Question: How can I troubleshoot high latency on DynamoDB Accelerator (DAX) clusters?

My read or write requests in Amazon DynamoDB Accelerator (DAX) experience high latency. How do I troubleshoot this?

Answer: "My read or write requests in Amazon DynamoDB Accelerator (DAX) experience high latency. How do I troubleshoot this?ResolutionThere are multiple reasons why you might receive latency in your requests. Refer to each of the potential issues below to troubleshoot your latency.The cluster or node is experiencing high loadLatency is often caused by a cluster or node that's experiencing a high load on the DAX cluster. This latency can be impacted further if you have your client configured to a single node URL instead of the cluster URL. In this case, if the node is suffering any issue during a high load, then the client requests suffer latency or throttling.To resolve latency and throttling caused by a high load on single clusters or nodes, use horizontal scaling or vertical scaling.Misconfiguration in the DAX clientIf you lower the withMinIdleConnectionSize parameter, then latency across the DAX cluster is likely to increase. This parameter sets the minimum number of idling connections with the DAX cluster. For every request, the client will use an available idle connection. If a connection isn't available, then the client establishes a new one. For example, if the parameter is set to 20, then there is a minimum of 20 idle connections with the DAX cluster.The client maintains a connection pool. When an application makes an API call to DynamoDB or DAX, the client leases a connection from the connection pool. Then, the client makes the API call and returns the connection to the pool. However, the connection pool has an upper limit. If you make a large number of API calls to DAX at once, then they might exceed the limit of the connection pool. In this case, some requests must wait for other requests to complete before obtaining leases from the connection pool. This results in requests queuing up at the connection pool level. As a result, the application experiences an increase in round-trip latency.Therefore, to decrease periodic traffic spikes in your application, adjust the parameters setMinIdleConnectionSize, getMinIdleConnectionSize, and withMinIdleConnectionSize. These parameters play a key role in the latency of a DAX cluster. Configure them for your API calls so that DAX uses an appropriate number of idling connections without the need to reestablish new connections.Missed items in the cacheIf a read request misses an item, then DAX sends the request to DynamoDB. DynamoDB processes the requests using eventually consistent reads and then returns the items to DAX. DAX stores them in the item cache and then returns them to the application. Latency in the underlying DynamoDB table can cause latency in the request.Cache misses commonly happen for two reasons:1.    Strongly consistent reads: Strongly consistent reads for the same item aren't cached by DAX. This results in a cache miss because the entries bypass DAX and are retrieved from the DynamoDB table itself. You can use eventually consistent reads to solve this issue, but note that DynamoDB must first read the data for the data to be cached.2.    Eviction policy in DAX: Queried data that's already evicted from the cache results in a miss. DAX uses three different values to determine cache evictions:DAX clusters use a Least Recently Used (LRU) algorithm to prioritize items. Items with the lowest priority are evicted when the cache is full.DAX uses a Time-to-Live (TTL) value for the period of time that items are available in the cache. After an item's TTL value is exceeded, the item is evicted.Note: If you're using the default TTL value of five minutes, then check to see if you're querying the data after the TTL time.DAX uses write-through functionality to evict older values as new values are written. This helps keep the DAX item cache consistent with the underlying data store, using a single API call.To extend the TTL value of your items, see Configuring TTL settings.Note: You can't modify a parameter group while it's in use in a running DAX instance.Cache misses can also occur when maintenance patching is applied to a DAX cluster. Use multiple node clusters to reduce this downtime.Maintenance windowsLatency might occur during the weekly maintenance window, especially if there are software upgrades, patches, or system changes to the cluster's nodes. In most cases, requests are handled successfully by other available nodes that aren't undergoing maintenance. A cluster with a high number of requests during heavy maintenance can experience failure.To reduce chances of latency or failure, configure the maintenance window to your off-peak hour. Do so allows the cluster to upgrade during a period of lighter request load.Latency in the DynamoDB tableWith write operations, data is first written to the DynamoDB table and then to the DAX cluster. The operation is successful only if the data is successfully written to both the table and to DAX. Latency in the underlying DynamoDB table can cause latency in the request. To reduce this latency, see How can I troubleshoot high latency on an Amazon DynamoDB table?To further configure DynamoDB to your application's latency requirements, see Tuning AWS Java SDK HTTP request settings for latency-aware Amazon DynamoDB applications.Request timeout periodThe parameter setIdleConnectionTimeout determines the timeout period for idle connections, and setConnectTimeout determines the timeout period for connections with the DAX cluster. These two parameters deal with timeouts of the connection pools, which can affect the latency of your cluster.Configure the request timeout for connections with the DAX cluster by adjusting the setRequestTimeout parameter. For more information, see setRequestTimeout in the DAX documentation.It's also a best practice to use exponential backoff retries, which reduce request errors and also operational costs.Note: DAX doesn't support latency of the cluster in CloudWatch Metrics.Follow"


Question: How do I check if resource record sets in my Route 53 public hosted zone are accessible from the internet?

I created a public hosted zone in Amazon Route 53 and added resource record sets in it. How do I verify that my resource record sets are reachable from the internet?

Answer: "I created a public hosted zone in Amazon Route 53 and added resource record sets in it. How do I verify that my resource record sets are reachable from the internet?Short descriptionCheck whether your resource record sets are accessible from the internet using one of the following methods:The Route 53 checking toolThe dig tool (for Linux, Unix, or Mac)The nslookup tool (for Windows)Note: The steps in this article verify that the public hosted zone is created successfully and accessible. If you want your entire domain resolvable, then verify the following:Update the domain registration to use Amazon Route 53 name serversUpdate the NS records to use Route 53 name serversResolutionMethod 1: Use the Route 53 checking toolUse the Route 53 checking tool to see how Route 53 responds to DNS queries.Method 2: Use the dig tool (for Linux, Unix, or Mac)1.    Find the four authoritative name servers for your public hosted zone.2.    In your resource record set’s configuration, find the associated domain name (Name), record type (Type), and value (Value).3.    Query one of the authoritative name servers. In your command line argument, specify the authoritative name server and the resource record set's domain name and record type. For example:$ dig @ns-###.awsdns-##.com  mailserver1.example.com  MX$ dig @ns-###.awsdns-##.com  _text_.example.com  TXT$ dig @ns-###.awsdns-##.com  cname.example.com  CNAME$ dig @ns-###.awsdns-##.com  subdomain.example.com  NS$ dig @ns-###.awsdns-##.com  www.example.com  ANote: The syntax for dig varies between Linux distributions. Use man dig to find the correct syntax for your particular distribution.4.    Review the output and verify that the ANSWER SECTION matches your resource record set.For example, if:Record name = mailserver1.example.comType = MXValue = inbound-smtp.mailserver1.example.comthen the correct dig output is:;; ANSWER SECTION:MAILSERVER1.EXAMPLE.COM    300    IN    MX    10    inbound-smtp.mailserver1.example.com.Method 3: Use the nslookup tool (for Windows)1.    Open the Windows Command Prompt.2.    Run the following command: nslookup. The output looks similar to this:C:\Users\Administrator>nslookupDefault Server: ip-172-31-0-2.ap-southeast-2.compute.internalAddress: 172.31.0.23.    Specify the resource record set type using set type=A:Note: You can also add any other required resource record type.set type=A4.    Specify one of the Route 53 name servers (NS) from the hosted zone (HZ) to query. In this example, enter server ns-1276.awsdns-31.org. The output looks similar to this:server ns-1276.awsdns-31.orgDefault Server: ns-1276.awsdns-31.orgAddresses: 2600:9000:5304:fc00::1205.251.196.2525.    Enter the record to query. For example, "aws.amazondomains.com". The query is done against the server specified earlier:aws.amazondomains.comServer: ns-1276.awsdns-31.orgAddresses: 2600:9000:5304:fc00::1205.251.196.2526.    The response is returned by the Route 53 NS:Name: aws.amazondomains.comAddress: 1.1.1.1Related informationChecking DNS responses from Route 53Follow"


Question: How do I edit my Amazon SNS topic's access policy?

I want to allow other AWS Identity and Access Management (IAM) entities to access to my Amazon Simple Notification Service (Amazon SNS) topic. How do I edit my Amazon SNS topic's access policy to grant the required permissions?

Answer: "I want to allow other AWS Identity and Access Management (IAM) entities to access to my Amazon Simple Notification Service (Amazon SNS) topic. How do I edit my Amazon SNS topic's access policy to grant the required permissions?ResolutionTo edit your Amazon SNS topic's access policy using the Amazon SNS console1.    Open the Amazon SNS console.2.    In the left navigation pane, choose Topics.3.    Choose your Amazon SNS topic's name.4.    Choose the Edit button.5.    Expand the Access policy - optional section.6.    Edit the access policy to grant the required permissions for your use case.Note: For more information on how to write access policies, see Overview of managing access in Amazon SNS.7.    Choose Save Changes.To edit your Amazon SNS topic's access policy using the AWS CLINote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.To modify, add, or remove permissions, run the following SetTopicAttributes command:Important: Replace <TopicARN> with your topic's Amazon Resource Name (ARN). Replace testpolicy.json with the path to your policy document.aws sns set-topic-attributes --topic-arn '<TopicARN>' --attribute-name 'Policy' --attribute-value file://testpolicy.json-or-To add permissions only, run the following AddPermission command:Important: Replace <TopicARN> with your topic's ARN. Replace AllowProdAccountsXXX with a unique identifier for the new policy statement. Replace AWS Account ID with the account IDs of the IAM entities that you want to allow access to specific actions. Replace Publish and Subscribe with the list of actions that you want to allow for the specified IAM entities.sns add-permission  --topic-arn '<TopicARN>' --label 'AllowProdAccountsXXX' --aws-account-id 'AWS Account ID' --action-name 'Publish' 'Subscribe'Related informationExample cases for Amazon SNS access controlActions, resources, and condition keys for Amazon SNSFollow"


Question: Why can't I delete an AWS Config rule?

"I can't delete my AWS Config rule, or I receive an error similar to the following:"An error has occurred with AWS Config.""

