Question: How do I resolve the "user cannot be dropped" error in Amazon Redshift?

I'm unable to drop a user or group in Amazon Redshift. How do I resolve this?

Answer: "I'm unable to drop a user or group in Amazon Redshift. How do I resolve this?Short descriptionWhen you try to drop a user in Amazon Redshift, you might encounter one of these error messages:ERROR: user "username" cannot be dropped because some objects depend on itERROR: user "username" cannot be dropped because the user has a privilege on some objectERROR: user "username" cannot be dropped because the user owns some objectThese errors can occur when you try to drop these types of users:Owner or target user of default privileges that were previously granted.Owner of any object (such as databases, schemas, tables, views, procedures, and libraries).User has privileges on the previously mentioned objects.To resolve these error messages, you must first remove any user permissions. Then, you must transfer object ownership, or remove group ownership of the objects.Important: You must revoke user and group permissions from all databases in the Amazon Redshift cluster.ResolutionDropping a userImportant: Before you drop a user, revoke any user permissions. Then, transfer ownership of any database objects owned by the user.1.    Download and install the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts from the AWS Labs GitHub repository. These scripts create views in Amazon Redshift that are useful for the next two steps.Note: The views for the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts use the admin schema in their definition. If you don't have an admin schema created on the Amazon Redshift cluster, then create these views in any other existing schema. To create these views in another schema, modify the definition or create an admin schema. Note that if there are any column changes in your view definition, you must drop your view before creating a new view and definition. If a view already exists and you try to create a new one without dropping the old view, then you receive a "not valid table" error.2.    Find all granted user permissions by user that must be dropped, and then regrant those permissions as another user (superuser preferably):select regexp_replace(ddl,grantor,'<superuser>') from v_generate_user_grant_revoke_ddl where grantor='<username>' and ddltype='grant' and objtype <>'default acl' order by objseq,grantseq;Note: The user that regrants the permissions must be a user with permissions on the object. This user must have grant permissions rights to another user. If there are no other users with regrant permissions, then you can regrant the permissions as a superuser.3.    Find all permissions granted to the user, and then revoke them:select ddl from v_generate_user_grant_revoke_ddl where ddltype='revoke' and (grantee='<username>' or grantor='<username>') order by objseq, grantseq desc;Note: Make sure to replace "grantor" and "grantee" with the user names who can grant and receive permissions, respectively.If your query doesn't return any records or the drop user command fails, then run this query:select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and ddl ilike '%<user-to-be-dropped>%' order by objseq, grantseq desc;This query lists the permissions that must be revoked from the user before the user can be dropped. Make sure to revoke these permissions before proceeding to the next step.4.    Run these queries to check for any empty access control lists (ACLs):select * from pg_user where usename = '<username-to-be-dropped>'; select * from pg_default_acl where defacluser= <user-id>;To retrieve the use name and user ID, find the usename and usesysid column entries in the PG_USER table.Note: You can't drop a user if there are any user entries in the PG_DEFAULT_ACL table.5.    If the user to be dropped still has permissions on some objects, check if the user was granted assume-role permissions. You can do this by using this query :select pg_get_iam_role_by_user('<user-name>');If you see assumerole permissions for the user to be dropped, then revoke them using this command :revoke assumerole on all from <user-name> for all;6.    (Optional) If the user to be dropped still has permissions on some objects, then check if the user is part of another group. The user might have permissions that are granted from that group. Or, the user might have permissions that were granted to the PUBLIC group (or all users).To confirm the permissions that are still granted to the user, run these queries:select * from pg_user where usename = '<username-to-be-dropped>';select * from pg_group;In the output of the second query, check the grolist column and verify whether there are any entries listing the user to be dropped. If the user to be dropped belongs to another group, then the user ID is listed.If your grolist column indicates that the user is part of a group, then check the permissions that are granted to that group:select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and grantee= 'group <group-name>' ;select * from admin.v_generate_user_grant_revoke_ddl where objname='timecards' and schemaname='postgres' and grantee='PUBLIC' and ddltype='revoke';Make sure to replace objname and schemaname with your respective table and schema.Note: By default, permissions granted to the PUBLIC group are granted to all users.7.    Find all objects owned by the user, and then transfer the ownership from the user being dropped to a different user or admin:select ddl||'<newuser>;' as ddl from admin.v_find_dropuser_objs where objowner = '<username-to-be-dropped>';This output lists the commands that you can use to transfer ownership to a new user. Make sure to run the commands that are listed.8.    Repeat steps 2-7 in each database on the Amazon Redshift cluster.9.    Use the DROP USER command to remove the user from the database:drop user <username-to-be-dropped>;Dropping a groupBefore you drop a group, you must revoke any permissions that the group has for objects.1.    Download and install the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts from the AWS Labs GitHub repository. These scripts create views in Amazon Redshift that are useful for the next step.Note: The views for the v_generate_user_grant_revoke_ddl.sql and v_find_dropuser_objs.sql scripts use the admin schema in their definition. If you don't have an admin schema created on the Amazon Redshift cluster, then you can create these views in any other existing schema. To create these views in another schema, modify the definition or create an admin schema.2.    Find all permissions granted to the group, and then revoke them, as shown in this example:select ddl from admin.v_generate_user_grant_revoke_ddl where ddltype='revoke' and grantee= 'group <group-name>';3.    Repeat step 2 in each database on the Amazon Redshift cluster, confirming that the group's permissions are revoked in all databases.4.    Use the DROP GROUP command to remove the user group.Related informationDROP USER usage notesDROP GROUP exampleFollow"


Question: How do I resolve authorization errors when trying to create an Amazon Connect instance?

"I receive an authorization error when I try to create an Amazon Connect instance. Why am I receiving these errors, and how do I resolve the issue?"

Answer: "I receive an authorization error when I try to create an Amazon Connect instance. Why am I receiving these errors, and how do I resolve the issue?Short descriptionIf an AWS Identity and Access Management (IAM) user doesn't have the permissions required to create an instance, Amazon Connect returns an authorization error.Example Amazon Connect authorization errors"Action not authorized This action is not allowed by AWS policies! Please contact your AWS account administrator for assistance.""An error occurred while creating your instance. User is not authorized to perform Check Alias operation.""An error occurred while creating your instance. Please try again. If the problem persists, please contact support for further assistance."ResolutionTo allow an IAM user to create an Amazon Connect instance, make sure that the user has permissions granted by the AmazonConnect_FullAccess policy.For instructions on how to edit IAM user permissions, see Changing permissions for an IAM user. For a list of the minimum permissions required, see Required permissions for using custom IAM policies to manage access to the Amazon Connect console.Follow"


Question: How can I deploy a file gateway on a VMware 6.5 HA cluster using the vSphere Web Client?

I want to deploy an AWS Storage Gateway file gateway on a VMware 6.5 High Availability (HA) cluster. I want to use the vSphere Web Client to deploy the gateway.

Answer: "I want to deploy an AWS Storage Gateway file gateway on a VMware 6.5 High Availability (HA) cluster. I want to use the vSphere Web Client to deploy the gateway.ResolutionFrom the Storage Gateway console, download the VMware ESXi imageOpen the Storage Gateway console.Choose Create gateway.Under Gateway settings, enter a name for the gateway, and select the gateway time zone.For Gateway type, select Amazon FSx File gateway.For Host platform, select VMware ESXi. Then, choose Download OVF template.Select I downloaded the OVF template and completed the deployment and then followed all the steps above, and then choose Next.Note: Don't close the window or tab with the Storage Gateway console. You'll return to the console in a later step.From the vSphere Web Client, deploy the Open Virtualization Format (OVF) templateIn a new browser window or tab, log in to the vSphere Web Client. For more information, see Log in to vCenter Server using the vSphere Web Client on the VMware vSphere Documentation Center.In the left navigation pane, right-click on Datacenter, and then choose Deploy OVF Template.For Select an OVF template, select Local file. Choose Browse, and then select the file that you downloaded in step 4 of From the Storage Gateway console, download the VMware ESXi image.Choose Next.For Virtual machine name, enter a name for your virtual machine (VM). Then, choose Next.For Select a compute resource, select the VMware cluster node where you want to deploy your gateway. Then, choose Next.Review the details of your template, and then choose Next.For Select storage, select the VMware shared datastore where you want to store the VM. Then, choose Next.For Select networks, select the network that you want to assign to the gateway. Then, choose Next.Review the details of your configuration, and then choose Finish.Wait for the Status of the Deploy OVF template and Import OVF package tasks to change to Completed.From the vSphere Web Client, prepare the file gateway VM for activationIn the left navigation pane, right-click on the VM that you created. Then, choose Edit Settings.In the Edit Settings dialog box, expand Memory. Then, for Reservation, enter 16 GB at minimum. Select the check box for Reserve all guest memory (All locked). Note: For more information on the minimum memory requirements, see Hardware and storage requirements.Confirm that the VM is using SCSI controller 0 and that Change Type is VMware Paravirtual.From the Edit Settings dialog box, choose ADD NEW DEVICE, and then choose Hard Disk. This adds a new hard drive for your file gateway cache.For New Hard disk, enter 150 GB as the minimum.Choose the VM Options tab.Expand VMware Tools. Then, for Time, select the check box for Synchronize guest time with host. For more information, see Synchronizing VM time with host time.Choose OK.On the main details page of your VM, choose the play button next to the name of your VM.After your VM starts, note the IP Addresses listed on the VM details page.Note: Don't close the window or tab with the vSphere Web Client. You'll go back to the web client in a later step.From the vSphere Web Client, complete the network configuration steps for your VMGo back to the vSphere Web Client to the page with the details of your VM.Choose Launch Remote Console.After the VMware Remote Console launches, log in with localhost login as admin, and Password as password. This takes you to the AWS Storage Gateway - Configuration menu.For Enter command, enter 2 to go to the AWS Storage Gateway - Network Configuration menu.For Enter command, enter 3 to configure the static IP address.For Enter network adapter, enter the name of the available adapter.For Enter IP Address, Ex: 10.1.1.212.For Enter network mask, enter Ex: 255.255.255.0.For Enter default gateway, enter Ex: 10.1.1.1.For Apply config, enter y.After the changes are applied, for Enter command, enter 1 to describe the adapter so that you can confirm the changes. Then, press return to continue.For Enter command, enter 6 to edit the DNS configuration.For Enter network adapter, enter the available adapter.For Enter primary DNS, enter the primary DNS for your server.For Apply config, enter y.After the changes are applied, for Enter command, enter 7 to view the DNS configuration so that you can confirm the changes.After you confirm the settings, for Enter command, enter x to complete your configuration and exit.For Restart gateway now, enter y.On the AWS Storage Gateway - Configuration menu, synchronize your gateway VM time.On the AWS Storage Gateway - Configuration menu, for Enter command, enter 3 to test the connection between the gateway appliance and AWS Storage Gateway service endpoints (client-cp, dp-1,anon-cp, and proxy-app) in your AWS Region. For more information, see Testing your gateway's network connectivity.Confirm that all connectivity tests return [ PASSED ].From the Storage Gateway console, complete the steps to create the file gatewayOpen the Storage Gateway console tab or window. Be sure that you are on the Connect to AWS page.For Service endpoint, choose Publicly accessible.For Connection options, select IP address.For IP address, enter the IP address that you noted in step 10 of From the vSphere Web Client, prepare the file gateway VM for activation.Choose Next.Complete the steps to activate the gateway and configure your Amazon Simple Storage Service (Amazon S3) File Gateway.Note: You can use the steps for both Amazon S3 File Gateway and Amazon FSx File Gateway deploying on vSphere HA-enabled cluster.Follow"


Question: How can I use a Lambda function to automatically start an AWS Glue job when a crawler run completes?

