Then, choose Configure test event.In the Configure test event dialog box, choose Create new event.For Event template, choose SNS Topic Notification.For Event name, enter a name for the test event.Choose Save.After it's saved, choose Test. Then, review the Execution result.If the test invocation succeeds with a 200 status code:The Amazon SNS notification message is accepted by your webhook, which delivers it to the corresponding channel.If the invocation fails with a 4xx status code:Verify the webhook URL to confirm that the key-value pair is correct and accepted by your destination webhook.For more information about testing functions in the Lambda console, see Invoke the Lambda function.Add an SNS topic trigger to your Lambda functionAfter sending an SNS message to your webhook as a test in the Lambda console, subscribe your function to your SNS topic. To configure this from the Lambda console, add an SNS topic trigger:On the Functions page of the Lambda console, choose your function.Under Function overview, choose Add trigger. For more information, see Invoking Lambda functions.Under Trigger configuration, choose Select a trigger. Then, choose SNS.For SNS topic, choose the SNS topic that you created earlier.Choose Add.For more information, see Configuring functions (console).With your function subscribed to your SNS topic, messages published to the topic are forwarded to the function, and then to your webhook.Note: For information on how to get Amazon SNS notifications through other AWS services, see Monitoring AWS Services using AWS Chatbot.Related informationAdding webhooks to chat roomsRaw message deliveryHow do I subscribe a Lambda function to an Amazon SNS topic in the same account?How can I resolve the error that I receive when I subscribe a Lambda function to a push-based event source in AWS CloudFormation?Follow"


Question: "How do I create, configure, and troubleshoot a subscription filter to Kinesis using the CloudWatch console?"

I want to use the Amazon CloudWatch console to create a subscription filter for streaming my Amazon CloudWatch logs to Amazon Kinesis.

Answer: "I want to use the Amazon CloudWatch console to create a subscription filter for streaming my Amazon CloudWatch logs to Amazon Kinesis.Short descriptionUse a subscription filter to send CloudWatch logs in near real-time to the same account or to cross-account Kinesis or Amazon Kinesis Data Firehose destinations. The CloudWatch Logs console supports the destination and setup configuration.For information on how to use filter pattern syntax to configure a subscription filter, see Filter and pattern syntax.ResolutionSubscription configuration for a Kinesis data stream in the same or current accountNote: The AWS Region for the CloudWatch log group and the Kinesis destination must be the same.Before you create your subscription, complete the following actions:If you didn't create create a Kinesis stream, then create one.Create an AWS Identify and Access Management (IAM) role that has the appropriate trust policy and permissions.To create a custom IAM role and role policy, complete the following steps:1.    Open the IAM console with your user that has administrator permissions.2.    In the navigation pane, choose Policies.3.    In the content pane, choose Create policy.4.    Enter the following role permissions policy document into the JSON tab. Replace REGION, ACCOUNT_ID, AND STREAM_NAME with your own details:{  "Statement": \[{    "Effect": "Allow",    "Action": "kinesis:PutRecord",    "Resource": "arn:aws:kinesis:REGION:ACCOUNT\_ID:stream/STREAM\_NAME"  }\]}5.    Open the IAM console.6.    In the navigation pane, choose Roles, and then choose Create role.7.    Choose the Custom trust policy role type.8.    In the Custom trust policy section, enter or paste the custom trust policy for the role. See the following example trust policy:{  "Statement": {    "Effect": "Allow",    "Principal": {      "Service": "logs.region.amazonaws.com"    },    "Action": "sts:AssumeRole",    "Condition": {      "StringLike": {        "aws:SourceArn": "arn:aws:logs:REGION:ACCOUNT\_ID:\*"      }    }  }}9.    Choose Next.10.    Select the custom IAM policy that you created in step 4.11.    Choose Next, and then choose Create a Role.After you create the Kinesis stream and the IAM role, create the subscription filter:1.    Open the CloudWatch console.2.    Choose Log Group.3.    Choose Action, Subscription Filters.4.    To configure the destination, choose Create Kinesis Subscription Filter.5.    Choose Current Account.6.    Select your Kinesis data stream from the dropdown list.7.    Select the IAM role that you created.8.    