Answer: "I can't delete my AWS Config rule, or I receive an error similar to the following:"An error has occurred with AWS Config."ResolutionTo troubleshoot this issue, check the following:The AWS Identity and Access Management (IAM) entity has permissions for the DeleteConfigRule API actionOpen the IAM console, and then in the navigation pane choose Users or Roles.Choose the user or role that you used to delete the AWS Config rule, and expand Permissions policies.In the Permissions tab, choose JSON.In the JSON preview pane, confirm that the IAM policy allows permissions for the DeleteConfigRule API action.The IAM entity permission boundary allows the DeleteConfigRule API actionIf the IAM entity has a permissions boundary, be sure that it allows the DeleteConfigRule API action.Open the IAM console, and then in the navigation pane choose Users or Roles.Choose the user or role that you used to delete the AWS Config rule, expand Permissions boundary, and then choose JSON.In the JSON preview pane, confirm that the IAM policy allows permissions for the DeleteConfigRule API action.The service control policy (SCP) allows the DeleteConfigRule API actionOpen the AWS Organizations console using the management account for the organization.In Account name, choose the AWS account.In Policies, expand Service control policies and note the SCP policies that are attached.At the top of the page, choose Policies.Select the policy, and then choose View details.In the JSON preview pane, confirm that the policy allows the DeleteConfigRule API action.The rule isn't a service-linked ruleWhen you enable a security standard, AWS Security Hub creates AWS Config service-linked rules for you. You can't delete these service-linked rules using AWS Config, so the delete button is grayed out. To remove the AWS Config service-linked rules, see Disabling a security standard.No remediation actions are in progressYou can't delete AWS Config rules that have remediation actions in progress. Follow the instructions to delete the remediation action that is associated with that rule. Then, try deleting the AWS Config rule again.Important: Delete only remediation actions that are in failed or successful states.If the remediation action fails to delete, see How can I resolve the error "NoSuchRemediationConfigurationException" or "unexpected internal error" when trying to delete a remediation action in AWS Config?Related informationPermissions boundaries for IAM entitiesWhat's the difference between an AWS Organizations service control policy and an IAM policy?Service-linked AWS Config rulesManaging your AWS Config rulesFollow"


Question: Why is my Reserved Instance showing as "Retired" in the console?

"I'm not getting the billing benefit of a Reserved Instance (RI), and the RI is displayed as "Retired" in the console."

Answer: "I'm not getting the billing benefit of a Reserved Instance (RI), and the RI is displayed as "Retired" in the console.ResolutionRIs appear as retired in the Billing and Cost Management console for the following reasons:The RI term expired. After the term expires, you no longer receive the billing benefit or capacity reservation, and the RI is marked as retired in the console.The upfront charge for the RI wasn't processed successfully, and a new billing period has started. If the upfront charge for the RI isn't processed successfully, the charge remains in the payment-pending state until it's retried successfully. If the charge is in the payment-pending state and a new billing period starts, then the RI moves to the retired state, and the upfront charge can't be retried.The RI was modified. When an RI is modified, the old RI is marked as retired in the console.You sold the RI on the RI Marketplace. After the RI is sold, it is marked as retired in the console.RIs in the retired state can't be activated, but you can purchase a new RI with the same configuration.Related informationAmazon EC2 Reserved InstancesAmazon RDS Reserved InstancesFollow"


Question: Why isn't CloudFront serving my domain name over HTTPS?

"I associated an SSL certificate with my Amazon CloudFront distribution, but I can't access my domain name over HTTPS. Why?"

Answer: "I associated an SSL certificate with my Amazon CloudFront distribution, but I can't access my domain name over HTTPS. Why?ResolutionTo resolve problems with accessing your domain name over HTTPS, check the following:Your SSL certificate's domain name must be added as an alternate domain name (CNAME) in your CloudFront distribution's settings. For more information, see Using custom URLs for files by adding alternate domain names (CNAMEs).The domain name of the SSL certificate must be consistent with the domain name associated with the CloudFront distribution. For example, if you issue an SSL certificate for *.example.com, then the CloudFront distribution will support domain names such as abc.example.com or 123.example.com. However, an SSL certificate for *.example.com won't support domain names such as abc.123.example.com. To use abc.123.example.com as a domain name, you need an SSL certificate for either *.123.example.com or abc.123.example.com.If you're getting cipher or TLS version mismatch errors, verify that your client is using supported SSL or TLS protocols and ciphers. This allows communication between viewers and CloudFront.Verify that the status of your CloudFront distribution is Deployed. If the status is still InProgress, then you might not be able to access the domain name because data is still propagating across edge locations.If you recently updated your SSL certificate on AWS Certificate Manager, then verify that the certificate renewal status is Success. It might take several hours for the certificate renewal process to complete. For more information, see I renewed my Amazon-issued SSL certificate or reimported my certificate to ACM. Why does CloudFront still show the old certificate?For more information on troubleshooting SSL errors, see SSL/TLS negotiation failure between CloudFront and a custom origin server.Related informationUsing HTTPS with CloudFrontFollow"


Question: How can I copy data to and from Amazon EFS in parallel to maximize performance on my EC2 instance?

I have a large number of files to copy or delete. How can I run these jobs in parallel on an Amazon Elastic File System (Amazon EFS) file system on my Amazon Elastic Compute Cloud (Amazon EC2) instance?

Answer: "I have a large number of files to copy or delete. How can I run these jobs in parallel on an Amazon Elastic File System (Amazon EFS) file system on my Amazon Elastic Compute Cloud (Amazon EC2) instance?Short descriptionUse one of the following tools to run jobs in parallel on an Amazon EFS file system:GNU parallel – For more information, see GNU Parallel on the GNU Operating System website.msrsync – For more information, see msrsync on the GitHub website.fpsync – For more information, see fpsyncon the Ubuntu manuals website.ResolutionGNU parallel1.    Install GNU parallel.For Amazon Linux and RHEL 6:$ sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm$ sudo yum install parallel nload -yFor RHEL 7:$ sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm$ sudo yum install parallel nload -yFor Amazon Linux 2:$ sudo amazon-linux-extras install epel$ sudo yum install nload sysstat parallel -yFor Ubuntu:$ sudo apt-get install parallel2.    Use rsync to copy the files to Amazon EFS.$ sudo time find -L /src -type f | parallel rsync -avR {} /dstor$ sudo time find /src -type f | parallel -j 32 cp {} /dst3.    Use the nload console application to monitor network traffic and bandwidth.$ sudo nload -u Mmsrsyncmsrsync is a Python wrapper for rsync that runs multiple rsync processes in parallel.Note: msrsync is compatible only with Python 2. You must run the msrsync script using Python version 2.7.14 or later.1.    Install msrsync.$ sudo curl -s https://raw.githubusercontent.com/jbd/msrsync/master/msrsync -o /usr/local/bin/msrsync && sudo chmod +x /usr/local/bin/msrsync2.    Use the-p option to specify the number of rsync processes that you want to run in parallel. ReplaceX with the number of rsync processes. The P option shows the progress of each job.$ sudo time /usr/local/bin/msrsync -P -p X --stats --rsync "-artuv" /src/ /dst/fpsyncThe fpsync tool synchronizes directories in parallel using fpart and rsync. It can run several rsync processes locally or launch rsync transfers on several nodes (workers) through SSH.For more information on fpart, see fpart on the Ubuntu manuals website.1.    Enable the EPEL repository, and then install the fpart package.For Amazon Linux and RHEL 6:$ sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-6.noarch.rpm$ sudo yum install fpart -yFor RHEL 7:$ sudo yum install -y https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpm$ sudo yum install fpart -yFor Amazon Linux 2:$ sudo amazon-linux-extras install epel$ sudo yum install fpart -yFor Ubuntu:$ sudo apt-get install fpartNote: In Ubuntu, fpsync is part of the fpart package.2.    Use fpsync to synchronize the /dst and /src directories. Replace X with the number of rsync processes that you want to run in parallel.$ sudo fpsync -n X /src /dstFollow"


Question: Why are my mobile text message (SMS) charges higher than expected from Amazon SNS and Amazon Pinpoint?

"I was charged more than I expected for mobile text messaging (SMS) through Amazon Simple Notification Service (Amazon SNS) and Amazon Pinpoint. Why are my SMS charges higher than expected? Also, what's the best way to calculate my required SMS spending quota for Amazon SNS and Amazon Pinpoint?"

Answer: "I was charged more than I expected for mobile text messaging (SMS) through Amazon Simple Notification Service (Amazon SNS) and Amazon Pinpoint. Why are my SMS charges higher than expected? Also, what's the best way to calculate my required SMS spending quota for Amazon SNS and Amazon Pinpoint?ResolutionAmazon SNS and Amazon Pinpoint SMS charges can be higher than expected if messages exceed the message parts per second (MPS) limits.For more information, see SMS character limits in Amazon Pinpoint. Also, Publishing to a mobile phone in the Amazon SNS Developer Guide.To calculate your required SMS spending quota for Amazon SNS and Amazon PinpointFollow the instructions in the Calculate your required SMS spending quota section of the following article: How do I request a spending limit increase for SMS messages in Amazon SNS?Note: For Amazon SNS, you can subscribe to daily SMS usage reports to monitor your SMS deliveries. For Amazon Pinpoint, you can activate event streams to Amazon Kinesis to monitor your SMS deliveries. For more information, see SMS events in the Amazon Pinpoint Developer Guide.Related informationAmazon Pinpoint pricingWorldwide SMS pricingFollow"


Question: How do I increase the available disk space on my Amazon ECS container instances if I launched my cluster manually with an Auto Scaling group?

How do I increase the available disk space on my Amazon Elastic Container Service (Amazon ECS) container instances if I launched my Amazon ECS cluster manually with an Auto Scaling group?