I want to use an AWS Lambda function to automatically start an AWS Glue job when a crawler run completes.

Answer: "I want to use an AWS Lambda function to automatically start an AWS Glue job when a crawler run completes.Short descriptionTo start a job when a crawler run completes, create an AWS Lambda function and an Amazon EventBridge rule. You can modify this method to automate other AWS Glue functions.Note: You can also use AWS Glue workflows to automatically start a job when a crawler run completes. This method requires that you start the crawler from the Workflows page on the AWS Glue console. For more information, see How can I use AWS Glue workflows to automatically start a job when a crawler run completes?ResolutionBefore completing the following steps, be sure that you have:An AWS Glue extract, transform, and load (ETL) job.An AWS Glue crawler.An AWS Identity and Access Management (IAM) role for Lambda with permission to run AWS Glue jobs. For example, set up a service-linked role for Lambda that has the AWSGlueServiceRole policy attached to it.Create the Lambda function1.    Open the Lambda console.2.    Choose Create function.Note: If you have no Lambda functions, then the Get started page appears. Choose Create a function and then continue to the next step.3.    Be sure that Author from scratch is selected, and then configure the following options:For Name, enter a name for your function.For Runtime, choose one of the Python options.For Architecture, use the default option, x86_64.For Role, select the dropdown at Change default execution role and select Use an existing role.For Existing role, select an IAM role that has permission to run AWS Glue jobs.4.    Choose Create function.5.    In the Function code section, paste code similar to the following. Be sure to replace MyTestJob with the name of your AWS Glue ETL job.# Set up loggingimport jsonimport osimport logginglogger = logging.getLogger()logger.setLevel(logging.INFO)# Import Boto 3 for AWS Glueimport boto3client = boto3.client('glue')# Variables for the job: glueJobName = "MyTestJob"# Define Lambda functiondef lambda_handler(event, context):    logger.info('## INITIATED BY EVENT: ')    logger.info(event['detail'])    response = client.start_job_run(JobName = glueJobName)    logger.info('## STARTED GLUE JOB: ' + glueJobName)    logger.info('## GLUE JOB RUN ID: ' + response['JobRunId'])    return response6.    In the top of the code edit UI, chose Deploy, and then choose Test.7.    Open the AWS Glue console and confirm that the job started.Create the EventBridge rule1.    Open the Amazon EventBridge console.2.    In the navigation pane, choose Rules, and then choose Create rule.3.    Enter a name and description for the rule and select Next.4.    Use default values for Event sourceand Sample even****t. In the Event pattern section, select Custom Patterns (JSON editor).5.    Copy and paste the following code in the Event pattern box. Be sure to replace MyTestCrawl with the name of your AWS Glue crawler.{    "detail-type": [        "Glue Crawler State Change"    ],    "source": [        "aws.glue"    ],    "detail": {        "crawlerName": [            "MyTestCrawl"        ],        "state": [            "Succeeded"        ]    }}6.    In the Select targets section, do the following:For Target, select Lambda function.For Function, select the name of your Lambda function.7.    Choose Create.To test the Lambda function and EventBridge rule, run your AWS Glue crawler. Then, check the History tab of your AWS Glue ETL job. The Run status should display Starting or Running.Related informationCreating Amazon EventBridge rules that react to eventsFollow"


Question: How do I create multiple node groups for Amazon EKS nodes using eksctl?

I want to create multiple node groups for Amazon Elastic Kubernetes Service (Amazon EKS) nodes using eksctl.

Answer: "I want to create multiple node groups for Amazon Elastic Kubernetes Service (Amazon EKS) nodes using eksctl.Short descriptionYou can create a node group using eksctl either with default parameters or with custom parameters using a configuration file for multiple node groups.ResolutionCreate a node group with default parameters1.    Install eksctl.2.    To confirm that eksctl is configured and installed on the terminal with the correct permissions, run this command:$ eksctl version3.    To create an additional node group with default parameters, run this command:$ eksctl create nodegroup --cluster=yourClusterName --name=yourNodeGroupName --region yourRegionNameHere are the default parameters:Instance type = m5.largeAMI : lastest AWS EKS AMINodes-desired capacity = 2Nodes-min capacity =2 Nodes-max capacity=2Note: By default, new node groups inherit the version of Kubernetes installed from the control plane (–version=auto), but you can specify a different version of Kubernetes (for example, version=1.13). To use the latest version of Kubernetes, run the –version=latest command.4.    Open the AWS CloudFormation console and choose the stack associated with the node group that you created. Then, choose the Events tab to look for an AWS CloudFormation event showing that your stack is deployed.5.    To confirm that the new node groups are attached to the cluster and to verify that the node group configuration is applied, run these commands:$ Kubectl get nodes$ eksctl get nodegroups --cluster yourClusterNameCreate a node group with custom parameters1.    Define the parameters for the new node group in a configuration file. For example:kind: ClusterConfigapiVersion: eksctl.io/v1alpha5metadata:    name: yourClusterName    region: yourRegionNamenodeGroups:  - name: ng1-Workers    availabilityZones: ["az-name"]    desiredCapacity: 3    instanceType: m5.large    iam:      instanceProfileARN: "arn:aws:iam::11111:instance-profile/eks-nodes-base-role" #Attaching IAM role      instanceRoleARN: "arn:aws:iam::1111:role/eks-nodes-base-role"    privateNetworking: true    securityGroups:      withShared: true      withLocal: true      attachIDs: ['sg-11111', 'sg-11112']    ssh:      publicKeyName: 'my-instance-key'    kubeletExtraConfig:        kubeReserved:            cpu: "300m"            memory: "300Mi"            ephemeral-storage: "1Gi"        kubeReservedCgroup: "/kube-reserved"        systemReserved:            cpu: "300m"            memory: "300Mi"            ephemeral-storage: "1Gi"    tags:      'environment': 'development'  - name: ng-2-builders #example of a nodegroup that uses 50% spot instances and 50% on demand instances:    minSize: 2    maxSize: 5    instancesDistribution:      maxPrice: 0.017      instanceTypes: ["t3.small", "t3.medium"] # At least two instance types should be specified      onDemandBaseCapacity: 0      onDemandPercentageAboveBaseCapacity: 50      spotInstancePools: 2    tags:      'environment': 'production'2.    To create an additional node group using the configuration file, run this command:$ eksctl create nodegroup --config-file= yourConfigFileName3.    Open the AWS CloudFormation console, and then choose the stack associated with the node group that you created. Then, choose the Events tab to look for an AWS CloudFormation event showing that your stack is deployed.4.    To confirm that the new node groups are attached to the cluster and to verify that the node group configuration is applied, run these commands:$ kubectl get nodes$ eksctl get nodegroups --cluster yourClusterNameYou see that your nodes have joined the cluster. You can see that the two node groups are visible by using eksctl.Follow"


Question: "I'm trying to export a snapshot from Amazon RDS MySQL to Amazon S3, but I'm receiving an error. Why is this happening?"

"I'm trying to export a snapshot to my Amazon Simple Storage Service (Amazon S3) bucket from my Amazon Relational Database Service (Amazon RDS) MySQL instance. However, I'm seeing an error or the option is unavailable."

