Question: How do I troubleshoot and fix failing health checks for Application Load Balancers?

The targets registered to my Application Load Balancer aren't healthy. How do I find out why my targets are failing health checks?

Answer: "The targets registered to my Application Load Balancer aren't healthy. How do I find out why my targets are failing health checks?ResolutionTo troubleshoot and fix failing health checks for your Application Load Balancer:1.    Check the health of your targets to find the reason code and description of your issue.2.    Follow the resolution steps below for the error that you received.Elb.InitialHealthCheckingDescription: Initial health checks in progress.Resolution: Before a target can receive requests from the load balancer, that target must pass initial health checks. Wait for your target to pass the initial health checks, and then recheck its health status.Elb.RegistrationInProgressDescription: Target registration is in progress.Resolution: The load balancer starts routing requests to the target as soon as the registration process completes and the target passes the initial health checks.Target.DeregistrationInProgressDescription: Target deregistration is in progress.Resolution: When you deregister a target, the load balancer waits until in-flight requests are complete. This is known as the deregistration delay. By default, Elastic Load Balancing waits 300 seconds before completing the deregistration process. However, you can customize this value.If a deregistering target has no in-flight requests and no active connections, then Elastic Load Balancing immediately deregisters without waiting for the deregistration delay to elapse. The initial state of a deregistering target is draining. After the deregistration delay elapses, the deregistration process completes and the state of the target is unused. If the target is part of an Auto Scaling group, then it can be terminated and replaced.Target.FailedHealthChecksDescription: The load balancer received an error while establishing a connection to the target, or the target response was malformed.Resolution:Verify that your application is running. Use the service command to check the status of services on Linux targets. For Windows targets, check the Services tab of the Windows Task Manager. If the service is stopped, start the service. If the service isn't recognized, verify that the required service is installed.Verify that the target is listening for traffic on the health check port. You can use the ss command on Linux targets to verify which ports your server is listening on. For Windows targets, you can use the netstat command.Verify that your application responds to the load balancer's health check requests accordingly. The following example shows a typical health check request from the Application Load Balancer that your targets must return with a valid HTTP response. The Host header value contains the private IP address of the target, followed by the health check port. The User-agent is set to ELB-HealthChecker/2.0. The line terminator for message-header fields is the sequence CRLF, and the header terminates at the first empty line followed by a CRLF. If necessary, add a default virtual host to your web server configuration to receive the health check requests.GET / HTTP/1.1Host: 10.0.0.1:80Connection: closeUser-Agent: ELB-HealthChecker/2.0Accept-Encoding: gzip, compressedThe target type of your target group determines which network interface that the load balancer sends health checks to on the targets. For example, you can register instance IDs, IP addresses, and Lambda functions. If the target type is instance ID, then the load balancer sends health check requests to the primary network interface of the targets. If the target type is IP address, then the load balancer sends health check requests to the network interface associated with the corresponding IP address. If your targets have multiple interfaces attached, then verify that your application is listening on the correct network interface.The ELBSecurityPolicy-2016-08 security policy is used for target connections and HTTPS health checks. Verify that the target provides a server certificate and a key in the format specified in the security policy. Also verify that the target supports one or more matching ciphers and a protocol provided by the load balancer to establish the TLS handshake.Target.InvalidStateDescription: The target is in the stopped or terminated state.Resolution: If the target is an Amazon Elastic Compute Cloud (Amazon EC2) instance, open the Amazon EC2 console. Then, verify that the instance is running. Start the instance if necessary.Target.IpUnusableDescription: The IP address can't be used as a target because it's in use by a load balancer.Resolution: When you create a target group, you specify its target type. When the target type is IP, don't choose an IP address that's already in use by a load balancer.Target.NotInUseDescription: The target group isn't used by any load balancer or the target is in an Availability Zone that isn't enabled for its load balancer.Resolution:Check the target group and verify that it's configured to receive traffic from the load balancer.Verify that the Availability Zone of the target is enabled for the load balancer.Target.NotRegisteredDescription: The target isn't registered to the target group.Resolution: Verify that the target is registered to the target group.Target.ResponseCodeMismatchDescription: The health checks didn't return an expected HTTP code.Resolution:Success codes are the HTTP codes to use when checking for a successful response from a target. You can specify values or ranges of values between 200 and 499. The default value is 200. Check your load balancer health check configuration to verify which success codes that it's expecting to receive. Then, inspect your web server access logs to see if the expected success codes are being returned. Modify the success code value if necessary.Verify that the ping path is valid. The ping path is the destination on the targets for health checks. Be sure to specify a valid URI (/path?query). The default is /. Modify the ping path value if necessary.Target.TimeoutDescription: Request timed out.Resolution: If you can connect, then the target page might not respond before the health check timeout period. Most web servers, such as NGINX and IIS, let you log how long the server takes to respond. If your health check requests take longer than the configured timeout, you can:Choose a simpler target page for the health check.Adjust the health check settings.If you can't connect:Verify that the security group associated with the target allows traffic from the load balancer using the health check port and health check protocol. You can add a rule to the security group to allow all traffic from the load balancer security group. Also, the security group for your load balancer must allow traffic to the targets.Verify that the network ACL associated with the subnets for your target allows inbound traffic on the health check port. Verify that it also allows outbound traffic on the ephemeral ports (1024-65535).Verify that the network ACL associated with the subnets for your load balancer nodes allows inbound traffic on the ephemeral ports. Verify that it also allows outbound traffic on the health check and ephemeral ports.Verify that any OS-level firewalls on the target are allowing health check traffic in and out.Verify that the route table for the subnets associated with the target contains an entry that allows health check traffic back to the load balancer.Verify that the memory and CPU utilization of your targets are within acceptable limits. If your memory or CPU utilization is too high, add additional targets or increase the capacity of your Auto Scaling Group. If your target is an EC2 instance, you can also upgrade the instance to a larger instance type.Related informationTroubleshoot your Application Load BalancersFollow"