Answer: "How do I increase the available disk space on my Amazon Elastic Container Service (Amazon ECS) container instances if I launched my Amazon ECS cluster manually with an Auto Scaling group?Short descriptionTo increase the storage space on your container instances, you must update the launch configuration or launch template to increase the volume size of your Amazon Elastic Block Store (Amazon EBS). Then, replace your original instances with new instances from your Auto Scaling group.To increase a container instance's storage space through this method, complete the steps below. If you launched your container instances using another method, then skip this article and complete the steps in one of the following articles:How do I increase the available disk space on my Amazon ECS container instances if I launched my ECS cluster from the AWS Management Console?How do I increase the available disk space on my Amazon ECS container instances if I launched my container instances as standalone Amazon EC2 instances?Note: Your Amazon EBS volume configuration varies depending on the Amazon ECS-optimized Amazon Machine Image (AMI) that you're using. For more information and commands on how to check the available space on your instances, see AMI storage configuration.Important: The following steps terminate the original container instances in your Amazon ECS cluster. Any data that's stored on the EBS volumes for those instances is lost when you complete these procedures.ResolutionImportant: To avoid downtime for your Amazon ECS services, you must launch replacement instances before draining your original container instances. After all the tasks stop on the original container instances, confirm that the tasks on the replacement instances started, and then terminate the original container instances.First, create an Auto Scaling group with either a launch template or launch configuration.Note: To use the latest features from Amazon Elastic Compute Cloud (Amazon EC2), it's a best practice to use launch templates instead of configurations.(Option 1) Create a new Auto Scaling group from a launch template1.    Open the Amazon EC2 console.2.    From the navigation pane, choose Auto Scaling Groups. In the Launch template/configuration column, note the name of the launch template for any ECS container instance where you want to increase disk space.3.    From the navigation pane, choose Launch Templates.4.    Select the launch template for your existing ECS container instance, choose Actions, and then choose Modify template (Create new version).5.    Under Storage (volumes), expand the details for the EBS volume and enter a value for Size (GiB).Note: For more information on volume options, see Block device mappings.6.    Choose Create template version.7.    Under Create an Auto Scaling group from your template, choose Create Auto Scaling group.8.    When creating the Auto Scaling group, make sure that you are using the new version of the template.9.    After your new instances launch, open the Amazon ECS console, and then choose Clusters.10.    To verify that the new instances appear, select your cluster, and then choose the ECS Instances tab.(Option 2) Create a new Auto Scaling group from your original launch configuration1.    Open the Amazon EC2 console.2.    From the navigation pane, choose Auto Scaling Groups. In the Launch template/configuration column, note the name of the launch template/configuration for any ECS container instance where you want to increase disk space.3.    From the navigation pane, choose Launch Configurations.4.    Select the launch configuration for your existing ECS container instance, choose Actions, and then choose Copy launch configuration.5.    To increase the size of your volume, enter a value for Size (GiB).Note: For more information on volume options, see Block device mappings.6.    Choose Create launch configuration.7.    Select the newly created launch configuration, and choose Actions. Then, choose Create Auto Scaling group.8.    After your new instances launch, open the Amazon ECS console, and then choose Clusters.9.    To verify that the new instances appear, select your cluster, and then choose the ECS Instances tab.Drain your original ECS container instances and migrate your containers to new instances1.    Open the Amazon ECS console.2.    Choose the ECS Instances tab, and then select the original container instances.3.    Choose Actions, and then choose Drain Instances.Note: You can drain the previous instances in batches to avoid downtime for your Amazon ECS services. When you drain service tasks for container instances, container instances in the RUNNING state are stopped and replaced according to the service's deployment configuration parameters minimumHealthyPercent and maximumPercent. Any PENDING or RUNNING tasks that don't belong to the service are unaffected. You must wait for these tasks to finish or stop them manually.4.    When the DRAINING instances have 0 running tasks, repeat steps 2 and 3 until all the original container instances are in DRAINING status.5.    Delete the original Auto Scaling group to terminate the original instances.6.    Your tasks are now running on the new instances with more storage available.Related informationContainer instance drainingUsing data volumes in tasksFollow"


Question: How do I resolve "EC2 is out of capacity" or "The requested number of instances exceeds your EC2 quota" errors in Amazon EMR?

"My Amazon EMR cluster fails to launch, and I get one of these error messages:"EC2 is out of capacity""The requested number of instances exceeds your EC2 quota""

Answer: "My Amazon EMR cluster fails to launch, and I get one of these error messages:"EC2 is out of capacity""The requested number of instances exceeds your EC2 quota"Resolution"EC2 is out of capacity"This error means that AWS doesn't have enough available On-Demand Instance capacity to create the Amazon Elastic Compute Cloud (Amazon EC2) instances that you specified for the EMR cluster. To resolve the issue, try the following:Specify a different instance type for the EMR cluster. A different instance type might have more available capacity.Launch your cluster in a different Availability Zone. Each Availability Zone has its own capacity.Wait a few minutes, and then try to launch the EMR cluster again. Capacity shifts frequently."The requested number of instances exceeds your EC2 quota"This error means that the number of instances that you specified for the EMR cluster exceeds a service quota. To view your Amazon EC2 service quotas, open the Amazon EC2 console and then choose Limits from the navigation pane. Keep the following in mind:Amazon EC2 service quotas are unique to each Region.Only running instances count toward your service quotas.In addition to the limit on the total number of running instances, each instance type has its own limit. For example, you might be limited to 10 running a1.4xlarge instances and 20 total running instances in US East (N. Virginia).If you need more Amazon EC2 resources, request a service quota increase. Requests are subject to review by AWS engineering teams.Related informationInsufficient instance capacityHow do I increase the service quota of my Amazon EC2 resources?Configure Amazon EC2 instancesFollow"


Question: Why did I get the error "The snapshot is currently in use by an AMI" when trying to delete my EBS snapshot?

"When I try to delete an Amazon Elastic Block Store (EBS) snapshot, I receive an error similar to the following:"snap-xxxxxxxx: The snapshot snap-xxxxxxxx is currently in use by ami-xxxxxxxx""

Answer: "When I try to delete an Amazon Elastic Block Store (EBS) snapshot, I receive an error similar to the following:"snap-xxxxxxxx: The snapshot snap-xxxxxxxx is currently in use by ami-xxxxxxxx"ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.EBS-backed Amazon Machine Images (AMIs) include EBS snapshots. If you try to delete an EBS snapshot associated with an active AMI, you receive this error.Note: Public snapshots can't be deleted. If you try to delete a public snapshot, you receive an "unknown error occurred" message.Before you attempt to delete an EBS snapshot, make sure that the AMI isn’t currently in use. You can use AMIs with a variety of AWS services, such as Amazon Elastic Compute Cloud (Amazon EC2), AWS Auto Scaling, AWS CloudFormation, and more. If you delete an AMI that’s used by another service or application, the function of that service or application might be affected.If you no longer need the EBS snapshot or its associated AMI, deregister the AMI. Then, delete the EBS snapshot in the Amazon EC2 console:Note the AMI ID in the error message.Open the Amazon EC2 console, and from the navigation pane, choose AMIs.Choose the AMI noted in the error message, and then choose Deregister from the Actions menu.Note: If you don’t see the AMI that you’re looking for, check any other AWS Regions that you might have used.Delete the EBS snapshot by using the EC2 console or the AWS CLI.Related informationDeregister your AMIDelete an Amazon EBS snapshotFollow"


Question: Why aren’t my stack-level tags propagating to resources in my CloudFormation stack?

My stack-level tags aren't propagating to resources in my AWS CloudFormation stack.

Answer: "My stack-level tags aren't propagating to resources in my AWS CloudFormation stack.Short descriptionPropagation of stack-level tags to resources can vary by resource. CloudFormation supports propagation of stack-level tags only for resources with the Tags property. For a list of AWS resources and their property types, see AWS resource and property types reference.The following examples demonstrate the difference in stack-level tag propagation between a resource that supports the Tags property, and one that doesn't.ResolutionResource that supports the Tags propertyThe resourceAWS::S3::Bucket supports the Tags property.Create a stack with the AWS::S3::Bucket resource and specify stack-level tags.After the stack is created, the S3 bucket resource has the propagated stack-level tags with the aws: prefix.Resource that doesn't support the Tags propertyAlthough the PutRule API allows you to specify tags, the AWS::Events::Rule resource doesn't support the Tags property.Create a stack with the AWS::Events::Rule resource and specify stack-level tags.After the stack is created, the Events Rule resource doesn't have the propagated stack-level tags.Search for or create an issue through GitHubIf a stack-level tag isn't propagating for a resource that supports the Tags property, then check the cloudformation-coverage-roadmap on the GitHub website to see if it's a known issue. If it isn't submitted as an issue, then choose New issue to create one.Follow"


Question: How can I set the default printer on Amazon Windows WorkSpaces and prevent the settings from reverting?

"I use Amazon Windows WorkSpaces, and I want to set a default printer for a WorkSpace. How can I do that?-or-I set a default printer for my Windows WorkSpace, but the settings don’t persist after I log off and back in to the WorkSpace. How can I fix this?"

Answer: "I use Amazon Windows WorkSpaces, and I want to set a default printer for a WorkSpace. How can I do that?-or-I set a default printer for my Windows WorkSpace, but the settings don’t persist after I log off and back in to the WorkSpace. How can I fix this?ResolutionSet a default printerDownload and install the driver for your local printer on the WorkSpace.From the WorkSpace, set the desired printer as the default printer, and then set any needed printer preferences.Install the Group Policy administrative template for PCoIP.Configure the local printer redirection.TroubleshootingIf the default printer settings aren’t preserved after logging off and back in to the WorkSpace, set the default printer on the WorkSpace. Then, follow these steps:Export a registry key containing the default printer settingFrom the Windows Start menu, choose Run.Enter Regedit, and then choose Ok.From the left navigation pane, expand HKEY_Current_User, Software, Microsoft, Windows NT, and CurrentVersion.Under CurrentVersion, open the context (right-click) menu for Windows, and then choose Export.Save the file to your desktop and name the file. Note the file name for a later step.Create a scheduled taskThe following process triggers a registry import when a user logs on.Note: The trigger might not work if users disconnect without logging off. If this happens, the user must log off, and then log back in.Open a command prompt, and then run taskschd.msc to open Task Scheduler.From the Actions panel, choose Create Basic Task.For Name, enter a task name, and then choose Next.For Trigger, select When I log on, and then choose Next.For Action, select Start a program, and then choose Next.For Program/script, enter the following, replacing username and filename.reg with your own values:regedit.exe /s D:\Users\username\Desktop\filename.regNote: Use the file name that you created when exporting the registry key.Choose Next, and then choose Yes.Select Open the Properties dialog for this task when I click Finish, and then choose Finish.On the General tab, for Security options, select Run with highest privileges.On the Triggers tab, select the At log on trigger, and then choose Edit.For Advanced settings, select Delay task for, change the value to 1 minute, and then choose Ok.On the Actions tab, select the Start a program action, and then choose Edit.For Start in (optional), enter c:\windows, and then choose Ok.Choose Ok to close the properties window.To confirm that the default printer settings persist, log off, and then log on again. It can take about a minute after logging on for the default printer to display correctly.Related informationPrint from a WorkSpaceFollow"


Question: How can I copy large amounts of data from Amazon S3 into HDFS on my Amazon EMR cluster?

I want to copy a large amount of data from Amazon Simple Storage Service (Amazon S3) to my Amazon EMR cluster.