Answer: "I'm trying to export a snapshot to my Amazon Simple Storage Service (Amazon S3) bucket from my Amazon Relational Database Service (Amazon RDS) MySQL instance. However, I'm seeing an error or the option is unavailable.Short descriptionExporting a DB snapshot from Amazon RDS to Amazon S3 can fail for the following reasons:AWS Identity Access Management (IAM) role and policy misconfigurationAWS KMS key check failureExport task is stuck in "STARTING"Access Denied errorKMSKeyNotAccessibleFaultPermission issues on tableIAM role doesn't existResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.AWS Identity Access Management (IAM) role and policy misconfigurationIf your IAM role doesn't have permissions to export a snapshot from your Amazon RDS MySQL instance to Amazon S3, you receive the following errors:An error occurred (IamRoleMissingPermissions) when calling the StartExportTask operation: The IAM Role arn:aws:iam::1234567890:role/service-role/role_name isn't authorized to call s3:GetBucketLocation on the S3 bucket my_bucket_name ORAn error occurred (IamRoleMissingPermissions) when calling the StartExportTask operation: The IAM Role arn:aws:iam::1234567890:role/service-role/role_name isn't authorized to call s3:DeleteObject on the S3 bucket my_bucket_name ORAn error occurred (IamRoleMissingPermissions) when calling the StartExportTask operation: The IAM Role arn:aws:iam::1234567890:role/service-role/role_name isn't authorized to call s3:PutObject on the S3 bucket my_bucket_name ORAn error occurred (IamRoleMissingPermissions) when calling the StartExportTask operation: The IAM Role arn:aws:iam::1234567890:role/service-role/role_name isn't authorized to call s3:ListBucket on the S3 bucket my_bucket_name ORAn error occurred (IamRoleMissingPermissions) when calling the StartExportTask operation: The IAM Role arn:aws:iam::1234567890:role/service-role/role_name isn't authorized to call s3:GetObject on the S3 bucket my_bucket_name.To successfully export a snapshot to Amazon S3, your IAM role must have proper permissions for these five actions:s3:PutObjects3:DeleteObjects3:GetObjects3:ListBuckets3:GetBucketLocationHere's an example IAM policy (in JSON format) that allows these five actions:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "ExportPolicy",      "Effect": "Allow",      "Action": [        "s3:PutObject*",        "s3:ListBucket",        "s3:GetObject*",        "s3:DeleteObject*",        "s3:GetBucketLocation"      ],      "Resource": [        "arn:aws:s3:::s3_bucket_name",        "arn:aws:s3:::s3_bucket_name/export/*"      ]    }  ]}AWS KMS key check failureIf your AWS KMS key was deactivated or deleted while you were exporting a snapshot, you receive the following error:Error: KMS keys check failed. Please check the credentials on your KMS key and try again.To resolve this issue, make sure that the AWS KMS key used for exporting snapshots exists in the AWS KMS console. The AWS KMS key status must indicate "Enabled".Export task is stuck in "STARTING" statusThe time that it takes to export your Amazon RDS for MySQL DB snapshot to Amazon S3 depends upon both the database size and type. The export task restores and scales the entire database before extracting the data to Amazon S3. During this stage, your export task displays the "STARTING" status. When your task begins to export the data to Amazon S3, the status changes to "In progress". If your export task is successful, the status indicates that the task is complete. If there are issues with your export task process, then the status indicates that the task failed.If your IAM role is missing the required permissions and you're using AWS Lambda with Amazon API Gateway, you receive the following error:An error occurred (AccessDenied) when calling the StartExportTask operation: User: arn:aws:sts::1234567890:assumed-role/user/rds_lambda is not authorized to perform: rds:StartExportTaskTo resolve this issue, allow Write access to rds:StartExportTask. However, you must have access to the StartExportTask action:"Effect": "Allow","Action": "rds:StartExportTask","Resource": "*"If your IAM role doesn't have permission to call the StartExportTask operation, then you receive the following error:An error occurred (AccessDenied) when calling the StartExportTask operation: User: arn:aws:sts::1234567890:assumed-role/user/rds_lambda is not authorized to perform: iam:PassRole on Resource ,iam role arn.To resolve this error, make sure to grant user permissions to pass a role to an AWS service:{    "Effect": "Allow",    "Action": [      "iam:GetRole",      "iam:PassRole"    ],    "Resource": "arn:aws:iam::1234567890:role/role_name"}KMSKeyNotAccessibleFaultIf your AWS KMS key or IAM role aren’t accessible from snapshot export mechanism, you receive the following error:An error occurred (KMSKeyNotAccessibleFault) when calling the StartExportTask operation: The specified KMS key <key_id> does not exist, is not enabled or you do not have permissions to access it.To resolve the KMSKeyNotAccessibleFault error in Amazon RDS, see Setting up access to an Amazon S3 bucket.To resolve the KMSKeyNotAccessibleFault error in Amazon Aurora, see Using a cross-account AWS KMS key.Permission issues on tableIf you don't have proper permissions to access a table in Amazon RDS, you receive the following error:Error: PERMISSIONS_DO_NOT_EXIST error stating that (n) tables were skippedTo resolve this issue, run the following command after connecting to a PostgreSQL database:GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA schema_name TO superuser_name;IAM role doesn't existIf the proper trust relationship isn't specified in your IAM role's trust policy, then you receive the following error:Error: The Principal export.rds.amazonaws.com isn't allowed to assume the IAM role arn:aws:iam::1234567890:role/iam_role or the IAM role arn:aws:iam::1234567890:role/iam_role doesn't exist.To resolve this issue, make sure that the trust relationship specifies "export.rds.amazonaws.com" instead of "rds.amazonaws.com" in your IAM policy:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "Service": "export.rds.amazonaws.com"      },      "Action": "sts:AssumeRole",      "Condition": {}    }  ]}Follow"


Question: Where can I find SSH login credentials so that I can connect to my Lightsail instance from an SSH client?

I want to connect to my Amazon Lightsail instance from an SSH client. Where can I find the required SSH login credentials?

Answer: "I want to connect to my Amazon Lightsail instance from an SSH client. Where can I find the required SSH login credentials?Short descriptionTo connect to your Lightsail instance using your own SSH client, you need the following:The Lightsail instance's IP address.The SSH user name.The SSH key pair configured on the instance.Resolution1.    Open the Lightsail console.2.    Select the Lightsail instance you want to connect to.3.    Select the Connect tab. In the Connect using your own SSH client section, note the IP address, user name, and key pair.4.    Connect to your Lightsail instance from the SSH client using the IP address, user name, and key pair you noted in step 3.Note: If your local machine uses a Windows operating system, you can set up PuTTY to connect to your Linux or Unix Lightsail instance. For more information, see Download and set up PuTTY to connect using SSH in Amazon Lightsail.If your local machine uses a Linux or Unix operating system, including macOS, then you can set up the native SSH client in terminal to connect to your Linux or Unix Lightsail instance. For more information, see Connect to your Linux or Unix instance using SSH in terminal.Generally, SSH password authentication is deactivated. However, certain Lightsail instances might store automatically-generated application credentials in a password file on the file system. This password file can be viewed after connecting to the instance via SSH using the SSH KEY.Related informationConnecting to your Linux or Unix instance in Amazon LightsailFollow"


Question: How can I use DataSync to transfer data from an Amazon EFS file system to an Amazon S3 bucket?

I want to use AWS DataSync to transfer data from Amazon Elastic File System (Amazon EFS) to Amazon Simple Storage Service (Amazon S3) without deploying the DataSync Amazon Elastic Compute Cloud (Amazon EC2) agent.

Answer: "I want to use AWS DataSync to transfer data from Amazon Elastic File System (Amazon EFS) to Amazon Simple Storage Service (Amazon S3) without deploying the DataSync Amazon Elastic Compute Cloud (Amazon EC2) agent.ResolutionCreate a DataSync task with the EFS file system as the source location and the S3 bucket as the destination location:Open the AWS DataSync console.In the navigation pane, choose Tasks.Choose Create task.For Configure source location, select Create a new location.Under Configuration, for Location type, select Amazon EFS file system.For EFS File system, choose the EFS file system that you want to use as an endpoint. You configure this location as a source.For Mount path, enter the mount path for your EFS file system. The path can include a subdirectory in the EFS file system that's used to read data from the EFS source or write data to the EFS destination. By default, DataSync uses the root directory.Expand Additional settings.For Subnet and Security Group, a subnet that includes a mount target for your Amazon EFS file system and this subnet's default security group are selected by default. Note: DataSync uses the security group specified in this step to connect to your Amazon EFS file system. If the security group is configured to restrict connections from within itself, then you can do either of the following:Change the configuration to allow the security group to communicate within itself.-or-Choose a different subnet and security group.Choose Next.For Destination location options, select Create a new location.Under Configuration, for Location type, select Amazon S3 bucket.For S3 bucket, select the bucket that you want to use as an endpoint.For S3 storage class, choose the storage class that you want to use for the transferred files.For Folder, enter the S3 folder or prefix that you want to use for the data transfer. This is the folder that DataSync uses either to read data from for an S3 source location or write data to an S3 destination. You can also leave this field blank to copy the file into the root of the bucket.For IAM role, select a role that has permissions to access the S3 bucket. Or, choose Autogenerate for DataSync to automatically create a role with the required permissions. If DataSync previously created an IAM role for the S3 bucket, then that role is selected as the default.Note: For instructions on how to create an IAM role manually, see Manually configuring an IAM role to access your S3 bucket.Choose Next.For Configure settings, configure the task settings for your use case.Choose Next.Review the task settings. Then, choose Create task.After the task status becomes Available, you can start the task to transfer files from the EFS file system to the S3 bucket. You can also schedule periodic replication of your Amazon EFS file system to the S3 bucket within the same AWS Account.Related informationWorking with locationsFollow"


Question: How can I fix the error "Unable to locate credentials" when I try to connect to my Amazon S3 bucket using the AWS CLI?

"When I try to access my Amazon Simple Storage Service (Amazon S3) bucket using the AWS Command Line Interface (AWS CLI), I get an error. How do I fix this?"

Answer: "When I try to access my Amazon Simple Storage Service (Amazon S3) bucket using the AWS Command Line Interface (AWS CLI), I get an error. How do I fix this?ResolutionAn "Unable to locate credentials" error indicates that Amazon S3 can't find the credentials to authenticate AWS API calls. To resolve this issue, make sure that your AWS credentials are correctly configured in the AWS CLI.Note: If you still receive an error when running an AWS CLI command, make sure that you’re using the most recent AWS CLI version.To check if the AWS CLI is configured with credentials, run this command:$ aws configure listIf your credentials are configured in the config file, the command returns a response similar to the following:Name                    Value                    Type            Location----                    -----                    ----            --------profile                <not set>                 None            Noneaccess_key             ****************ABCD      config_file    ~/.aws/configsecret_key             ****************ABCD      config_file    ~/.aws/configregion                 us-west-2                 env            AWS_DEFAULT_REGIONIf your credentials are configured using environment variables, then the command returns a response similar to the following:Name                   Value                     Type            Location----                   -----                     ----            --------profile                <not set>                 None            Noneaccess_key             ****************N36N      env    secret_key             ****************cxxy      env    region                 <not set>                 None            NoneIf your credentials are configured in an instance profile, the command returns a response similar to the following:Name                    Value                    Type              Location----                    -----                    ----              --------profile                <not set>                 None               Noneaccess_key             ****************YVEQ      iam-rolesecret_key             ****************2a9N      iam-roleregion                 <not set>                 None               NoneIf the command returns the following output, then no credentials are set:Name                    Value             Type                Location----                    -----             ----                --------profile                <not set>          None                Noneaccess_key             <not set>          None                Nonesecret_key             <not set>          None                Noneregion                 <not set>          None                NoneReview the response to check whether credentials are missing or the stored credentials are incorrect. To update your credentials, use the AWS CLI, environment variables, or attach an instance profile to an EC2 instance.After you update your credentials, test the AWS CLI by running an Amazon S3 AWS CLI command, such as aws s3 ls.Related informationConfiguration and credential file settingsFollow"


Question: How do I troubleshoot CCP user interface errors in Amazon Connect?