Choose the Distribution method:By Log Stream: This verifies that downstream consumers can aggregate log events by log stream, but might be less efficient. This method might also incur higher streaming costs because it requires more shards.Random: This distributes the load across Kinesis stream shards, but downstream consumers can't aggregate log events by log stream.9.    Configure Log format and filters:Select the log format. The format can be Amazon VPC Flow Logs, AWS CloudTrail, or AWS Lambda for logs that are published by Amazon VPC, CloudTrail, or Lambda. Or, you can choose JSON, Space delimited, or Other, depending on your incoming log events.Define the filter pattern in the Subscription filter pattern section.Enter a name for your subscription filter.10.    Verify your pattern with the existing log event data.11.    After verifying, choose Start Streaming.12.    (Optional) Validate the flow of log events to verify that your data stream works.Configuration for a cross-account Kinesis data stream destinationNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.You can deliver CloudWatch Logs events to Kinesis data streams in different AWS accounts and Regions. To do this, set up cross-account log data sharing with subscriptions and specify the Region.In the following example, CloudWatch logs in the us-east-1 Region are delivered to another AWS user's Kinesis data stream in us-west-2 . The log data recipient's account ID is 222222222222, and the log data sender's account ID is 111111111111.Create a destination data stream in the recipient account 222222222222Create a destination data stream in Kinesis in the data recipient's account with an IAM role and trust policy.Create a subscription filter in the source account 111111111111To create the subscription filter, complete the following steps:1.    Select the log group.2.    Choose Action, Subscription Filters.3.    To select the destination, choose Create, and then select Create Kinesis Subscription Filter.4.    Choose Another Account.5.    For a cross-account Kinesis or Kinesis data Firehose destination, provide the Destination ARN.6.    Choose the Distribution method:By Log Stream: This verifies that downstream consumers can aggregate log events by log stream, but might be less efficient. This method might also incur higher streaming costs because it requires more shards.Random: This distributes the load across Kinesis stream shards, but downstream consumers can't aggregate log events by log stream.7.    Configure Log format and filters:Select the log format. The format can be Amazon VPC Flow Logs, CloudTrail, or AWS Lambda for logs that are published by Amazon VPC, CloudTrail, or Lambda. Or, you can choose JSON, Space delimited, or Other, depending on your incoming log events.Define the filter pattern in the Subscription filter pattern section.Enter a name of your subscription filter.8.    Verify your pattern with the existing log event data.9.    After verifying, choose Start Streaming.10.    (Optional) Validate the flow log events to verify that your data stream works.TroubleshootingMake sure that your Kinesis stream is in the Active state. You can view the stream on the Kinesis console or use the DescribeStream API call.Verify that the CloudWatch log group and Kinesis data stream Regions are the same.Make sure that there is an IAM role that has trust permissions for logs.yourregion.amazonaws.com and allows the permission kinesis:putrecords.Verify that the Regions and resources in the IAM policy are correct.Make sure that you didn't select Kinesis Firehose when configuring a subscription filter for Kinesis data stream.After you start streaming, check the subscription filter metrics to confirm that the filter pattern is valid and matches the incoming log events. Review the following metrics: ForwardedBytes: The volume of log events in compressed bytes forwarded to the subscription destination. ForwardedLogEvents: The number of log events forwarded to the subscription destination.Check that there aren't errors when streaming log events to your destination. Review the following metrics: DeliveryErrors: The number of log events that CloudWatch Logs received an error for when forwarding data to the subscription destination. DeliveryThrottling: The number of log events that indicate CloudWatch Logs was throttled when forwarding data to the subscription destination.If you have a dedicated Kinesis stream, then check the stream's metrics to confirm functionality.For issues with cross-account logging, see Troubleshooting your CloudWatch cross-account setup.Follow"


Question: How do I convert my EC2 Ubuntu instance's default MBR partitioning scheme to GPT to bypass the 2-TiB limit for MBR partitions on my EBS volume?