Answer: "I want to copy a large amount of data from Amazon Simple Storage Service (Amazon S3) to my Amazon EMR cluster.Short descriptionUse S3DistCp to copy data between Amazon S3 and Amazon EMR clusters. S3DistCp is installed on Amazon EMR clusters by default. To call S3DistCp, add it as a step at launch or after the cluster is running.ResolutionTo add an S3DistCp step to a running cluster using the AWS Command Line Interface (AWS CLI), see Adding S3DistCp as a step in a cluster.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.To add an S3DistCp step using the console, do the following:1.    Open the Amazon EMR console, and then choose Clusters.2.    Choose the Amazon EMR cluster from the list, and then choose Steps.3.    Choose Add step, and then choose the following options:For Step type, choose Custom JAR.For Name, enter a name for the S3DistCp step.For JAR location, enter command-runner.jar. For more information, see Run commands and scripts on an Amazon EMR cluster.For Arguments, enter options similar to the following: s3-dist-cp --src=s3://s3distcp-source/input-data --dest=hdfs:///output-folder1.For Action on failure, choose Continue.4.    Choose Add.5.    When the step Status changes to Completed, verify that the files were copied to the cluster:$ hadoop fs -ls hdfs:///output-folder1/Note: It's a best practice to aggregate small files into fewer large files using the groupBy option and then compress the large files using the outputCodec option.TroubleshootingTo troubleshoot problems with S3DistCp, check the step and task logs.1.    Open the Amazon EMR console, and then choose Clusters.2.    Choose the EMR cluster from the list, and then choose Steps.3.    In the Log files column, choose the appropriate step log:controller: Information about the processing of the step. If your step fails while loading, then you can find the stack trace in this log.syslog: Logs from non-Amazon software, such as Apache and Hadoop.stderr: Standard error channel of Hadoop while it processes the step.stdout: Standard output channel of Hadoop while it processes the step.If you can't find the root cause of the failure in the step logs, check the S3DistCp task logs:1.    Open the Amazon EMR console, and then choose Clusters.2.    Choose the EMR cluster from the list, and then choose Steps.3.    In the Log files column, choose View jobs.4.    In the Actions column, choose View tasks.5.    If there are failed tasks, choose View attempts to see the task logs.Common errorsReducer task fails due to insufficient memory:If you see an error message similar to the following in the step's stderr log, then the S3DistCp job failed because there wasn't enough memory to process the reducer tasks:Container killed on request. Exit code is 143Container exited with a non-zero exit code 143Container [pid=19135,containerID=container_1494287247949_0005_01_000003] is running beyond virtual memory limits. Current usage: 569.0 MB of 1.4 GB physical memory used; 3.0 GB of 3.0 GB virtual memory used. Killing container.To resolve this problem, use one of the following options to increase memory resources for the reducer tasks:Increase the yarn.nodemanager.vmem-pmem-ratio or mapreduce.reduce.memory.mb parameter in the yarn-site.xml file on the cluster's master node.Add more Amazon Elastic Compute Cloud (Amazon EC2) instances to your cluster.Amazon S3 permission error:If you see an error message similar to the following in the step's stderr log, then the S3DistCp task wasn't able to access Amazon S3 because of a permissions problem:Exception in thread "main" com.amazonaws.services.s3.model.AmazonS3Exception: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: REQUEST_IDTo resolve this problem, see Permissions errors.Related informationView log filesFollow"


Question: How can I grant a user Amazon S3 console access to only a certain bucket or folder?

"I want to grant a user Amazon Simple Storage Service (Amazon S3) console access to a bucket or folder (prefix). However, I don't want the user to see other buckets in the account or other folders within the bucket."

Answer: "I want to grant a user Amazon Simple Storage Service (Amazon S3) console access to a bucket or folder (prefix). However, I don't want the user to see other buckets in the account or other folders within the bucket.Short descriptionChange a user's AWS Identity and Access Management (IAM) permissions to limit the user's Amazon S3 console access to a certain bucket or folder (prefix):1.    Remove permission to the s3:ListAllMyBuckets action.2.    Add permission to s3:ListBucket only for the bucket or folder that you want the user to access. To allow the user to upload and download objects from the bucket or folder, you must also include s3:PutObject and s3:GetObject.Resolution1.    Open the IAM console.2.    Select the IAM user or role that you want to restrict access to.3.    In the Permissions tab of the IAM user or role, expand each policy to view its JSON policy document.4.    In the JSON policy document, search for the policy that grants the user permission to the s3:ListAllMyBuckets action or to s3:* actions (all S3 actions).5.    Modify the policy to remove permission to the s3:ListAllMyBuckets action.Note: If an attached user policy allows s3:* or Full Admin access with the "*" resource, then the policy includes the s3:ListAllMyBuckets permissions. Remove the "*" resource. Then, use one of the following example policies.6.    Add permission to s3:ListBucket only for the bucket or folder that you want the user to access from the console.The following example policy is for access to an S3 bucket:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:ListBucket"      ],      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET"    },    {      "Effect": "Allow",      "Action": [        "s3:PutObject",        "s3:GetObject"      ],      "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"    }  ]}The policy allows the user to perform the s3:ListBucket, s3:PutObject, and s3:GetObject actions only on DOC-EXAMPLE-BUCKET.The following example policy grants access to a folder. The policy allows the user to perform the s3:ListBucket, s3:ListBucketVersions, s3:PutObject, s3:GetObject, and s3:GetObjectVersion actions only on folder2 within DOC-EXAMPLE-BUCKET. Use s3:ListBucketVersions, s3:GetObjectVersion and s3:GetBucketVersioning only if the bucket has versioning, and you want users to have access to prior versions of objects.{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "AllowUsersToAccessFolder2Only",      "Effect": "Allow",      "Action": [        "s3:GetObject",        "s3:GetObjectVersion",        "s3:PutObject"      ],      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/folder1/folder2/*"      ]    },    {      "Sid": "AllowListOfBucketOnlyOnPrefix",      "Effect": "Allow",      "Action": [        "s3:ListBucket",        "s3:ListBucketVersions"      ],      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET"      ],      "Condition": {        "StringLike": {          "s3:prefix": [            "folder1/folder2/*"          ]        }      }    },    {      "Sid": "AllowListVersionOnObjectDetails",      "Effect": "Allow",      "Action": [        "s3:GetBucketVersioning"      ],      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET"      ]    }  ]}7.    Provide the user with a direct console link to the S3 bucket or folder.Warning: After you change these permissions, the user gets an Access Denied error when they access the main Amazon S3 console. The user must use a direct console link to access the bucket or folder. The following link is an example of a direct console link to an S3 bucket:https://s3.console.aws.amazon.com/s3/buckets/DOC-EXAMPLE-BUCKET/The following link is an example of a direct console link to a folder:https://s3.console.aws.amazon.com/s3/buckets/DOC-EXAMPLE-BUCKET/folder1/folder2/Related informationUser policy examplesFollow"


Question: How do I shut down my Amazon Lightsail resources?

How do I remove the Amazon Lightsail resources from my AWS account?

Answer: "How do I remove the Amazon Lightsail resources from my AWS account?ResolutionTo remove all your Lightsail resources, delete your Lightsail instances and resources attached to these instances, such as static IP addresses, snapshots, or block storage.Lightsail resources are billed incrementally in hours or in fractions of GB-months. When all Lightsail resources are deleted, you receive no further billing related to Lightsail. For fees incurred for various resources, see Frequently Asked Questions in Amazon Lightsail.To delete your Lightsail resources, do the following:Delete your Amazon Lightsail instance - You stop incurring charges for the instance as soon as it's deleted.Delete a static IP in Amazon Lightsail - Static IP addresses are free while attached to an instance. Note that other resources that rely on this static IP might be impacted, such as DNS records that reference your static IP address.Delete your database in Lightsail - You stop incurring charges for the database as soon as it's deleted.Delete your domain's DNS zone in Lightsail - You stop incurring charges for your DNS as soon as you delete your Lightsail DNS zone.Delete disk snapshots in Lightsail - You need to retain only the most recent snapshot to restore an entire disk. You can reduce charges by removing outdated snapshots, or prevent charges by deleting all snapshots.Detach and delete your block storage disk in Lightsail - You must stop, or delete, your instance before you detach and delete your disk.Delete a Lightsail load balancer - Deleting a load balancer also detaches any Lightsail instances attached to it, but doesn't delete the Lightsail instances. If you activated encrypted (HTTPS) traffic using an SSL/TLS certificate, then deleting the load balancer also deletes any SSL/TLS certificates associated with the load balancer.Delete an SSL/TLS certificate - You can delete an SSL/TLS certificate that you no longer use. For example, your certificate might be expired, and you attached an updated certificate that's validated.Turn off VPC peering that you no longer need - To turn off your VPC peering, do the following:In the Lightsail console, choose Account on the navigation bar.Choose Advanced.In the VPC peering section, clear Enable VPC peering for all AWS Regions.Related informationHow do I change my Lightsail plan?Follow"


Question: How do I update my EBS volume in CloudFormation without EC2 instances being replaced?

I want to update my Amazon Elastic Block Store (Amazon EBS) volume in AWS CloudFormation without Amazon Elastic Compute Cloud (Amazon EC2) instances being replaced.

Answer: "I want to update my Amazon Elastic Block Store (Amazon EBS) volume in AWS CloudFormation without Amazon Elastic Compute Cloud (Amazon EC2) instances being replaced.Short descriptionAs a best practice, use the AWS::EC2::Volume resource type to prevent instance replacement when updating EBS volumes in CloudFormation.Instance replacement occurs when you specify volumes in the BlockDeviceMappings property of the AWS::EC2::Instance and AWS::EC2::Template resource types. In this case, you must add a Retain DeletionPolicy attribute.Prerequisites: If you modify the volume from gp2 to gp3, then make sure that the volume that's attached to the instance is modified to gp3. Also, make sure that the instance isn't in the Optimizing or Modifying states. Before you modify the volume to gp3, check what the limitations are.Important: Before resolving the issue, take a snapshot of the volumes to create a backup of critical workloads.Resolution1.    Add the Retain DeletionPolicy to the CloudFormation stack for the instance that you want to update the volume, and then update the stack:AWSTemplateFormatVersion: '2010-09-09'Resources: Myinstance:  Type: AWS::EC2::Instance  DeletionPolicy: Retain  Properties:   BlockDeviceMappings:    - DeviceName: /dev/xvda     Ebs:      VolumeType: gp2      VolumeSize: 10      DeleteOnTermination: true   EbsOptimized: false   ImageId: ami-064ff912f78e3e561   InstanceInitiatedShutdownBehavior: stop   InstanceType: t2.micro   Monitoring: false2.    Update the CloudFormation stack again by removing the instance from the template. Note: If you have only one resource in your template, then you must create a stand-in resource, such as another instance. You can delete the resource from the template after you finished.3.    Modify the EBS volume attributes to your requirements.4.    Import the instance back into the CloudFormation stack.To import the instance back into the CloudFormation stack:1.    Open the AWS CloudFormation console.2.    On the stack page, choose Stack actions and then choose Import resources into stack.3.    Update the template:AWSTemplateFormatVersion: '2010-09-09'Resources: Myinstance:  Type: AWS::EC2::Instance  DeletionPolicy: Retain  Properties:    BlockDeviceMappings:    - DeviceName: /dev/xvda      Ebs:       VolumeType: gp3       VolumeSize: 100       DeleteOnTermination: true    EbsOptimized: false    ImageId: ami-064ff912f78e3e561    InstanceInitiatedShutdownBehavior: stop    InstanceType: t2.micro    Monitoring: false4.    Enter the instance ID value into the Identifier field.5.    Choose Import resource.After CloudFormation moves to IMPORT_COMPLETE status, the instances are part of the stack again.Note: You might receive the error, There was an error creating this change set. As part of the import operation, you cannot modify or add [Outputs]. To resolve this issue, verify that the Outputs sections of the latest CloudFormation template and the template that your stack is using are the same. If they're not, update the latest CloudFormation template to match the values in the Outputs section of the template that your stack is using. Then, update the stack again.Follow"


Question: Why can't I connect to my VPC when using an AWS Site-to-Site VPN connection that terminates on a virtual private gateway?