I want to troubleshoot Contact Control Panel (CCP) user interface errors in Amazon Connect.

Answer: "I want to troubleshoot Contact Control Panel (CCP) user interface errors in Amazon Connect.Short descriptionThe following are the most common CCP user interface errors:The microphone isn't accessible.There's an ice_collection_timeout error.The browser isn't supported.The softphone call failed.There's a WebRTC issue.Initialization failed.The outbound configuration isn't valid.The number isn't valid.There are multiple CCPs open.To locate specific errors, download the CCP logs. Then, review the following steps to troubleshoot common CCP user interface errors.ResolutionThe microphone isn't accessibleError message: Your browser does not have access to the microphoneThis error indicates that the CCP doesn't have access to a microphone or headset device.To troubleshoot this error, see Can't hear caller or caller can't hear agent?There's an ice_collection_timeout errorThis error indicates that the CCP can't communicate to the softphone endpoint. For example, you use a Network Load Balancer endpoint with the User Datagram Protocol (UDP) port 3478, and the connection times out.To troubleshoot this error, take one or more of the following actions:Check if the user's workstation meets the minimum requirements.Check the firewall settings to see if UDP 3478 outbound traffic is allowed to Amazon Connect softphone media. Make sure that all traffic requirements are configured properly in your network.Turn off any VPNs that you might be using, or test another browser or workstation to isolate workstation related issues.If you're using a stateless firewall, then be sure that you add the ephemeral port range to your allow list.For additional troubleshooting instructions, see How do I troubleshoot Amazon Connect CCP softphone errors?The browser isn't supportedError message: This browser is not supported, Some functionality may not be availableThis error indicates that the browser version that you're using is three versions earlier than the current version, or Amazon Connect doesn't support the browser.For a list of supported browsers, see Browsers supported by Amazon Connect.The softphone call failedError message: Failed to establish softphone connection. Try again or contact your administrator.This error can happen due to signalling_connection_failure or signalling_handshake_failure errors. The signalling_connection_failure error happens when the CCP can't establish a connection with the signaling server. Both issues mean that the CCP failed to communicate with the signaling server (Amazon Connect persistent connection service).Note: The signaling server uses TCP 443 for communication.To troubleshoot this error, take one or more of the following actions:If there's a proxy in place, then deactivate the proxy for the agent's browser to see if the issue still persists.Check for network issues or firewall blocks with the agent’s workstation.Check the firewall settings to see if TCP 443 outbound traffic is allowed to Amazon Connect. For more information, see Set up your network.For additional troubleshooting instructions, see How do I troubleshoot Amazon Connect CCP softphone errors?There's a WebRTC issueError message: Call failed due to a browser-side WebRTC issue.The ice_collection_timeout happens when the CCP detects a disconnected contact and tries to establish the WebRTC connection again. If a second attempt to establish a connection fails, then the webrtc_error occurs.To troubleshoot this error, check the CCP logs for the following information:If you see ice_collection_timeout before the webrtc_error, then follow the preceding troubleshooting steps in this article for the ice_collection_timeout error.If you don't see ice_collection_timeout, then review the CCP log to check what SESSION state the RTC session establishment failed. The SESSION state is identified by the ConnectSignalingAndIceCollectionState error. Then, check the rtc_session JavaScript file to see which RTC_ERRORS correspond with the call failure. Also, check if the issue is reproducible or if it depends on a specific browser version.Initialization failedError message: Try fixing your connection by logging out, and then logging on again. If you need help, contact your administrator.This error indicates that the CCP fails to establish a WebSocket connection when it's initialized.To troubleshoot this error, take one or more of the following actions:Check for network issues in an agent's workstation.Make sure that the user's workstation meets the minimum requirements.Check the firewall settings to see if TCP 443 outbound traffic is allowed to Amazon Connect. For more information, see Set up your network.If there's a proxy in place, then deactivate the proxy for the agent’s browser to see if the issue still persists.Be sure to close unused CCP windows to prevent the QuotaExceededException error.For more information, see How to determine whether a workstation is the source of problems.The outbound configuration isn't validError message: Before you can place an outbound call, you must associate a phone number with this queue. Contact your administrator for further assistance.To troubleshoot this error, take one or more of the following actions:Check the outbound caller ID in the default outbound queue settings. If you didn't set up an outbound caller ID, then set it up.Check the instance-level settings for outbound calls. For more information, see Update telephony options.Verify whether a security profile allows an agent to make outbound calls. To set up outbound communications, see Activate outbound calls.The number isn't validError message: We are unable to complete the call as dialed. Try again, or contact your administrator.This error can happen for many reasons. The following reasons are the most common ones:The phone number isn't in E.164 format. For example, the UK mobile number 07911 123456 in E.164 format is +44 7911 123456 (tel:+447911123456).You can't call the country's phone number by default. For more information, see Countries you can call by default.You reached the ConcurrentCalls limit. For more information, see How contacts are counted.To further troubleshoot this error, run the StartOutboundVoiceContact API request. Then, review the CCP logs to see what error message you get in the API response.There are multiple CCPs openThis error happens when the agent opens more than five WebSocket connections.However, if the CCP fails to open a WebSocket connection, then this results in an Initialization failed error. To troubleshoot this issue, follow the preceding troubleshooting steps in this article for the Initialization failed error.Follow"


Question: How can I resolve the “CannotPullContainerError” error in my Amazon ECS EC2 Launch Type Task?

"When I launch an EC2 task in Amazon Elastic Container Service (Amazon ECS), I receive the following error: "CannotPullContainerError"."

Answer: "When I launch an EC2 task in Amazon Elastic Container Service (Amazon ECS), I receive the following error: "CannotPullContainerError".Short descriptionThe CannotPullContainerError occurs due to any of the following issues:An Amazon Elastic Compute Cloud (Amazon EC2) Launch Type task can't pull the image due to an incorrectly configured network.An AWS Identity and Access Management (IAM) role doesn't have the right permissions to pull the image.There's a DockerHub rate limit.The image name or tag doesn't exist.ResolutionYour Amazon ECS container instance network configuration is incorrectIf your Amazon ECS container instance doesn't have an internet connection, then it can't reach the Amazon Elastic Container Registry (Amazon ECR) endpoint. Without a connection to the endpoint, the instance can't pull the image.To verify that your ECS container instance has internet access, review the following:Confirm that your instances have access to the internet through either an internet gateway or Network Address Translation (NAT) gateway.Note: Instead of a NAT gateway, you can use AWS PrivateLink. To avoid errors, make sure that AWS PrivateLink is correctly configured.Verify that inbound HTTPS access is allowed through port 443 at the instance, security group, and network access control list (network ACL) levels.To troubleshoot NAT gateway connectivity issues, see Why can't my EC2 instances access the internet using a NAT gateway?To troubleshoot internet gateway connectivity issues, see Why can't my EC2 instance connect to the internet using an internet gateway?If you're using a VPC endpoint to connect to an Amazon ECR endpoint, then check your security groups. Confirm that the security groups for your VPC endpoint allow the ECS container instance to use them.If you receive the error message "CannotPullContainerError: API error", then see How can I resolve the Amazon ECR error "CannotPullContainerError: API error" in Amazon ECS?Your IAM role doesn't have the right permissions to pull imagesConfirm that the instance IAM role associated with the instance profile has permissions to access the Amazon ECR repository.Note: The AWS managed policy AmazonEC2ContainerRegistryReadOnly provides the minimum permissions required to pull images.The DockerHub pull rate limit is reachedIf you're trying to pull an image from DockerHub and you reached your pull rate limit, then you receive the following error message:CannotPullContainerError: inspect image has been retried 5 time(s): httpReaderSeeker: failed open: unexpected status code https://registry-1.docker.io/v2/manifests/sha256:2bb501e6429 Too Many Requests - Server message: toomanyrequests:To resolve this issue, review the steps in How do I resolve the error "CannotPullContainerError: You have reached your pull rate limit" in Amazon ECS?The image name or tag doesn't existIf an image or its associated tag hosted in Amazon ECR defined in your task definition doesn't exist, then you receive the following error:Cannotpullcontainererror: pull image manifest has been retried 1 time(s): failed to resolve ref 123456789.dkr.ecr.ap-southeast-2.amazonaws.com/image-name:tag: 123456789**.dkr.ecr.ap-southeast-2.amazonaws.com/image-name:tag: not found**To resolve this issue, verify the image field in your task definition. Confirm that the corresponding repository and defined tag is present in the container registry that you're pulling from.If your task pulls an image from a registry other than Amazon ECR and is missing information, then you receive a different error. The following error occurs if the image doesn't exist, the tag doesn't exist, or the registry credentials aren't provided:Cannotpullcontainererror: pull image manifest has been retried 1 time(s): failed to resolve ref docker.io/library/invalid-name:non-existenttag: pull access denied, repository does not exist or may require authorization: server message: insufficient_scope: authorization failedTo resolvethis issue, verify the image field in your task definition. Confirm that the image exists in the corresponding container registry. If the image exists, then make sure that you provide the correct credentials. For more information, see Private registry authentication for tasks.Follow"


Question: How do I delete or terminate a Client VPN endpoint or connection on AWS Client VPN?

I want to delete or terminate a Client VPN endpoint or connection on AWS Client VPN using the console.