"My Amazon Elastic Compute Cloud (Amazon EC2) instance is running Ubuntu 16.04, 18.04, or 20.04. There's a 2-TiB limit for MBR partitions. I want to convert the default MBR partitioning scheme on my Amazon Elastic Block Store (Amazon EBS) volume to the GPT partitioning scheme to bypass the limit."

Answer: "My Amazon Elastic Compute Cloud (Amazon EC2) instance is running Ubuntu 16.04, 18.04, or 20.04. There's a 2-TiB limit for MBR partitions. I want to convert the default MBR partitioning scheme on my Amazon Elastic Block Store (Amazon EBS) volume to the GPT partitioning scheme to bypass the limit.ResolutionWarning: Before stopping and starting your instance, consider the following:If your instance is instance store-backed or has instance store volumes containing data, then the data is lost when you stop the instance. For more information, see Determine the root device type of your instance.If your instance is part of an Amazon EC2 Auto Scaling group, stopping the instance might terminate the instance. If you launched the instance with Amazon EMR, AWS CloudFormation, or AWS Elastic Beanstalk, then your instance might be part of an AWS Auto Scaling group. If this is the case, instance termination depends on the instance scale-in protection settings for your Auto Scaling group. If your instance is part of an Auto Scaling group, then temporarily remove the instance from the Auto Scaling group before starting the resolution steps.Stopping and starting the instance changes the public IP address of your instance. It's a best practice to use an Elastic IP address instead of a public IP address when routing external traffic to your instance. If you're using Amazon Route 53, you might have to update the Route 53 DNS records when the public IP changes.If the shutdown behavior of the instance is set to Terminate, then the instance is terminated when it's stopped. To avoid this issue, change the instance shutdown behavior.Note: It's a best practice to create a backup of your EBS volume before beginning any resolution steps.1.    Open the Amazon EC2 console.2.    Launch an instance from an Amazon Machine Image (AMI) running Ubuntu.3.    Launch a second instance in the same Availability Zone as the first instance and from the same Ubuntu AMI with a 3-TiB root volume.4.    Stop the instance with the 3-TiB root volume.5.    Detach the root volume (/dev/xvda or /dev/sda1) from the stopped instance. Then, attach it to the instance you created in step 2 as /dev/sdf.6.    Connect to the running instance (created in step 2) using SSH.7.    Use the lsblk command to view the root partition of / dev/sdf. The root partition of /dev/sdf is only 2-TiB size, as shown in the following example:# lsblkNAME    MAJ:MIN RM SIZE RO TYPE MOUNTPOINT(snip)xvdf    202:80    0   3T  0 disk └─xvdf1 202:81    0   2T  0 part (snip)Note: On Nitro instance types, the block device name looks similar to the following example: /dev/nvme1n1.8.    Use the gdisk tool to convert the partition table from MBR to GPT.Note: If you enter incorrect commands in gdisk, then use q to quit from gdisk without saving changes or press Ctrl+C.# sudo gdisk /dev/xvdfGPT fdisk (gdisk) version 1.0.1Partition table scan:  MBR: MBR only     BSD: not present  APM: not present  GPT: not present***************************************************************Found invalid GPT and valid MBR; converting MBR to GPT formatin memory. THIS OPERATION IS POTENTIALLY    DESTRUCTIVE! Exit bytyping 'q' if you don't want to convert your MBR partitionsto GPT format!9.    Enter the following commands at the prompts to enter Expert mode and set the sector alignment value.Note: Make sure that you change the sector alignment value from the default 8 to 1. Using the 8-bytes alignment might cause issues when you create the GPT partition.Command (? for help): x                                            Expert command (? for help): l                                     Enter the sector alignment value (1-65536, default = 2048): 1      Expert command (? for help): m10.    