I'm using an AWS Site-to-Site VPN connection that terminates on a virtual private gateway (VGW). But I can't access resources in the virtual private cloud (VPC).

Answer: "I'm using an AWS Site-to-Site VPN connection that terminates on a virtual private gateway (VGW). But I can't access resources in the virtual private cloud (VPC).ResolutionUsing the AWS Management Console, check that the Site-to-Site VPN connection's tunnel status is UP. If the connection is DOWN, then follow the troubleshooting steps for resolving connection downtime for phase 1 failures and phase 2 failures.Verify that the encryption domain that's configured on the customer gateway device is broad enough to cover the local (on-premises) and remote (AWS) network CIDRs. Site-to-Site VPN is a route-based virtual private network (VPN) solution, so by default the local and remote network CIDRs are set to any/any (0.0.0.0/0). AWS limits the number of security associations (SAs) to a single pair for both inbound and outbound security associations. So, if multiple networks are defined to communicate through the tunnel, then multiple security associations are negotiated. This setup can cause a network connectivity failure.For an active/active setup (where both tunnels are UP), make sure that asymmetric routing is supported and activated on the customer gateway device. If you haven't turned on asymmetric routing, then AWS randomly selects the egress tunnel (AWS to customer gateway traffic). For dynamic VPN, use AS PATH prepending or MED BGP attributes to use a single tunnel for return traffic from the VPC to the customer gateway device.For a static VPN, make sure that the remote on-premises network routes are defined on the VPN connection. Also, make sure that you've created a corresponding reverse route for the VPC CIDRs on the customer gateway device. This reverse route is used to route traffic through the virtual tunnel interface (VTI).For dynamic VPN, make sure that the customer gateway device is advertising the local routes to the AWS peers. Also check that the customer gateway device is receiving the VPC network CIDRs.Verify the routing on the VPC route tables. It's a best practice to turn on VGW route propagation to automatically propagate the VPN routes to the VPC route tables. Or if route propagation is turned off, you can add a static route for the on-premises network to route through the VGW.Verify that traffic is allowed on both the subnet network ACL and target resource security group. For more information, see Control traffic to resources using security groups and Controlling traffic to subnets using Network ACLs.Confirm that traffic is allowed (inbound and outbound) on the target host or instance firewall. On Windows OS, check that the Windows firewall allows traffic. For Linux systems, verify that IP tables, firewalls, and other similar host firewalls have allowed the corresponding traffic.Check if the application that's running on the target server is listening on the expected port and protocol (TCP/UDP). Run the following commands:Windows CMD:> netstat -aLinux terminal:$ sudo netstat -plantuRelated informationHow to determine which program uses or blocks specific Transmission Control Protocol ports in Windows Server 2003 in Windows documentationFollow"


Question: How do I install the CONNECTION_CONTROL and CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS plugins in Amazon RDS for MySQL?

I want to install the CONNECTION_CONTROL and CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS plugins for my Amazon Relational Database Service (Amazon RDS) for MySQL database.

Answer: "I want to install the CONNECTION_CONTROL and CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS plugins for my Amazon Relational Database Service (Amazon RDS) for MySQL database.ResolutionNote: The following steps apply only to Amazon RDS for MySQL. They don't apply to Amazon Aurora MySQL-Compatible Edition.The CONNECTION_CONTROL pluginCONNECTION_CONTROL (from the MySQL website) checks incoming connection attempts and adds a delay to server responses as necessary. This plugin also reveals system variables that allow for its configuration and a status variable that provides rudimentary monitoring information.CONNECTION_CONTROL doesn't come with default MySQL configurations. Therefore, you must configure the plugin after you install it.Install CONNECTION_CONTROLTo install the CONNECTION_CONTROL plugin in MySQL, run the following commands in the MySQL Command-Line Client:mysql    INSTALL PLUGIN CONNECTION_CONTROLSONAME 'connection_control.so';This returns an output that's similar to the following message:Query OK, 0 rows affected (0.01 sec)For more information, see Installing connection control plugins on the MySQL website.Check the plugin's variablesYou can now verify the following variables that relate to the plugin:connection_control_failed_connections_thresholdconnection_control_max_connection_delayconnection_control_min_connection_delayTo check these variables, run the following commands:mysql         SHOW VARIABLES LIKE 'connection_control%';This returns an output that's similar to the following message:+-------------------------------------------------+------------+| Variable_name | Value | +-------------------------------------------------+------------+| connection_control_failed_connections_threshold | 3 || connection_control_max_connection_delay | 2147483647 || connection_control_min_connection_delay | 1000 |+-------------------------------------------------+------------+You can't modify the values of these variables, and you must use these values by default. For more information, see Connection-control system and status variables on the MySQL website.The CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS pluginCONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS implements an INFORMATION_SCHEMA table that reveals more detailed monitoring information for failed connection attempts.Install CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTSTo install the CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS plugin in MySQL, run the following commands:mysqlINSTALL PLUGIN CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTSSONAME 'connection_control.so';This returns an output that's similar to the following message:Query OK, 0 rows affected (0.00 sec)View the plugins' statusTo view the status of these plugins, run the following commands:mysql    SELECT PLUGIN_NAME, PLUGIN_STATUS FROM INFORMATION_SCHEMA.PLUGINS WHERE PLUGIN_NAME LIKE 'connection%'; command.This returns an output that's similar to the following message:+------------------------------------------+---------------+| PLUGIN_NAME | PLUGIN_STATUS |+------------------------------------------+---------------+| CONNECTION_CONTROL | ACTIVE || CONNECTION_CONTROL_FAILED_LOGIN_ATTEMPTS | ACTIVE |+------------------------------------------+---------------+This confirms that the status of the plugins is ACTIVE. You can now learn about any failed login attempts, compare those failures with your third-party assessment tools, and post the assessment.Related informationUNINSTALL PLUGIN statement (MySQL website)Follow"


Question: How do I troubleshoot "Error Code: 503 Slow Down" on s3-dist-cp jobs in Amazon EMR?

"My S3DistCp (s3-dist-cp) job on Amazon EMR job fails due to Amazon Simple Storage Service (Amazon S3) throttling. I get an error message similar to the following:mapreduce.Job: Task Id : attempt_xxxxxx_0012_r_000203_0, Status : FAILED Error: com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.AmazonS3Exception: Slow Down (Service: Amazon S3; Status Code: 503; Error Code: 503 Slow Down; Request ID: D27E827C847A8304; S3 Extended Request ID: XWxtDsEZ40GLEoRnSIV6+HYNP2nZiG4MQddtNDR6GMRzlBmOZQ/LXlO5zojLQiy3r9aimZEvXzo=), S3 Extended Request ID: XWxtDsEZ40GLEoRnSIV6+HYNP2nZiG4MQddtNDR6GMRzlBmOZQ/LXlO5zojLQiy3r9aimZEvXzo= at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1712)"

Answer: "My S3DistCp (s3-dist-cp) job on Amazon EMR job fails due to Amazon Simple Storage Service (Amazon S3) throttling. I get an error message similar to the following:mapreduce.Job: Task Id : attempt_xxxxxx_0012_r_000203_0, Status : FAILED Error: com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.AmazonS3Exception: Slow Down (Service: Amazon S3; Status Code: 503; Error Code: 503 Slow Down; Request ID: D27E827C847A8304; S3 Extended Request ID: XWxtDsEZ40GLEoRnSIV6+HYNP2nZiG4MQddtNDR6GMRzlBmOZQ/LXlO5zojLQiy3r9aimZEvXzo=), S3 Extended Request ID: XWxtDsEZ40GLEoRnSIV6+HYNP2nZiG4MQddtNDR6GMRzlBmOZQ/LXlO5zojLQiy3r9aimZEvXzo= at com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleErrorResponse(AmazonHttpClient.java:1712)Short description"Slow Down" errors occur when you exceed the Amazon S3 request rate (3,500 PUT/COPY/POST/DELETE and 5,500 GET/HEAD requests per second per prefix in a bucket). This often happens when your data uses Apache Hive-style partitions. For example, the following Amazon S3 paths use the same prefix (/year=2019/). This means that the request limit is 3,500 write requests or 5,500 read requests per second.s3://awsexamplebucket/year=2019/month=11/day=01/mydata.parquets3://awsexamplebucket/year=2019/month=11/day=02/mydata.parquets3://awsexamplebucket/year=2019/month=11/day=03/mydata.parquetIf increasing the number of partitions isn't an option, reduce the number of reducer tasks or increase the EMR File System (EMRFS) retry limit to resolve Amazon S3 throttling errors.ResolutionUse one of the following options to resolve throttling errors on s3-dist-cp jobs.Reduce the number of reducesThe mapreduce.job.reduces parameter sets the number of reduces for the job. Amazon EMR automatically sets mapreduce.job.reduces based on the number of nodes in the cluster and the cluster's memory resources. Run the following command to confirm the default number of reduces for jobs in your cluster:$ hdfs getconf -confKey mapreduce.job.reducesTo set a new value for mapreduce.job.reduces, run a command similar to the following. This command sets the number of reduces to 10.$ s3-dist-cp -Dmapreduce.job.reduces=10 --src s3://awsexamplebucket/data/ --dest s3://awsexamplebucket2/output/Increase the EMRFS retry limitBy default, the EMRFS retry limit is set to 4. Run the following command to confirm the retry limit for your cluster:$ hdfs getconf -confKey fs.s3.maxRetriesTo increase the retry limit for a single s3-dist-cp job, run a command similar to the following. This command sets the retry limit to 20.$ s3-dist-cp -Dfs.s3.maxRetries=20 --src s3://awsexamplebucket/data/ --dest s3://awsexamplebucket2/output/To increase the retry limit on a new or running cluster:New cluster: Add a configuration object similar to the following when you launch a cluster.Running cluster: Use the following configuration object to override the cluster configuration for the instance group (Amazon EMR release versions 5.21.0 and later).[    {      "Classification": "emrfs-site",      "Properties": {        "fs.s3.maxRetries": "20"      }    }]When you increase the retry limit for the cluster, Spark and Hive applications can also use the new limit. Here's an example of a Spark shell session that uses the higher retry limit:spark> sc.hadoopConfiguration.set("fs.s3.maxRetries", "20")spark> val source_df = spark.read.csv("s3://awsexamplebucket/data/")spark> source_df.write.save("s3://awsexamplebucket2/output/")Related informationBest practices design patterns: optimizing Amazon S3 performanceWhy does my Spark or Hive job on Amazon EMR fail with an HTTP 503 "Slow Down" AmazonS3Exception?Follow"


Question: Why am I unable to mount my Amazon EFS volumes on my AWS Fargate tasks?