Answer: "I want to delete or terminate a Client VPN endpoint or connection on AWS Client VPN using the console.ResolutionDelete a VPN endpointYou must disassociate all associated target networks before you can delete a Client VPN endpoint.To disassociate all associated target networks, do the following:Access the Amazon VPC console.Select the AWS Region for your VPN endpoint.In the navigation pane, choose Client VPN Endpoints.Select the Client VPN endpoint with which the target network is associated, and then choose Associations.Select the target network to disassociate, and then choose Disassociate. Then choose Yes, Disassociate.To disassociate all associated target networks using AWS CLI, see disassociate-client-vpn-target-network.To delete a Client VPN endpoint, do the following:Access the Amazon VPC console.Select the AWS Region for your VPN endpoint.In the navigation pane, choose Client VPN Endpoints.Select the Client VPN endpoint to delete, choose Actions.Choose Delete Client VPN Endpoint, and then choose Yes, Delete.To delete a Client VPN endpoint using AWS CLI, see delete-client-vpn-endpoint.Terminate a Client VPN endpoint connectionTo terminate a Client VPN endpoint connection, do the following:Access the Amazon VPC console.Select the AWS Region for your VPN endpoint.In the navigation pane, choose Client VPN Endpoints.Select the Client VPN endpoint that the client is connected to. Then, choose Connections.Select the connection to terminate, and then choose Terminate Connection.When prompted, choose Terminate Connection.After termination, the VPN session ends.To terminate Client VPN endpoint connections using AWS CLI, see terminate-client-vpn-connections.Follow"


Question: How do I resolve the errors "session '0' not found" and "Error sending http request and maximum retry encountered" in Amazon EMR?

I want to troubleshoot errors when I run an Apache Livy application using a Jupyter Notebook on Amazon EMR.

Answer: "I want to troubleshoot errors when I run an Apache Livy application using a Jupyter Notebook on Amazon EMR.Short descriptionYou get one of the following errors when you run an Apache Livy application using a Jupyter Notebook on Amazon EMR:'404' from xxxxxxxx with error payload: "session '0' not found""The code failed because of a fatal error: Error sending http request and maximum retry encountered."These errors usually happen when you keep the Jupyter Notebook session running until it times out. To resolve these errors, increase the value of the livy.server.session.timeout property in /etc/livy/conf/livy.conf on the master node. Then, restart livy-server.ResolutionYou can modify livy.server.session.timeout on a running Amazon EMR cluster or when launching a new cluster.On a running cluster1.    Open /etc/livy/conf/livy.conf on the master node, and then modify the livy.server.session.timeout value (the default value is 1h). Example:sudo vim /etc/livy/conf/livy.conflivy.server.session.timeout 2h2.    Run the following commands on the master node to restart livy-server:Suppose that you're using one of the following Amazon EMR release versions that's based on Amazon Linux 2:Amazon EMR release version 5.30.0 or laterAmazon EMR 6.x seriesThen, run the following commands:sudo systemctl stop livy-serversudo systemctl start livy-serverIf you're using the Amazon EMR release version 5.29.0 or earlier, then run the following commands:sudo stop livy-serversudo start livy-serverWhen livy-server is restarting, your cluster is unavailable. To avoid downtime, configure the Livy application when you launch an Amazon EMR cluster.On a new clusterAdd a configuration objectsimilar to the following when you launch a cluster using Amazon EMR release version 4.6.0 or later. In addition to modifying livy.server.session.timeout, you can modify the following related properties, if desired:livy.server.session.timeout-check: When turned on, Livy stops idle sessions that reach the timeout threshold. The default setting is true.livy.server.yarn.app-lookup-timeout: The duration that Livy looks for the YARN application before considering it lost. The default setting is 60s.[    {        "Classification": "livy-conf",        "Properties": {            "livy.server.session.timeout-check": "true",            "livy.server.session.timeout": "2h",            "livy.server.yarn.app-lookup-timeout": "120s"        }    }]After you're done running the job, be sure to close the session in Jupyter or Zeppelin. When too many sessions are open, new jobs can't start until resources become available.Related informationApache LivyJupyter Notebook on Amazon EMRFollow"


Question: How can I get data to assist in troubleshooting IAM permission access denied or unauthorized errors?

I am trying to access an AWS resource and I received an "access denied" or "unauthorized" error. How can I get data to assist in troubleshooting these AWS Identity and Access Management (IAM) API call failure errors?

Answer: "I am trying to access an AWS resource and I received an "access denied" or "unauthorized" error. How can I get data to assist in troubleshooting these AWS Identity and Access Management (IAM) API call failure errors?Short descriptionYou can use Amazon Athena queries or the AWS Command Line Interface (AWS CLI) to get error logs for IAM API call failures. Then, follow the instructions to troubleshoot access denied or unauthorized operation errors with an IAM policy.ResolutionNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Option 1: Use Athena queries to troubleshoot IAM API call failures by searching CloudTrail logsNote: Before you begin, you must have a trail created to log to an Amazon Simple Storage Service (Amazon S3) bucket. This is because Athena uses events recorded in AWS CloudTrail log files that are delivered to an Amazon S3 bucket for that trail.1.    Follow the steps in the create the Athena table section of How do I automatically create tables in Athena to search through AWS CloudTrail logs?Note: Athena tables that are created automatically are in the same AWS Region as your Amazon S3 bucket.2.    Open the Athena console, and then choose the plus sign "+" to create a new query.3.    Enter the following example query, and then choose Run.In this example query, the time format uses ISO 8601 basic format with the Z variable for UTC.Note: Replace your-arn with the IAM Amazon Resource Names (ARN) for your resources and your-table with your table name.SELECT from_iso8601_timestamp(eventTime) AS "Time", useridentity.arn AS "Identity ARN", eventID AS "Event ID",         eventsource AS "Service", eventname AS "Action", errorCode AS "Error", errorMessage AS "Message"FROM your-tableWHERE from_iso8601_timestamp(eventtime) >= from_iso8601_timestamp('2019-10-29T06:40:00Z')        AND from_iso8601_timestamp(eventtime) < from_iso8601_timestamp('2019-10-29T06:55:00Z')        AND userIdentity.arn = 'your-arn'        AND eventType = 'AwsApiCall'        AND errorCode is not null        AND (lower(errorCode) LIKE '%accessdenied%' OR lower(errorCode) LIKE '%unauthorized%')ORDER BY eventTime desc4.    This example table output lists permission errors for the identity ARN:| Time                        | Event ID                             | Service                  | Action       | Error        | Message                                                                                ||-----------------------------|--------------------------------------|--------------------------|--------------|--------------|----------------------------------------------------------------------------------------------------------------------|| 2019-10-29 06:52:45.000 UTC | 0406f0c1-47a8-4f71-8a94-18267b84042a | cloudtrail.amazonaws.com | LookupEvents | AccessDenied | User: arn:aws:iam::account:user/username is not authorized to perform: cloudtrail:LookupEvents with an explicit deny in an identity-based policy || 2019-10-29 06:41:48.000 UTC | 14e5e77c-f682-45e1-8c88-12d15af293dd | cloudtrail.amazonaws.com | LookupEvents | AccessDenied | User: arn:aws:iam::account:user/username is not authorized to perform: cloudtrail:LookupEvents because no identity-based policy allows the cloudtrail:LookupEvents action |Note: CloudTrail event outputs can take up to 15 minutes to deliver results.5.    Optionally, get errors for all users by removing this line from the example query:AND userIdentity.arn = 'your-arn'6.    Optionally, get all errors from a selected time period by removing this line from the example query:AND (lower(errorCode) LIKE '%accessdenied%' OR lower(errorCode) LIKE '%unauthorized%')Option 2: Use the AWS CLI to troubleshoot IAM permission API call failuresNote: This AWS CLI script requires the jq command line JSON processor. For the tutorial and download instructions, see JSON output format. For distributions that use the yum package, run the following command:$ sudo yum install jq1.    Run the following AWS CLI command:Note: Replace your-arn with the IAM ARNs for your resources.( echo "Time,Identity ARN,Event ID,Service,Action,Error,Message";  aws cloudtrail lookup-events --start-time "2019-10-29T06:40:00Z" --end-time "2019-10-29T06:55:00Z" --query "Events[*].CloudTrailEvent" --output text \    | jq -r ". | select(.userIdentity.arn == \"your-arn\" and .eventType == \"AwsApiCall\" and .errorCode != null    and (.errorCode | ascii_downcase | (contains(\"accessdenied\") or contains(\"unauthorized\"))))    | [.eventTime, .userIdentity.arn, .eventID, .eventSource, .eventName, .errorCode, .errorMessage] | @csv") | column -t -s'",'Note: The rate of lookup requests to CloudTrail is limited to two requests per second, per account, per Region. If this limit is exceeded, a throttling error occurs.2.    This example table output lists permission errors for the identity ARN from the specified time period.Note: You can look up events that occurred in a Region from the last 90 days.Time                  Event ID                              Service                   Action        Error         Message2019-10-29T06:52:45Z  0406f0c1-47a8-4f71-8a94-18267b84042a  cloudtrail.amazonaws.com  LookupEvents  AccessDenied  User: arn:aws:iam::account:user/username is not authorized to perform: cloudtrail:LookupEvents with an explicit deny in an identity-based policy2019-10-29T06:41:48Z  14e5e77c-f682-45e1-8c88-12d15af293dd  cloudtrail.amazonaws.com  LookupEvents  AccessDenied  User: arn:aws:iam::account:user/username is not authorized to perform: cloudtrail:LookupEvents because no identity-based policy allows the cloudtrail:LookupEvents action3.    (Optional) get errors for all users by removing this line:.userIdentity.arn == \"your-arn\" and4.    (Optional) get all errors from the selected time period by removing this line:and (.errorCode | ascii_downcase | (contains(\"accessdenied\") or contains(\"unauthorized\")))Troubleshoot unauthorized errorsAthena and the previous AWS CLI example outputs are relevant to CloudTrail LookupEvents API calls.IAM policies that deny access because it contains a Deny statement include a specific phrase in the error message for explicit and implicit denies. IAM explicit deny errors contain the phrase "with an explicit deny in a <type> policy". IAM implicit deny errors contain the phrase "because no <type> policy allows the <action> action".The cloudtrail:LookupEvents with an explicit deny output indicates that an associated IAM policy is incorrect.An explicit deny can occur from any of these policy types. For example, identity-based policies, resource-based policies, permissions boundaries, organizations SCPs, and session policies. Explicit deny statements always override allow statements. The explicit deny exists in the IAM users identity-based policy.The cloudtrail:LookupEvents because no identity-based policy allows output indicates that the identity-based policy doesn't allow this API action resulting in an implicit deny. The identity-based policy lacks an explicit allow statement for the cloudtrail:LookupEvents API action.Policy types evaluated by AWS to establish access are:AWS Organizations SCPsResource-based policiesIAM permissions boundariesSession policiesIdentity-based policiesFor additional information about how IAM policies are evaluated and managed, see Policy evaluation logic and Managing IAM policies.Related informationPolicies and permissions in IAMTroubleshoot IAM policiesFollow"


Question: How do I reset the master user password for my Amazon RDS DB instance?