Enter the following commands at the prompts to create a GPT partition. Type enter at the Last sector prompt to use the default sector number 2047.Command (? for help): n                                                                                Partition number (2-128, default 2): 128                                                                                First sector (34-6291455966, default = 4294967296) or {+-}size{KMGTP}: 34                     Last sector (34-2047, default = 2047) or {+-}size{KMGTP}:                                                  Current type is 'Linux filesystem'Hex code or GUID (L to show codes, Enter = 8300): ef02                                                     Changed type of partition to 'BIOS boot partition'Note: In the preceding example, ef02 is the BIOS boot partition number.11.    Enter the following commands at the prompts to delete the root partition:Command (? for help): d                                                                                Partition number (1-128): 112.    Enter the following commands at the prompts to recreate the root partition to 3-TiB. In the First sector, Last sector, and Hex code or GUID prompts, type enter to use the default settings.Command (? for help): n                                                                                Partition number (1-128, default 1): 1                                                                                First sector (2048-6291455966, default = 2048) or {+-}size{KMGTP}:                                  Last sector (2048-6291455966, default = 6291455966) or {+-}size{KMGTP}:                       Current type is 'Linux filesystem'Hex code or GUID (L to show codes, Enter = 8300):                                                             Changed type of partition to 'Linux filesystem'13.    Enter the following commands at the prompts to save the GPT partition table:Command (? for help): w                                                                                Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTINGPARTITIONS!!Do you want to proceed? (Y/N): y                                                                                OK; writing new GUID partition table (GPT) to /dev/xvdf.The operation has completed successfully.Run the lsblk command to view the new volume information:# lsblkNAME    MAJ:MIN RM SIZE RO TYPE MOUNTPOINTxvdf    202:80   0   3T  0 disk └─xvdf1 202:81   0   3T  0 part14.    Use the fsck tool to check that the file system of device /dev/xvdf1 is correct. For more information on the fsck tool, see fsck on the Ubuntu website.Note: Adding a -y switch to the e2fsck command assumes yes to all questions.# sudo e2fsck -f /dev/xvdf1e2fsck 1.42.13 (17-May-2015)Pass 1: Checking inodes, blocks, and sizesPass 2: Checking directory structure    Pass 3: Checking directory connectivityPass 4: Checking reference countsPass 5: Checking group summary informationcloudimg-rootfs: 57524/262144000 files (0.0% non-contiguous), 16648272/536870655 blocks15.    Run the resize command to resize the file system to extend it to 3-TiB.Note: It can take 10-20 seconds to resize the file system.# sudo resize2fs /dev/xvdf1resize2fs 1.42.13 (17-May-2015)Resizing the filesystem on /dev/xvdf1 to 786431739 (4k) blocks.The filesystem on /dev/xvdf1 is now 786431739 (4k) blocks long.16.    Install Grub on the device /dev/xvdf1, and use the following commands to configure it:Ubuntu 16.04 or 18.04:sudo mount /dev/xvdf1 /mnt sudo mount --bind /proc /mnt/procsudo mount --bind /sys /mnt/syssudo mount --bind /dev /mnt/devsudo chroot /mnt /bin/bashgrub-install /dev/xvdfgrub-mkdevicemapupdate-grubexitsudo umount -l /mnt/devsudo umount -l /mnt/syssudo umount -l /mnt/procsudo umount -l /mntUbuntu 20.04:sudo mount /dev/xvdf1 /mnt sudo mount --bind /proc /mnt/procsudo mount --bind /sys /mnt/syssudo mount --bind /dev /mnt/devsudo chroot /mnt /bin/bashgrub-install /dev/xvdfgrub-mkdevicemapecho "GRUB_DISABLE_OS_PROBER=true" > /etc/default/grubecho "GRUB_FORCE_PARTUUID=" > /etc/default/grub.d/40-force-partuuid.cfgupdate-grubexitsudo umount -l /mnt/devsudo umount -l /mnt/syssudo umount -l /mnt/procsudo umount -l /mnt17.    Detach the volume /dev/xvdf from the running instance.18.    Attach the volume /dev/xvdf back to its original instance as /dev/xvda or /dev/sda1.19.    Start the original instance using SSH.20.    Run the lsblk command to verify that the root volume on your original instance now has 3-TiB of space.Related informationConstraints on the size and configuration of an EBS volumeFollow"