I'm getting errors when I mount my Amazon Elastic File System (Amazon EFS) volumes on my AWS Fargate tasks.

Answer: "I'm getting errors when I mount my Amazon Elastic File System (Amazon EFS) volumes on my AWS Fargate tasks.ResolutionAmazon EFS provides a persistent storage solution for your Fargate tasks to share files and data across different tasks.You might be unable to mount your Amazon EFS volumes on your Fargate tasks due to one or more of the following reasons:The Amazon EFS file system isn't configured correctly.The Amazon Elastic Container Service (Amazon ECS) task IAM role doesn't have the required permissions.There are issues related to network and Amazon Virtual Private Cloud (Amazon VPC) configurations.You might get one of the following errors when you try to mount your EFS volume on your Fargate task.ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: b'mount.nfs4: Connection timed out' : unsuccessful EFS utils command execution; code: 32You get the preceding error when your Fargate task can't connect to the EFS filesystem because of connection timing. To resolve this error, try the following troubleshooting steps:1.    Open the Amazon EFS console.2.    In the navigation pane, choose File systems.3.    Choose the file system that you want to check by choosing its Name or the File system ID.4.    Choose Network to display the list of existing mount targets.5.    Choose Manage.You can view the security group and the security group's inbound rules for the mount targets.Be sure that the inbound rule for the security group allows traffic from the Fargate task security group on port 2049. Confirm that network traffic is allowed at the subnet level. To confirm, verify that the network access control list allows traffic between the file system and task. If the traffic isn't allowed, then modify the rules accordingly. For more information, see Security in the VPC with public and private subnets (NAT) documentation.ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: mount.nfs4: Connection reset by peer : unsuccessful EFS utils command execution; code: 32You get the preceding error due to one of the following reasons:You mounted the EFS file system immediately after creating the file system.The security group for the mount target doesn't allow inbound traffic from Fargate tasks on port 2049.You're using AWS App Mesh, and outbound to port 2049 is blocked because of proxy rules.To troubleshoot this error, follow these steps:Up to 90 seconds can elapse for the DNS records to propagate completely in an AWS Region after creating a mount target. If you're programmatically creating and mounting the file systems, such as with an AWS CloudFormation template, it's a best practice to implement a wait condition.Confirm that the inbound security group rule that's attached to the EFS file system mount targets allows traffic on port 2049 from Fargate tasks.If you're using AppMesh, then make sure that your proxy configuration specified in the TaskDefinition includes 2049 as EgressIgnoredPorts.ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: Failed to resolve "fs-xxxxxxxxxxx.efs.us-east-1.amazonaws.com" - check that your file system ID is correctYou get the preceding error due to one of the following reasons:The EFS file system mount target isn't created or available in an Availability Zone where Fargate tasks are launched.You're using a custom DNS server for the VPC.The VPC DNS hostnames are turned off. DNS hostnames are turned off by default.To resolve this error, try the following steps:Be sure that the EFS file system mount target is in the same Availability Zone as the Fargate task. You can view the Availability Zone, subnet, and security group of the mount target in the Amazon EFS console. Then, verify that the mount target uses the same Availability Zone and subnet as the Fargate task.If you specified a custom DNS server for your VPC DHCP options instead of AmazonProvidedDNS, then be sure to configure conditional DNS forwarders. The DNS forwarders must send the DNS queries of AWS resources (*.amazonaws.com) to the VPC's default DNS server at VPC CIDR .2 or 169.254.169.253. For more information, see How to set up DNS resolution between on-premises networks and AWS using AWS Directory Service and Microsoft Active Directory.ResourceInitializationError: failed to invoke EFS utils commands to set up EFS volumes: stderr: b'mount.nfs4: access denied by server while mounting 127.0.0.1:/' : unsuccessful EFS utils command execution; code: 32You get the preceding error when access to the file system is denied by the following policies and permissions:The file system policyThe task role policyThe POSIX file system level permissionsAccess to an EFS file system might be controlled by permissions that are defined in the following resources:The network access control listSecurity groupsEFS file system policiesECS task role IAM policyA POSIX fileFor more information, see Developers guide to using Amazon EFS with Amazon ECS and AWS Fargate – Part 2.To troubleshoot this error, check if the file system policy or the ECS task role IAM policy denies access to the file system. If these policies deny permissions, then modify the policies to grant permissions to access the file system. If the file system policy doesn't exist, then access to the file system is granted by default to all principals during creation.Related informationCreating Amazon EFS file systemsCreating and managing mount targets and security groupsHow do I mount an Amazon EFS file system on an Amazon ECS container or task running on Fargate?File system mount fails immediately after file system creationFollow"


Question: How do I create an SQL Server Always On availability group cluster in the AWS Cloud?

I want to create an SQL Server Always On availability group cluster in the AWS Cloud. How can I do this?

Answer: "I want to create an SQL Server Always On availability group cluster in the AWS Cloud. How can I do this?Short descriptionTo create an SQL Server Always On availability group cluster in the AWS Cloud, first configure two secondary IPs for each cluster node elastic network interface. Then, use Remote Desktop Protocol (RDP) to connect as a Domain Administrator account to the cluster node instances. Finally, create a two-node Windows cluster and SQL Server Always On availability groups.You can also use AWS Launch Wizard to create an SQL Server Always On availability group deployment. The Launch Wizard identifies the AWES resources to provision the SQL Server databases automatically based on your use case. For more information, see What is AWS Launch Wizard for SQL Server?ResolutionPrerequisitesLaunch two Amazon Elastic Compute Cloud (Amazon EC2) Windows Server instances (version 2012 R2 or later) across Availability Zones inside a Virtual Private Cloud (VPC).Use SQL Server 2014 64-bit Enterprise edition or later. For testing, use SQL Server 2014 64-bit Evaluation edition or later.Configure secondary Amazon Elastic Block Store (Amazon EBS) volumes to host SQL Server Master Data File, Log Data File, and SQL Backup files. It's a best practice to choose Provisioned IOPS SSD (io1) EBS volumes for large SQL Server database workloads.Deploy the cluster nodes in private subnets. You can then use RDP to connect from a jump server to the cluster node instances.Configure security group inbound rules and Windows Firewall exceptions to allow the nodes to communicate in a restrictive environment. See Configure the Windows Firewall to allow SQL Server access on the Microsoft website.Active Directory (AD) domain controllers must have all necessary ports opened for the SQL nodes and witness to join the domain and authenticate against Active Directory. See Active Directory and Active Directory Domain Services Port Requirements on the Microsoft website.Join the nodes to the domain before creating the Windows failover cluster. Verify that you are logged in using domain credentials before creating and configuring the cluster.Run the SQL DB instances with an Active Directory service account.Create an SQL login with sysadmin permission using Windows domain authentication. Consult your Database Administrator for more information. For more details, see Create a login using SSMS on the Microsoft website.Verify that the SQL browser is configured properly. This is required only for SQL Server named instances.Configure the secondary IPs for each cluster node elastic network interfaceA secondary IP is required for each cluster node eth0 elastic network interface. If you want an SQL Group Listener, then you need to add a third IP address. This results in total of 3 IPs that are attached to the eth0 elastic network interface.Note: If you don't plan to deploy an SQL Group Listener, add only one secondary IP for each cluster node elastic network interface.1.    Open the Amazon EC2 console, and then choose the AWS Region that will host your Always On cluster.2.    Choose Instances from the navigation pane, and then select your EC2 cluster instance.3.    Choose the Networking tab.4.    Under Network interfaces, choose the Interface ID elastic network interface.5.    Select the network interface, and then choose Actions, Manage IP addresses.6.    Choose the arrow next to the network interface ID to expand the window, and then choose Assign new IP address. You can select a specific IP or leave the field as Auto-assign. Repeat this step to add a second new IP.7.    Choose Save, Confirm.8.    Repeat steps 1-7 for the other EC2 instance that will participate in the cluster.Create a two-node Windows cluster1.    Connect to your EC2 instance using RDP with a domain account that has local Administrator permissions on both nodes.2.    On the Windows Start menu, open Control Panel, and then choose Network and Sharing Center.3.    Choose Change adapter settings from the navigation pane.4.    Select your network connection, and then choose Change settings of this connection.5.    Select Internet Protocol Version 4 (TCP/IPv4), and then choose Properties.6.    Choose Advanced.7.    On the DNS tab, choose Append primary and connection specific DNS suffixes.8.    Choose Ok, choose Ok, and then choose Close.9.    Repeat steps 1-8 for the other EC2 instance that will participate in the cluster.10.    On each instance, install the cluster feature on the nodes from the Server Manager, or run the following PowerShell command:Install-WindowsFeature –Name Failover-Clustering –IncludeManagementTools11.    Open cmd as Administrator, and enter cluadmin.msc to open the Cluster Manager.12.    Open the context (right-click) menu for Failover Cluster Manager, and then choose Create Cluster.13.    Choose Next, and then choose Browse.14.    For Enter the object names to select, enter the cluster node hostnames, and then choose Ok.15.    Choose Next. You can now choose whether you want to validate the cluster. It's a best practice to run a cluster validation. If the cluster doesn't pass validation, Microsoft might not be able to provide technical support for your SQL cluster. Choose Yes or No, and then choose Next.16.    For Cluster Name, enter a name, and then choose Next.17.    Clear Add all eligible storage to the cluster, and then choose Next.18.    When the cluster creation is complete, choose Finish.Note: Cluster logs and reports are located at the following path: %systemroot%\cluster\reports19.    In the Cluster Core Resources section of Cluster Manager, expand the entry for your new cluster.20.    Open the context (right-click) menu for the first IP Address entry, and then choose Properties. For IP Address, choose Static IP Address, and then enter one of the secondary IPs associated with eth0 elastic network interface. Choose Ok. Repeat this step for the second IP Address entry.21.    Open the context (right-click) menu for the cluster name, and then choose Bring Online.Note: It's a best practice to also configure a File Share Witness (FSW) to act as a tie breaker. You can also use Amazon FSx for Windows File Server with Microsoft SQL Server. For information on FSW, see Failover Cluster Step-by-Step Guide: Configuring the Quorum in a Failover Cluster on the Microsoft website.Create Always On availability groups1.    Open SQL Server Configuration Manager.2.    Open the context (right-click) menu for the SQL instance, and then choose Properties.3.    On the AlwaysOn High Availability tab, select Enable AlwaysOn Availability Groups, and then choose Apply.4.    Open the context (right-click) menu for the SQL instance, and then choose Restart.5.    Repeat steps 1-4 on the other cluster node part of the cluster.6.    Open Microsoft SQL Server Management Studio (SSMS).7.    Log in to one of the SQL instances with your Windows authenticated login that has access to the SQL instance.Note: It's a best practice to use the same MDF and LDF directory file paths across the SQL instances.8.    Create a test database. Open the context (right-click) menu for Databases, and then choose New Database.Note: Be sure to use the Full recovery model on the Options page. For more information, see Recovery Models (SQL Server) on the Microsoft website.9.    For Database name, enter a name, and then choose Ok.10.    Open the context (right-click) menu for the new database name, choose Tasks, and then choose Back Up. For Backup type, choose Full.11.    Choose Ok, and then choose Ok.12.    Open the context (right-click) menu for Always On High Availability, and then choose New Availability Group Wizard.13.    Choose Next.14.    For Availability group name, enter a name, and then choose Next.15.    Select your database, and then choose Next.16.    A primary replica is already present in the Availability Replicas window. Choose Add Replica to create a secondary replica.17.    For Server name, enter a name for the secondary replica, and then choose Connect.18.    For Availability Mode, decide which availability mode you want, and then choose Synchronous commit or Asynchronous commit for each replica. For more information, see Differences between availability modes for an Always On availability group on the Microsoft website.19.    Choose Next.20.    Choose your data synchronization preference, and then choose Next. For more information, see Select Initial Data Synchronization Page (Always On Availability Group Wizards) on the Microsoft website.21.    When the validation is successful, choose Next.Note: You can safely ignore Checking the listener configuration, as you'll add it later.22.    Choose Finish, and then choose Close.Add an SQL Group Listener1.    Open SSMS, and then expand Always On High Availability, Availability Groups, [primary replica name].2.    Open the context (right-click) menu for Availability Group Listeners, and then choose Add Listener.For Listener DNS Name, enter a name.For Port, enter 1433.For Network Mode, choose Static IP.3.    Choose Add.For IPv4 Address, enter the third IP address from one of the cluster node instances, and then choose Ok. Repeat this step, using the third IP address from the other cluster node instance.4.    Choose Ok.Note: Errors received when adding an SQL Group Listener indicate missing permissions. For troubleshooting steps, see the following resources on the Microsoft website:KB2829783 - Troubleshooting AlwaysOn availability group listener creation in SQL Server 2012Create Availability Group Listener Fails with Message 19471, 'The WSFC cluster could not bring the Network Name resource online'Test failover1.    Using SSMS, open the context (right-click) menu for the primary replica on the navigation menu, and then choose Failover.2.    Choose Next, and then choose Next.3.    Choose Connect, and then choose Connect.4.    Choose Next, and then choose Finish. The primary replica will become the secondary replica after failover.Related informationBest practices and recommendations for SQL Server clustering on EC2SQL Server with Always-on Replication on AWSAWS Launch WizardConfigure a listener for an Always On availability group (on the Microsoft website)Follow"