I want to reset the master user password for my Amazon Relational Database Service (Amazon RDS) DB instance. How can I do this?

Answer: "I want to reset the master user password for my Amazon Relational Database Service (Amazon RDS) DB instance. How can I do this?Short descriptionYou can change the master user password for your DB instance using the RDS console.For clustered systems, such as Amazon Aurora, reset the password for any RDS DB instance in the cluster with a Writer or Reader role. Then, choose Apply Immediately. The password change is asynchronous and applies as soon as possible. This means that the RDS DB instance doesn't require a restart.Note: Existing connections aren't dropped. However, you must provide the updated password for reconnecting.ResolutionTo modify the master user password of your DB instance, do the following:Open the Amazon RDS console.Select Databases.Select the RDS DB instance, and then choose Modify.Note: If you use Aurora, expand the cluster, and choose the instance that you want to modify. Then, choose Modify.Enter the master user password you want to use in the New Master Password field.Note: The password change is asynchronous, and applies as soon as possible. This change ignores the Apply Immediately setting.Choose Continue, and then choose Modify DB Instance.Note: In some cases, your RDS master user might lose their privileges. If this happens, reset the master user password on the DB instance to regain access and restore privileges that might have been accidentally revoked. The password can be the same one used previously or a new password.To modify the master user password using the AWS Command Line Interface (AWS CLI), use the modify-db-instance command. To modify the master user password for an Aurora cluster using AWS CLI, use the modify-db-cluster command.You can also modify an RDS DB instance using the Amazon RDS API ModifyDBInstance.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.The Status field for your RDS DB instance on the RDS dashboard changes to resetting-master-credentials. When the modification is complete, the Status column changes to Available.Related informationUsing the Apply Immediately settingWorking with parameter groupsResetting the db_owner role passwordFollow"


Question: How do I resolve an internal error when activating my Storage Gateway?

"I'm trying to activate my gateway on AWS Storage Gateway, but I'm getting an internal error."

Answer: "I'm trying to activate my gateway on AWS Storage Gateway, but I'm getting an internal error.Short descriptionA request to Storage Gateway traverses two network paths. Activation requests sent by a client connect to the gateway's virtual machine (VM) or Amazon Elastic Compute Cloud (Amazon EC2) instance over port 80. If the gateway successfully receives the activation request, then the gateway communicates with the Storage Gateway endpoints to receive an activation key. If the gateway can't reach those Storage Gateway endpoints, then the service responds to the client with an internal error message.ResolutionNote: Be sure to use the latest Amazon Machine Image (AMI) version. You'll get an internal error if you don't use the latest AMI.Be sure that you selected the right gateway type. The .ova files and AMIs for the gateway types are different and aren't interchangeable.If using a public endpoint to activate your gateway1.    Verify that you opened the required ports. For gateways deployed on-premises, check that the ports are open on your local firewall. For gateways deployed on an Amazon EC2 instance, check that the ports are open on the instance's security group. To confirm that the ports are open, run a telnet command on the public endpoint from a server. This server must be in the same subnet as the gateway. For example, the following telnet commands test the connection to port 443:telnet d4kdq0yaxexbo.cloudfront.net 443telnet storagegateway.region.amazonaws.com 443telnet dp-1.storagegateway.region.amazonaws.com 443telnet proxy-app.storagegateway.region.amazonaws.com 443telnet client-cp.storagegateway.region.amazonaws.com 443telnet anon-cp.storagegateway.region.amazonaws.com 443To confirm that the gateway itself can reach the endpoint, access the gateway's local VM console (for gateways deployed on-premises). Or, you can SSH to the gateway's instance (for gateways deployed on Amazon EC2). Then, run a network connectivity test. Confirm that the test returns [PASSED].Note: The default login user name for the gateway console is admin, and the default password is password.2.    Confirm that there's no firewall security that modifies the packets sent from the gateway to the public endpoints. The firewall security might be an SSL inspection, deep packet inspection, or in any other form. The SSL handshake fails if the SSL certificate is modified from what the activation endpoint expects. To confirm that there's no SSL inspection in progress, run an OpenSSL command on the main activation endpoint ( anon-cp.storagegateway.region.amazonaws.com) on port 443. You must run this command from a machine that's in the same subnet as the gateway:Note: Replace region with your activation Region.$ openssl s_client -connect  anon-cp.storagegateway.region.amazonaws.com:443 -servername anon-cp.storagegateway.region.amazonaws.comIf there's no SSL inspection in progress, then the command returns a response similar to the following:$ openssl s_client -connect anon-cp.storagegateway.us-east-2.amazonaws.com:443 -servername anon-cp.storagegateway.us-east-2.amazonaws.comCONNECTED(00000003)depth=2 C = US, O = Amazon, CN = Amazon Root CA 1verify return:1depth=1 C = US, O = Amazon, OU = Server CA 1B, CN = Amazonverify return:1depth=0 CN = anon-cp.storagegateway.us-east-2.amazonaws.comverify return:1---Certificate chain 0 s:/CN=anon-cp.storagegateway.us-east-2.amazonaws.com   i:/C=US/O=Amazon/OU=Server CA 1B/CN=Amazon 1 s:/C=US/O=Amazon/OU=Server CA 1B/CN=Amazon   i:/C=US/O=Amazon/CN=Amazon Root CA 1 2 s:/C=US/O=Amazon/CN=Amazon Root CA 1   i:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2 3 s:/C=US/ST=Arizona/L=Scottsdale/O=Starfield Technologies, Inc./CN=Starfield Services Root Certificate Authority - G2   i:/C=US/O=Starfield Technologies, Inc./OU=Starfield Class 2 Certification Authority---If there is an ongoing SSL inspection, then the response shows an altered certificate chain, similar to the following:$ openssl s_client -connect  anon-cp.storagegateway.ap-southeast-1.amazonaws.com:443 -servername anon-cp.storagegateway.ap-southeast-1.amazonaws.comCONNECTED(00000003)depth=0 DC = com, DC = amazonaws, OU = AWS, CN = anon-cp.storagegateway.ap-southeast-1.amazonaws.comverify error:num=20:unable to get local issuer certificateverify return:1depth=0 DC = com, DC = amazonaws, OU = AWS, CN = anon-cp.storagegateway.ap-southeast-1.amazonaws.comverify error:num=21:unable to verify the first certificateverify return:1---Certificate chain 0 s:/DC=com/DC=amazonaws/OU=AWS/CN=anon-cp.storagegateway.ap-southeast-1.amazonaws.com   i:/C=IN/O=Company/CN=Admin/ST=KA/L=New town/OU=SGW/emailAddress=admin@company.com---The activation endpoint accepts SSL handshakes only if it recognizes the SSL certificate. This means that the gateway's outbound traffic to the endpoints must be exempt from inspections performed by firewalls in your network. These inspections might be an SSL inspection or a deep packet inspection.3.    Confirm that your gateway is synchronizing time properly. Excessive time skews can cause SSL handshake errors. Use the gateway's local VM console to check your gateway's time synchronization. The time skew should be no larger than 60 seconds.Note: The System Time Management option isn't available on gateways that are hosted on an EC2 instance. Confirm that the instance can connect to the NTP server pool list over ports UDP and TCP 123:0.amazon.pool.ntp.org1.amazon.pool.ntp.org2.amazon.pool.ntp.org3.amazon.pool.ntp.orgIf using an Amazon Virtual Private Cloud (Amazon VPC) endpoint to activate your gateway1.    Verify that you opened therequired ports within your local firewall (for gateways deployed on-premises) or security group (for gateways deployed in Amazon EC2). The ports required for connecting a gateway to a Storage Gateway VPC endpoint differ from those required when connecting a gateway to public endpoints. The following ports are required for connecting to a Storage Gateway VPC endpoint:TCP 443TCP 1026TCP 1027TCP 1028TCP 1031TCP 2222Additionally, check the security group that's attached to your Storage Gateway VPC endpoint. The default security group attached to the endpoint might not allow the required ports. Create a new security group that allows traffic from your gateway's IP address range over the required ports. Then, attach that security group to the VPC endpoint.Note: Use the Amazon VPC console to verify the security group that's attached to the VPC endpoint. View your Storage Gateway VPC endpoint from the console, and then choose the Security Groups tab.To confirm that the required ports are open, run telnet commands on the Storage Gateway VPC Endpoint. You must run these commands from a server that's in the same subnet as the gateway. You can run the tests on the first DNS name that doesn't specify an Availability Zone. For example, the following telnet commands test the required port connections using the DNS name vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:telnet vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com 443telnet vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com 1026telnet vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com 1027telnet vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com 1028telnet vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com 1031telnet vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com 22222.    Confirm that there's no firewall security that modifies packets sent from the gateway to your Storage Gateway VPC endpoint. The firewall security might be an SSL inspection, deep packet inspection, or in any other form. The SSL handshake fails if the SSL certificate is modified from what the activation endpoint expects. To confirm that there's no SSL inspection in progress, run an OpenSSL command on your Storage Gateway VPC endpoint. You must run this command from a machine that's in the same subnet as the gateway. Run the command for each required port:$ openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:443 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com$ openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:1026 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com$ openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:1027 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com$ openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:1028 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com$ openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:1031 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com$ openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:2222 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.comIf there's no SSL inspection in progress, the command returns a response similar to the following:openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:1027 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.comCONNECTED(00000005)depth=2 C = US, O = Amazon, CN = Amazon Root CA 1verify return:1depth=1 C = US, O = Amazon, OU = Server CA 1B, CN = Amazonverify return:1depth=0 CN = anon-cp.storagegateway.us-east-1.amazonaws.comverify return:1---Certificate chain 0 s:CN = anon-cp.storagegateway.us-east-1.amazonaws.com   i:C = US, O = Amazon, OU = Server CA 1B, CN = Amazon 1 s:C = US, O = Amazon, OU = Server CA 1B, CN = Amazon   i:C = US, O = Amazon, CN = Amazon Root CA 1 2 s:C = US, O = Amazon, CN = Amazon Root CA 1   i:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2 3 s:C = US, ST = Arizona, L = Scottsdale, O = "Starfield Technologies, Inc.", CN = Starfield Services Root Certificate Authority - G2   i:C = US, O = "Starfield Technologies, Inc.", OU = Starfield Class 2 Certification Authority---If there is an ongoing SSL inspection, the response shows an altered certificate chain, similar to the following:openssl s_client -connect vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.com:1027 -servername vpce-1234567e1c24a1fe9-62qntt8k.storagegateway.us-east-1.vpce.amazonaws.comCONNECTED(00000005)depth=2 C = US, O = Amazon, CN = Amazon Root CA 1verify return:1depth=1 C = US, O = Amazon, OU = Server CA 1B, CN = Amazonverify return:1depth=0 DC = com, DC = amazonaws, OU = AWS, CN = anon-cp.storagegateway.us-east-1.amazonaws.comverify error:num=21:unable to verify the first certificateverify return:1---Certificate chain 0 s:/DC=com/DC=amazonaws/OU=AWS/CN=anon-cp.storagegateway.us-east-1.amazonaws.com   i:/C=IN/O=Company/CN=Admin/ST=KA/L=New town/OU=SGW/emailAddress=admin@company.com---The activation endpoint accepts SSL handshakes only if it recognizes the SSL certificate. This means that the gateway's outbound traffic to your VPC endpoint over required ports is exempt from inspections performed by your network firewalls. These inspections might be SSL inspections or deep packet inspections.3.    Confirm that your gateway is synchronizing time properly. Excessive time skews can cause SSL handshake errors. Use the gateway's local VM console to check your gateway's time synchronization. The time skew should be no larger than 60 seconds.Note: The System Time Management option isn't available on gateways that are hosted on an EC2 instance. Confirm that the instance can connect to theNTP server pool list over ports UDP and TCP 123:0.amazon.pool.ntp.org1.amazon.pool.ntp.org2.amazon.pool.ntp.org3.amazon.pool.ntp.org4.    Before activation, check if you have an HTTP proxy on Amazon EC2 configured on the on-premises gateway VM as a Squid proxy on port 3128. In this case, confirm the following:The security group attached to the HTTP proxy on Amazon EC2 must have an inbound rule. This inbound rule must allow Squid proxy traffic on port 3128 from the gateway VM's IP address.The security group attached to the Storage Gateway VPC endpoint must have inbound rules. These inbound rules must allow traffic on ports 1026-1028, 1031, 2222, and 443 from the IP address of the HTTP proxy on Amazon EC2.If using a public endpoint to activate your gateway when there is a Storage Gateway VPC endpoint in the same VPCConfirm that the Enable Private DNS Name setting isn't enabled on your Storage Gateway VPC endpoint. If this setting is enabled, you can't activate any gateways from that VPC to the public endpoint. Follow these steps to disable the private DNS name option:Open the Amazon VPC console.In the navigation pane, choose Endpoints.Choose your Storage Gateway VPC endpoint.Choose Actions.Choose Manage Private DNS Names.For Enable Private DNS Name, clear Enable for this Endpoint.Choose Modify Private DNS Names to save the setting.Related informationPrivate DNS for interface endpointsFollow"