Question: How do I troubleshoot issues with sending email messages in Amazon Cognito with default email settings compared to Amazon SES?

I need more information to resolve issues with sending email messages in Amazon Cognito with default settings compared to Amazon Simple Email Service (Amazon SES).

Answer: "I need more information to resolve issues with sending email messages in Amazon Cognito with default settings compared to Amazon Simple Email Service (Amazon SES).ResolutionTo determine whether Amazon Cognito sent an email message to a user's account, review the user's email configuration.In all scenarios, start by checking your email inbox and spam folder to verify that you didn't receive an email message from Amazon Cognito.Your troubleshooting steps depend on your email configuration in the Amazon Cognito console on the Messaging tab.If you choose Send email with Cognito in your setup, then Amazon Cognito uses an AWS owned account for email messages. With this setting, users don't have visibility into send metrics for that account. Users can open an AWS Support case to request access to Amazon SES to check the status of email messages to certain addresses.If you choose Send email with Amazon SES - Recommended in your setup, then users are actively using a verified email account in Amazon SES. Users can view Amazon CloudWatch logs to see if an email message was sent. When the sent email message is confirmed, users can explore other information in their accounts. To learn more about the different errors you might see in an Amazon SES CloudWatch log, see Amazon SES email sending errors.Follow"


Question: How do I hide my Lambda function's environment variables and unencrypted text from an IAM user?

I want to prevent AWS Identity and Access Management (IAM) users with access to my AWS Lambda function from seeing environment variables and unencrypted text. How do I do that?

Answer: "I want to prevent AWS Identity and Access Management (IAM) users with access to my AWS Lambda function from seeing environment variables and unencrypted text. How do I do that?ResolutionNote: The following solution prevents IAM identities from seeing a Lambda function's environment variables only in the Lambda console and the Lambda API. It doesn't prevent IAM identities from accessing decrypted environment variables using the function's code, or from outputting the environment variable values to Amazon CloudWatch Logs.To prevent IAM identities from accessing passwords, keys, or other sensitive information in your Lambda environment variables, do the following:Use an AWS Key Management Service (AWS KMS) customer managed key to encrypt the environment variables. To set up a KMS key, follow the instructions in Securing environment variables.Important: Make sure that you edit the key policy for the KMS key so that the policy denies access to the IAM identities that don't need access.KMS key policy example that denies specific IAM users permission to see Lambda environment variablesNote: Replace arn:aws:iam::1234567890:User1DeniedAccess and arn:aws:iam::1234567890:User2DeniedAccess with the Amazon Resource Names (ARNs) of IAM identities that you want to deny access. You can add more IAM ARNs to the key policy as needed.{    "Id": "MyCustomKey",    "Version": "2012-10-17",    "Statement": [        {            "Sid": "Deny IAM users permission to see Lambda environment variables",            "Effect": "Deny",            "Principal": {                "AWS": [                    "arn:aws:iam::1234567890:User1DeniedAccess",                    "arn:aws:iam::1234567890:User2DeniedAccess"                ]            },            "Action": [                "kms:Encrypt",                "kms:Decrypt",                "kms:ReEncrypt*",                "kms:GenerateDataKey*",                "kms:DescribeKey"            ],            "Resource": "*"        }    ]}You receive an error message that the denied IAM user sees if they try to view the function's environment variables similar to the following:"Lambda was unable to decrypt your environment variables because the KMS access was denied. Please check your KMS permissions. KMS Exception: AccessDeniedException"Related informationCreating keysAWS Lambda permissionsFollow"


Question: How can I use EC2Rescue to troubleshoot issues with my Amazon EC2 Windows instance?