Question: How can I manage an AWS Managed Microsoft AD or Simple AD directory from an Amazon EC2 Windows instance?

I want to use an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance to manage AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) or Simple AD. How can I do that?

Answer: "I want to use an Amazon Elastic Compute Cloud (Amazon EC2) Windows instance to manage AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) or Simple AD. How can I do that?ResolutionFirst, join the EC2 Windows instance to the directory in one of the following ways:To join a new instance to an AWS Managed Microsoft AD or Simple AD directory during launch, see Seamlessly join a Windows EC2 instance.To manually join an existing instance to a directory, see Manually join a Windows instance.Then, to manage the directory from the EC2 Windows instance, install Active Directory administration tools on the instance.Related informationAWS Managed Microsoft ADSimple Active DirectoryAWS Directory Service FAQsFollow"


Question: Why is my application or website hosted on Route 53 unreachable?

"I'm running an application or website on Amazon Route 53. However, I'm unable to access my application or website. How can I troubleshoot this?"

Answer: "I'm running an application or website on Amazon Route 53. However, I'm unable to access my application or website. How can I troubleshoot this?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Check for domain status issues1.    Use the following command to check the domain status:whois domain_name |grep 'status'If the domain status (Extensible Provisioning Protocol code) is "inactive" or "ServerHold" or "ClientHold", the domain won't resolve.2.    If your see an unusual domain status code, including "inactive" or "ServerHold" or "ClientHold", contact your registrar.Use the following command to determine the domain registrar:whois domain_name |grep 'Registrar'Query your preferred Whois utility (domain registration lookup tool) for generic or country-specify top-level domains (TLDs).Check for name server issues1.    Confirm that the authoritative name server is correctly configured at your registrar. To find the authoritative name servers, check the authoritative_nameserver value in the name server (NS) resource record set of the public hosted zone.2.    If you're using Route 53 as your DNS service provider, be sure that you correctly configured each of the four name servers.Use the following command to check the name server configuration:whois domain_name |grep 'Name Server'For example, the output for whois amazon.com |grep 'Name Server' is:Name Server: NS1.P31.DYNECT.NETName Server: NS2.P31.DYNECT.NETName Server: NS3.P31.DYNECT.NETName Server: NS4.P31.DYNECT.NETName Server: PDNS1.ULTRADNS.NETName Server: PDNS6.ULTRADNS.CO.UKCheck for record set issuesUse the following command to check if you've created the required alias (A) record in the hosted zone with the DNS service provider:dig Domain_name record_typeFor example, the output for $dig amazon.com A is:; <<>> DiG 9.10.6 <<>> amazon.com +question;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 29804;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 1;; OPT PSEUDOSECTION:; EDNS: version: 0, flags:; udp: 512;; QUESTION SECTION:;amazon.com.            IN    A;; ANSWER SECTION:amazon.com.        44    IN    A    54.239.28.85amazon.com.        44    IN    A    205.251.242.103amazon.com.        44    IN    A    176.32.103.205;; Query time: 4 msec;; SERVER: 192.168.1.1#53(192.168.1.1);; WHEN: Fri Mar 19 20:28:51 IST 2021;; MSG SIZE  rcvd: 87Note: The record type is listed in the Type column of the corresponding resource record set. For more information, see Supported DNS record types.Check for source issuesFor local browsers or mobile devices:Clear your browser cache and then try to access the domain.Check whether you're requesting the correct domain. Mobile device browsers might append "www" when requesting the domain.For an on-premises machine connected to an Amazon Virtual Private Cloud (Amazon VPC) or AWS resource using VPC .2 Resolver:If you have private and public hosted zones with overlapping namespaces, such as "example.com" and "accounting.example.com", then Resolver routes traffic based on the most specific match. If there's a matching private hosted zone but no record that matches the domain name and type in the request, then Resolver doesn't forward the request to a public DNS resolver. Instead, it returns an NXDOMAIN (non-existent domain) error to the client. If you unintentionally created a private hosted zone with overlapping namespaces, you can delete the private hosted zone.Check for record caching issues1.    Use the following command to check if the record value returned from the DNS resolver matches the value returned from the authoritative name server. If the domain isn't resolving to the expected IP address, the DNS resolver might have cached the value. Clear your browser cache if the domain is resolving to an unexpected IP address.dig domain_name record_type @authorative_name_serverFor example, the output for $dig amazon.com @NS1.P31.DYNECT.NET is:; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.64.amzn1 <<>> amazon.com @NS1.P31.DYNECT.NET;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 63711;; flags: qr aa rd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0;; WARNING: recursion requested but not available;; QUESTION SECTION:;amazon.com.            IN    A;; ANSWER SECTION:amazon.com.        60    IN    A    205.251.242.103amazon.com.        60    IN    A    54.239.28.85amazon.com.        60    IN    A    176.32.103.205;; Query time: 2 msec;; SERVER: 208.78.70.31#53(208.78.70.31) ;; WHEN: Fri Mar 19 15:08:52 2021;; MSG SIZE  rcvd: 762.    Use the following command to check if you're seeing the same results with the public resolver. If the public resolver is returning the expected answer, the issue is likely with the DNS resolver on the local machine.dig domain @public_resolver_IpFor example, the output for $dig amazon.com @8.8.8.8 is:; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.64.amzn1 <<>> amazon.com @8.8.8.8;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26860;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;amazon.com.            IN    A;; ANSWER SECTION:amazon.com.        15    IN    A    205.251.242.103amazon.com.        15    IN    A    54.239.28.85amazon.com.        15    IN    A    176.32.103.205;; Query time: 1 msec;; SERVER: 8.8.8.8#53(8.8.8.8);; WHEN: Fri Mar 19 15:09:41 2021;; MSG SIZE  rcvd: 76Check for DNSSEC issuesConfirm that you've correctly configured DNSSEC for your domain. Use the DNSSEC analyzer tool or your preferred utility to see if there are DNSSEC issues with the domain.Pass the DNSSEC and see if you're getting expected results:dig domain_name +cdFor example, the output for $ dig amazon.com +cd is:; <<>> DiG 9.8.2rc1-RedHat-9.8.2-0.68.rc1.64.amzn1 <<>> amazon.com +cd;; global options: +cmd;; Got answer:;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 55636;; flags: qr rd ra cd; QUERY: 1, ANSWER: 3, AUTHORITY: 0, ADDITIONAL: 0;; QUESTION SECTION:;amazon.com.            IN    A;; ANSWER SECTION:amazon.com.        29    IN    A    205.251.242.103amazon.com.        29    IN    A    176.32.103.205amazon.com.        29    IN    A    54.239.28.85;; Query time: 2 msec;; SERVER: 1.1.1.1#53(1.1.1.1);; WHEN: Fri Mar 19 15:10:13 2021;; MSG SIZE  rcvd: 76Check for webserver issuesIf you're seeing the expected IP address for the domain in curl command output, check if you're getting the Expected HTTP response from the server:1XX (Informational)2XX (Successful)3XX (Redirection)4XX (Client Error)5XX (Server Error)If the DNS resolution is working as expected but the server isn't responding, the issue is with the web server where the website or application is hosted.Command:curl -Iv http://domain_name:Port/PathFor example, the output for $ curl -Iv http://amazon.com:80 is:* Rebuilt URL to: http://amazon.com:80/*   Trying 176.32.103.205...   <--- Indicates no issues with the DNS resolution as we are getting expected IP address for the domain amazon.com.* TCP_NODELAY set* Connected to amazon.com (176.32.103.205) port 80 (#0)> HEAD / HTTP/1.1> Host: amazon.com> User-Agent: curl/7.61.1> Accept: */*> < HTTP/1.1 301 Moved PermanentlyHTTP/1.1 301 Moved Permanently< Server: ServerServer: Server< Date: Fri, 19 Mar 2021 15:11:18 GMTDate: Fri, 19 Mar 2021 15:11:18 GMT< Content-Type: text/htmlContent-Type: text/html< Content-Length: 179Content-Length: 179< Connection: keep-aliveConnection: keep-alive< Location: https://amazon.com/Location: https://amazon.com/< * Connection #0 to host amazon.com left intactNote: The Port value is the web server port on which the website or application is configured to listen.Follow"


Question: How can I generate server and client certificates and their respective keys on a Windows server and upload them to ACM?