Question: How can I avoid DNS resolution failures with an Amazon EC2 Linux instance?

I want to avoid DNS resolution failures with Amazon Elastic Compute Cloud (Amazon EC2) Linux instances.

Answer: "I want to avoid DNS resolution failures with Amazon Elastic Compute Cloud (Amazon EC2) Linux instances.Short descriptionTo decrease CPU and network usage and avoid DNS resolution failures, apply a DNS cache.If you're using a DNS cache to query external DNS resources, then the cache answers most of the recurring DNS queries locally. The cache does this without interacting with the DNS resolver over the network. Examples of external DNS resources that you can query include the following:Amazon Relational Database Service (Amazon RDS)Amazon ElastiCacheAmazon Simple Storage Service (Amazon S3)The following procedure applies to all versions of Amazon Linux. If you're using another distribution, select the documentation for your distribution from the following list:For Debian, see Local caching on the debian.org website.For Ubuntu, see Local DNS cache on the Ubuntu website.For RHEL, see How to configure DNS caching server with dnsmasq in RHEL on the Red Hat customer portal.ResolutionSet up a local DNS cache using dnsmasqSet up a local DNS cache, using dnsmasq (a DHCP and cache DNS server). For an overview of dnsmasq, see the dnsmasq documentation.1.    Install the dnsmasq server by running the following command:sudo yum install -y dnsmasq2.    Create a dedicated system user to run dnsmasq using the following commands:sudo groupadd -r dnsmasqsudo useradd -r -g dnsmasq dnsmasqNote: dnsmasq typically runs as the root user, but drops root privileges after startup by changing to another user (by default, the user is "nobody").3.    Create a copy of the dnsmasq.conf file using the following command:sudo mv /etc/dnsmasq.conf /etc/dnsmasq.conf.orig4.    Open the configuration file using a text editor (for example, vim):sudo vim /etc/dnsmasq.conf5.    Edit the /etc/dnsmasq.conf file so that it's similar to the following:# Server Configurationlisten-address=127.0.0.1port=53bind-interfacesuser=dnsmasqgroup=dnsmasqpid-file=/var/run/dnsmasq.pid# Name resolution optionsresolv-file=/etc/resolv.dnsmasqcache-size=500neg-ttl=60domain-neededbogus-priv6.    Create the /etc/resolv.dnsmasq file, and then set the Amazon DNS server or the custom domain-name-servers that you specified on DHCP options sets:sudo bash -c "echo 'nameserver 169.254.169.253' > /etc/resolv.dnsmasq"Note: For more information about DNS server locations, see What is DHCP? Adjust the file /etc/resolv.dnsmasq to use the name server for that network in the following scenarios:You create an AMI from an instance with the dnsmasq cache to launch in another VPC with a different CIDR.You have a custom DNS server specified in your DHCP options.7.    Restart the dnsmasq server and set the service to start up on boot using the following commands:Amazon Linux 1sudo service dnsmasq restartsudo chkconfig dnsmasq onAmazon Linux 2sudo systemctl restart dnsmasq.servicesudo systemctl enable dnsmasq.service8.    Verify that dnsmasq is working correctly using the dig command:dig aws.amazon.com @127.0.0.1If the response is similar to the following, then the dnsmasq cache is working correctly:; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.56.amzn1 <<>> aws.amazon.com @127.0.0.1;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 25122;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;aws.amazon.com.            IN    A;; ANSWER SECTION:aws.amazon.com.        41    IN    A    54.239.31.69;; Query time: 1 msec;; SERVER: 127.0.0.1#53(127.0.0.1)...9.    Set the dnsmasq DNS cache as the default DNS resolver.Note: You must suppress the default DNS resolver provided by DHCP by changing or creating the /etc/dhcp/dhclient.conf file. For more information, see My private Amazon EC2 instance is running Amazon Linux, Ubuntu, or RHEL. How do I assign a static DNS server to the EC2 instance that persists during reboot?10.    Configure the default DNS resolver as a fallback option by using the following commands:sudo bash -c "echo 'supersede domain-name-servers 127.0.0.1, 169.254.169.253;' >> /etc/dhcp/dhclient.conf"11.    To apply the change, run the dhclient command, restart the network service, or reboot your instance:sudo dhclient-or-sudo systemctl restart network-or-sudo rebootTo verify that your instance is using the DNS cache, run the dig command:dig aws.amazon.comIf the response indicates that the server replying to your DNS request is 127.0.0.1, then the DNS cache is working correctly:; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.62.rc1.56.amzn1 <<>> aws.amazon.com;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 1028;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;aws.amazon.com.            IN    A;; ANSWER SECTION:aws.amazon.com.        55    IN    A    54.239.31.69;; Query time: 0 msec;; SERVER: 127.0.0.1#53(127.0.0.1) <<<-------...Automate dnsmasqYou can use one of the following to automate the installation and configuration of dnsmasq as a DNS resolver on Amazon Linux:AutomateDnsmasq.sh bash scriptAutomateDnsmasq.cloudinit directivesIf you want to automate the dnsmasq installation on other Linux distributions, you can use either file to make the necessary customization.Both files can run on VPC instances because they use the Amazon DNS server alternative address of 169.254.169.253.You can run either file at launch time by passing the contents of the file in the user data field. You can run the Bash script as a standalone script or with an AWS Systems Manager run command to perform the actions on an instance.To run the Bash script as a standalone script:1.    Download the script on your instance and make it executable.wget https://raw.githubusercontent.com/awslabs/aws-support-tools/master/EC2/AutomateDnsmasq/AutomateDnsmasq.shchmod +x AutomateDnsmasq.sh2.    Run the following command as a root user or use sudo.sudo ./AutomateDnsmasq.shRelated informationAmazon EC2 instance IP addressingFollow"


Question: What type of endpoint should I use for my AWS Transfer Family server?

I want to know the type of endpoint that I must use for my AWS Transfer Family server.