How can I generate server and client certificates and their respective keys on a Windows server and upload them to AWS Certificate Manager (ACM)?

Answer: "How can I generate server and client certificates and their respective keys on a Windows server and upload them to AWS Certificate Manager (ACM)?ResolutionGenerate the server and client certificates and their respective keys1.    Go to the OpenVPN Community Downloads page.2.    Select the Windows Installer (.exe) file for the Windows OS version that you're running. Then, choose Run.3.    Complete the OpenVPN Setup Wizard:Choose Next.Review the license agreement, and then choose I Agree.For Choose Components, select EasyRSA 2 Certificate Management Scripts.Choose Next, and then choose Install.4.    After the OpenVPN software is installed, open a command prompt and navigate to the easy-rsafolder:cd \Program Files\OpenVPN\easy-rsa5.    Start the OpenVPN configuration:init-config6.    Open the vars.bat file in a text editor:notepad vars.bat Set KEY_Size=2048. Then, set values for KEY_COUNTRY, KEY_PROVINCE, KEY_CITY, KEY_ORG, and KEY_EMAIL. Don’t leave any of these parameters blank.Save and close your text editor.7.    Run the following commands to set the above variables for the certificate authority (CA) certificate, initialize the public key infrastructure (PKI), and build the CA certificate:varsclean-allbuild-caAt the prompt, leave all fields as the default values. Optionally, you can change the Common Nameto your server's domain name.8.    Run the following command to generate a certificate and private key for the server:build-key-server serverAt the prompt, change the Common Nameto your server's domain name using the format server.example.com. Leave all of the remaining fields as the default values.9.    Run the following command to generate a certificate and private key for the client:build-key client1At the prompt,changethe Common Nameto your client's domain name using the format client1.example.com. Leave all of the remaining fields as the default values.10.    (Optional) If needed, create additional client certificates and keys.build-key client2At the prompt, change the Common Name to your client's domain name using the format client2.example.com. Leave all of the remaining fields as the default values.Important: If you don't follow the format specified above for setting common names, the domain names aren't available when you import the certificate into ACM. As a result, the certificate isn't an available option for specifying the server certificate or client certificate when you create the AWS Client VPN endpoint.Import the server and client certificates and keys into ACMNote: The server and client certificates, and their respective keys, are available in C:\Program Files\OpenVPN\easy-rsa\keys.1.    Open the following files: server.crt, server.key, client1.crt, client1.key, and ca.crt.2.    Open the ACM console, and then choose Import a certificate.3.    On the Import a certificatepage, copy/paste the content:From the server.crtfile to Certificate body.From the server.keyfile to Certificate private key.          From the ca.crtfile to Certificate chain.     4.    Choose Import to import the server certificate.5.    Choose Import a certificateagain and copy/paste the content:                 From the client1.crtfile to Certificate body.From the client1.key file to Certificate private key.            From the ca.crt fileto Certificate chain.        6.    Choose Import to import the client certificate.Or, you can use the AWS Command Line Interface (AWS CLI) to import the server and client certificates and their keys into ACM:cd C:\Program Files\OpenVPN\easy-rsa\keysaws acm import-certificate --certificate file://"C:\Program Files\OpenVPN\easy-rsa\keys\server.crt" --private-key file://"C:\Program Files\OpenVPN\easy-rsa\keys\server.key" --certificate-chain file://"C:\Program Files\OpenVPN\easy-rsa\keys\ca.crt"aws acm import-certificate --certificate file://"C:\Program Files\OpenVPN\easy-rsa\keys\client1.crt" --private-key file://"C:\Program Files\OpenVPN\easy-rsa\keys\client1.key" --certificate-chain file://"C:\Program Files\OpenVPN\easy-rsa\keys\ca.crt"Confirm that you have successfully created and imported your server and client certificates1.    Open the ACM console.2.    In the certificates list, confirm that Issueddisplays in the Status columnfor your server and client certificates.Related InformationMutual Authentication (for AWS Client VPN)Follow"


Question: How do I increase my custom origin's response timeout in CloudFront?

How do I increase the amount of time that Amazon CloudFront waits for a response from my custom origin?

Answer: "How do I increase the amount of time that Amazon CloudFront waits for a response from my custom origin?Short descriptionTo adjust the timeout value that CloudFront uses when communicating with your custom origin, change the origin's response timeout setting in the CloudFront console.Important: If you're getting HTTP 504 errors from CloudFront, make sure that you verify the following before you increase your origin's response timeout:The firewall and security groups on your origin server allow CloudFront traffic.The origin server is accessible on the internet.The server timeouts aren't being caused by delayed responses from applications on your origin server.For more information, see HTTP 504 status code (Gateway Timeout) in the CloudFront Developer Guide.Resolution1.    Open the CloudFront console.2.    In the Distributions pane, in the ID column, select the ID of the distribution that you want to edit.3.    Choose the Origins tab. The Origins page appears.4.    In the Origin name column, select the check box next to the origin name that you want to edit. Then, choose Edit. The Edit origin page appears.5.    In the Settings pane, choose Additional settings.6.    For Response timeout, enter the new timeout value.7.    Choose Save changes.Note: To configure a Response timeout value that's greater than 60 seconds, you must request a quota increase. The default Response timeout value is 30 seconds.Follow"


Question: "How can I change the default Amazon SNS email subject line, "AWS Notification Message", for an EventBridge rule?"

"I configured my Amazon Simple Notification Service (Amazon SNS) to receive email notifications from an Amazon EventsBridge rule that has multiple event sources. How do I customize the default SNS email subject line, "AWS Notification Message," and email body based on the event that triggers the notification?"

Answer: "I configured my Amazon Simple Notification Service (Amazon SNS) to receive email notifications from an Amazon EventsBridge rule that has multiple event sources. How do I customize the default SNS email subject line, "AWS Notification Message," and email body based on the event that triggers the notification?Short descriptionThere is currently no way to customize the message of an Amazon SNS email based on specific EventBridge rules using the Amazon SNS console.Use a Lambda function, instead of the Amazon SNS topic, as a target for the EventBridge rule. Then, configure the Lambda function to publish a custom message to the Amazon SNS topic when triggered by the EventBridge rule.Here's how the logic works:The EventBridge rule is triggered.The Lambda function invokes with the payload of the EventBridge rule.The function calls the Amazon SNS publish API.Amazon SNS delivers an email notification with a custom subject or message.ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Create an AWS Lambda function that is set as a target for the EventBridge ruleFor more information, see Tutorial: Schedule AWS Lambda functions using EventBridge.Important: Make sure that the Lambda function’s execution role has permission to publish to the Amazon SNS topic. For example, if your function's execution role has the AWS managed policy, AWSLambdaBasicExecutionRole, you must attach the AmazonSNSFullAccess policy to the execution role.After the Lambda function is set as a target for the EventBridge rule, the following resource-based policy is automatically added to the function:{  "Version": "2012-10-17",  "Id": "default",  "Statement": [    {      "Sid": "AWSEvents_CWRule_CustomEmailSubject_Id196649187337",      "Effect": "Allow",      "Principal": {        "Service": "events.amazonaws.com"      },      "Action": "lambda:InvokeFunction",      "Resource": "Lambda-function-ARN",      "Condition": {        "ArnLike": {          "AWS:SourceArn": "Eventbridge-rule-ARN"        }      }    }  ]}Configure the Lambda function to publish a custom email subject or a custom message to the Amazon SNS topicFor more information, see Publish (API reference).Important: The following code snippets are for reference only. Don't use the code snippets in your production environment before testing them.Example Python publish API callimport boto3import jsonsns_arn = "SNS_TOPC_ARN"def lambda_handler(event, context):    client = boto3.client("sns")    resp = client.publish(TargetArn=sns_arn, Message=json.dumps(event), Subject="CUSTOM_SUBJECT")Example JavaScript/Node.js publish API callconst AWS = require('aws-sdk');exports.handler = (event, context, callback) => {    let sns = new AWS.SNS();    sns.publish({    TopicArn: 'SNS_TOPIC_ARN',    Message: JSON.stringify(event),     Subject: 'CUSTOM_SUBJECT'    }, function(error, data){       if(error) console.log(error, error.stack);       callback(error, data);     });};Important: Make sure that you replace the values for SNS_TOPIC_ARN and CUSTOM_SUBJECT with your own inputs.In this way, you can use a Lambda function to customize and forward a EventBridge rule’s email subject or message to an Amazon SNS topic.Related informationTutorial: Create an Amazon EventBridge rule for AWS CloudTrail API callsFollow"


Question: Can I associate multiple SSL certificates with my Amazon CloudFront distribution?

I'm serving multiple CNAMEs (alternate domain names) through my Amazon CloudFront distribution. I want to turn on Secure Sockets Layer (SSL) or HTTPS for all the associated CNAMEs.

Answer: "I'm serving multiple CNAMEs (alternate domain names) through my Amazon CloudFront distribution. I want to turn on Secure Sockets Layer (SSL) or HTTPS for all the associated CNAMEs.ResolutionYou can't associate more than one SSL or Transport Layer Security (TLS) certificate to an individual CloudFront distribution. However, certificates provided by AWS Certificate Manager (ACM) support up to 10 subject alternative names, including wildcards. To turn on SSL or HTTPS for multiple domains served through one CloudFront distribution, assign a certificate from ACM that includes all the required domains.To use an SSL certificate for multiple domain names with CloudFront, import your certificate into ACM or the AWS Identity and Access Management (IAM) certificate store. For instructions, see Importing an SSL/TLS Certificate.Related informationRequirements for using SSL/TLS certificates with CloudFrontFollow"