Answer: "I want to know the type of endpoint that I must use for my AWS Transfer Family server.ResolutionReview the following table to determine which AWS Transfer Family endpoint type best suits your use case:Endpoint typePublic endpointAmazon Virtual Private Cloud (Amazon VPC) endpoint with internal accessVPC endpoint with internet-facing accessVPC_ENDPOINT (DEPRECATED)Supported protocolsSFTPSFTP, FTP, FTPSSFTP, FTPSSFTPAccessFrom over the internet. This endpoint type doesn't require any special configuration in your VPC.From within VPC and VPC-connected environments, such as an on-premises data center over AWS Direct Connect or VPN.Over the internet and from within VPC and VPC-connected environments, such as an on-premises data center over AWS Direct Connect or VPN.From within VPC and VPC-connected environments, such as an on-premises data center over AWS Direct Connect or VPN.Static IP addressYou can’t attach a static IP address. AWS provides IP addresses that are subject to change.Private IP addresses attached to the endpoint don't change.You can attach Elastic IP addresses to the endpoint. These can be AWS-owned IP addresses or your own IP addresses (BYOIP). Elastic IP addresses attached to the endpoint don't change. Private IP addresses attached to the server also don't change.Private IP addresses attached to the endpoint don't change.Source IP allow listThis endpoint type does not support allow lists by source IP addresses. The endpoint is publicly accessible and listens for traffic over port 22.To allow access by source IP address, you can use security groups attached to the server endpoints and network access control lists (network ACLs) attached to the subnet that the endpoint is in.To allow access by source IP address, you can use security groups attached to the server endpoints and network ACLs attached to the subnet that the endpoint is in.To allow access by source IP address, you can use security groups attached to the server endpoints and network ACLs attached to the subnet that the endpoint is in.Client firewall allow listYou must allow the DNS name of the server. Because IP addresses are subject to change, avoid using IP addresses for your client firewall allow list.You can allow the private IP addresses or the DNS name of the endpoints.You can allow the DNS name of the server or the Elastic IP addresses attached to the server.You can allow the private IP addresses or the DNS name of the endpoints.Note: The VPC_ENDPOINT endpoint type is now deprecated and cannot be used to create new Servers. See Discontinuing the use of VPC_ENDPOINT to learn more.Consider the following options to increase the security posture of your AWS Transfer Family server:Use a VPC endpoint with internal access, so that the server is accessible only to clients within your VPC or VPC-connected environments such as an on-premises data center over AWS Direct Connect or VPN.To allow clients to access the endpoint over the internet and protect your server, use a VPC endpoint with internet-facing access. Then, modify the VPC's security groups to allow traffic only from certain IP addresses that host your users' clients.Use a Network Load Balancer in front of a VPC endpoint with internal access. Change the listener port on the load balancer from port 22 to a different port. This can reduce, but not eliminate, the risk of port scanners and bots probing your server, because port 22 is most commonly used for scanning. However, if you use a Network Load Balancer, you can't use security groups to allow access from source IP addresses.If you require password-based authentication and you use a custom identity provider with your server, it's a best practice that you set an aggressive password policy. It's a best practice that your password policy prevents users from creating weak passwords and limits the number of failed login attempts.Related informationCreate an internet-facing endpoint for your serverHow can I enable Elastic IP addresses on my AWS Transfer Family SFTP-enabled server endpoint?Follow"


Question: How do I clear the buffer cache or other caches without rebooting my RDS for SQL Server instance?

I want to clear the Microsoft SQL Server cache on my Amazon Relational Database Service (Amazon RDS) for Microsoft SQL Server instance. How can I do this without restarting my DB instance?

Answer: "I want to clear the Microsoft SQL Server cache on my Amazon Relational Database Service (Amazon RDS) for Microsoft SQL Server instance. How can I do this without restarting my DB instance?Short descriptionThere are multiple ways to clear the SQL Server cache, from very granular to full cache clearing. You can use the following tools to clear the cache. All of these tools are available with Database Console Commands (DBCC) for SQL Server:DBCC FREEPROCCACHE: Clears the cache by removing the entire plan cache. This command can also remove specific plans or remove cache entries tied to a resource pool.DBCC FREESYSTEMCACHE: In addition to removing elements from the plan cache, DBCC FREESYSTEMCACHE can clear other memory caches.DBCC ALTER DATABASE SCOPED CONFIGURATION: This command is available starting with SQL Server 2016.ResolutionNote: It's a best practice to test the following commands thoroughly before running them in your production environment. Testing helps identify potential issues that might occur during implementation.Identify the top five caches and the memory usedRun the following command to identify the top five caches and the memory used:SELECT TOP(5) name AS [Name],SUM(pages_kb) AS [SizeKb]FROM sys.dm_os_memory_cache_counters WITH (NOLOCK)GROUP BY nameORDER BY SizeKb DESCRemove one plan from the cache (parameter sniffing issue)Run the following command to identify the bad plan:SELECT cp.plan_handle, cp.objtype, cp.usecounts,DB_NAME(st.dbid)AS [DatabaseName], st.textFROM sys.dm_exec_cached_plans AS cp CROSS APPLY sys.dm_exec_sql_text(plan_handle) AS stWHERE st.text LIKE N'%[search string]%' OPTION (RECOMPILE);Run one of the following commands to remove the bad plan:DBCC FREEPROCCACHE (plan_handle);orALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE [plan_handle];Remove as-needed and prepared plans from the cacheIf you have too many as-needed plans in the cache, then run the following command to remove them:DBCC FREESYSTEMCACHE ('SQL Plans')Clear the plan cache for the current databaseIf you're running SQL Server 2016 or higher, then run the following command:ALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE;orDBCC FREESYSTEMCACHE('DatabaseName')If you're using a SQL Server version prior to SQL 2016, then run the following command:declare @dbid int = (select DB_ID())DBCC FLUSHPROCINDB (@dbid);Clear all cachesDBCC FREESYSTEMCACHE('ALL')orDBCC FREEPROCCACHE WITH NO_INFOMSGS;Note: The DBCC DROPCLEANBUFFERS command is used to clear all caches and the buffer pool. This command isn't supported in Amazon RDS for SQL Server because it requires membership in the sysadmin fixed server role.Follow"


Question: How can I troubleshoot high latency on an Amazon DynamoDB table?

I'm seeing an increase in the response time for Amazon DynamoDB requests.

Answer: "I'm seeing an increase in the response time for Amazon DynamoDB requests.ResolutionTo troubleshoot high latency on your DynamoDB table, analyze the Amazon CloudWatch metric SuccessfulRequestLatency, and check the average latency. Occasional spikes in latency aren't a cause for concern. However, if average latency is high, there might be an underlying issue that you must resolve.To get the latency value for all DynamoDB calls, turn on latency metric logging for the AWS SDK. These metrics can help you identify the source of the increased latency. Keep in mind that DynamoDB latency metrics measure activity only within DynamoDB or Amazon DynamoDB Streams. The latency metrics don't take network latency or client-side activity into account.Note: For most atomic operations, such as GetItem and PutItem, you can expect an average latency in single-digit milliseconds. Latency for non-atomic operations, such as Query and Scan, depends on many factors, including the size of the result set and the complexity of the query conditions and filters.Consider one or more of the following strategies to reduce latency:Reduce the request timeout settings: Tune the client SDK parameters requestTimeOut and clientExecutionTimeout to timeout and fail much faster (for example, after 50 milliseconds). This causes the client to abandon high latency requests after the specified time period and then send a second request that usually completes much faster than the first. For more information about timeout settings, see Tuning AWS Java SDK HTTP request settings for latency-aware Amazon DynamoDB applications.Reduce the distance between the client and DynamoDB endpoint: If you have globally dispersed users, consider using global tables. With global tables, you can specify the AWS Regions where you want the table to be available. This can significantly reduce latency for your users. Also, consider using the DynamoDB gateway endpoint to avoid traffic across the internet.Use caching: If your traffic is read heavy, consider using a caching service, such as Amazon DynamoDB Accelerator (DAX). DAX is a fully managed, highly available, in-memory cache for DynamoDB that delivers up to a 10x performance improvement, from milliseconds to microseconds, even at millions of requests per second.Send constant traffic or reuse connections: When you're not making requests, consider having the client send dummy traffic to a DynamoDB table. Or, you can reuse client connections or use connection pooling. All these techniques keep internal caches warm that helps keep latency low.Use eventually consistent reads: If your application doesn't require strongly consistent reads, consider using eventually consistent reads. Eventually consistent reads are cheaper and are less likely to experience high latency. For more information, see Read consistency.Related informationEnabling metrics for the AWS SDK for JavaFollow"


Question: How do I troubleshoot Lambda function provisioned concurrency issues?

"I configured provisioned concurrency for my AWS Lambda function, but it’s not working."

Answer: "I configured provisioned concurrency for my AWS Lambda function, but it’s not working.ResolutionLambda functions that you configure with provisioned concurrency might fail to deploy and receive the "FUNCTION_ERROR_INIT_FAILURE" error.The following reasons are possible causes for failure after you set up provisioned concurrency for your Lambda function:You might be invoking the Lambda function with the $LATEST version of Lambda instead of the version with configured provisioned concurrency.All provisioned concurrency is in use, so your Lambda function is invoked with standard concurrency. This causes cold starts.Your account has exceeded its burst limit.There are missing or mismatched environment variables or issues with the Lambda function code.Follow these steps to troubleshoot issues with provisioned concurrency:1.    Verify that the Lambda function that you use to configure provisioned concurrency isn’t set to $LATEST. Unpublished versions of Lambda functions don’t support provisioned concurrency.For more information, see Lambda function versions and Configuring provisioned concurrency.2.    In your Lambda function configuration, verify that your provisioned concurrency displays the Ready status.3.    Use Amazon CloudWatch to review all logs that your function's code generates to identify potential issues. For more information, see Accessing Amazon CloudWatch Logs for AWS Lambda.4.    On the Metrics page of the CloudWatch console, check the ProvisionedConcurrencySpilloverInvocations metric. This metric shows the number of times your Lambda function runs with standard concurrency when all provisioned concurrency is being used.For more information about provisioned concurrency metrics, see Working with Lambda function metrics and review the Using invocation metrics section.5.    Deploy the function without configuring provisioned concurrency. Then, test the Lambda function.6.    Check if reserved concurrency is configured for the Lambda function. Reserved concurrency limits a function’s ability to scale up.7.    If you still can’t resolve the issue, then open a case with AWS Support. Provide the following information in the case:The Lambda function ARN.The workflow on the Lambda function setup with all included services.Details about whether the issue is intermittent or continuous.Complete CloudWatch logs in .txt format from when the issue occurred. These CloudWatch logs are used to identify Lambda function errors that include timeout issues, init durations, and permissions issues.The exact timestamp of the issue with the time zone or timestamp in UTC.Note: AWS Support representatives don’t have access to customer CloudWatch logs due to security and privacy reasons.For more troubleshooting information, see Lambda: Cold starts with provisioned concurrency.Note: Unlike reserved concurrency, you incur additional costs when you use provisioned concurrency. See AWS Lambda pricing for details about provisioned concurrency costs. To keep provisioned concurrency costs low, consider scheduling provisioned concurrency usage for your organization. For more information, see Scheduling AWS Lambda provisioned concurrency for recurring peak usage.Related informationProvisioned concurrency for Lambda functionsTypes of metricsTroubleshoot invocation issues in LambdaScheduling AWS Lambda provisioned concurrency for recurring peak usageFollow"