I’m experiencing one of the following issues with my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance:I can’t connect to my Amazon EC2 Windows instance.I am experiencing boot issues.I need to perform a restore action.I need to fix common issues such as a disk signature collision.I need to gather operating system (OS) logs for analysis and troubleshooting.How can I use EC2Rescue to resolve these issues?

Answer: "I’m experiencing one of the following issues with my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance:I can’t connect to my Amazon EC2 Windows instance.I am experiencing boot issues.I need to perform a restore action.I need to fix common issues such as a disk signature collision.I need to gather operating system (OS) logs for analysis and troubleshooting.How can I use EC2Rescue to resolve these issues?Short descriptionEC2Rescue for EC2 Windows is a troubleshooting tool that you can run on your Amazon EC2 Windows Server instances. Use the tool to troubleshoot OS-level issues and to collect advanced logs and configuration files for further analysis. The following are some common issues that EC2Rescue can address:Instance connectivity issues due to firewall, Remote Desktop Protocol (RDP), or network interface configuration.OS boot issues due to a blue screen or stop error, a boot loop, or a corrupted registry.Any issues that might need advanced log analysis and troubleshooting.Note: You can capture a screenshot of an Amazon EC2 Windows instance to determine the state of the instance.You can run EC2Rescue manually or automatically using the AWS Systems Manager AWSSupport-ExecuteEC2Rescue Automation document.System requirementsEC2Rescue requires an Amazon EC2 Windows instance that:Runs on Windows Server 2008 R2 or laterHas .NET Framework 3.5 SPI or later installedIs accessible from an RDP connectionNote: EC2Rescue runs only on Windows Server 2008 R2 or later, but the tool can analyze the offline volumes of Windows Server 2008 or later.ResolutionFirst, choose whether you want to use the Systems Manager AWSSupport-ExecuteEC2Rescue Automation document, or run EC2Rescue manually. Then, follow the steps below for your chosen method.Use the Systems Manager AWSSupport-ExecuteEC2Rescue Automation documentThe AWSSupport-ExecuteEC2Rescue Automation document combines AWS Lambda functions with Systems Manager and AWS CloudFormation actions to automate EC2Rescue steps. For more information about how the document works, permissions requirements, and prerequisites for using the tool, see Run the EC2Rescue tool on unreachable instances.Important: The Automation workflow stops the instance. If the instance has an instance store volume, any data on the volume is lost when the instance stops. If you’re not using an Elastic IP address, the public IP address releases when the instance stops.When you're ready, run the Systems Manager AWSSupport-ExecuteEC2Rescue Automation.Run EC2Rescue manuallyYou can run EC2Rescue manually using one of the following methods:Use EC2Rescue for Windows Server GUI.Use the EC2Rescue for Windows Server command line interface (CLI).Use the AWSSupport-RunEC2RescueForWindowsTool Systems Manager Run Command.First, download EC2Rescue on your Amazon EC2 Windows instance.Note: The AWSSupport-RunEC2RescueForWindowsTool Systems Manager Run Command document method downloads and verifies EC2Rescue for Windows Server for you.Then, use EC2Rescue to troubleshoot Amazon EC2 Windows Server instance issues:Instance connectivity issues: Use the Diagnose and Rescue feature in Offline instance mode.OS boot issues: Use the Restore feature in Offline instance mode.Advanced logs and troubleshooting: Use the Capture logs feature in either Current instance mode or Offline instance mode.Current instance modeThis mode analyzes the instance that EC2Rescue is currently running. Current instance mode is read-only and doesn’t modify the current instance, so this mode doesn’t directly fix any issues. Use Current instance mode to gather system information and logs for analysis or for submission to system administrators or AWS Support.FeaturesSystem Information: Displays important system information about the current system in a text box for easy copying.Capture logs: First, select from a list of relevant troubleshooting logs. This feature then automatically gathers and packages those logs into a zipped folder under the name and location that you specify.Offline instance modeThis mode allows you to select the volume of an offline system. EC2Rescue analyzes the volume and presents automated rescue and restore options. Offline instance mode also includes the same Capture logs feature as Current instance mode.FeaturesSystem Information: Displays important system information about the current system in a text box for easy copying.Select Disk: If multiple offline root volumes are connected to the instance, this feature allows you to select a specific volume.Note: If the selected disk isn’t already online, this feature automatically brings the disk online for you.Diagnose and Rescue: Detects and provides options to automatically fix common configuration issues that prevent RDP connections or that cause instance status checks to fail. The following items are inspected for possible configuration issues:System time settingsWindows Firewall settingsRemote Desktop settingsEC2Config version and settings (Windows Server 2012 R2 and earlier)EC2Launch version and settings (Windows Server 2016 and later)Network interface settingsRestore: Set the offline instance to boot to Last Known Good Configuration or Restore registry from backup. Use this feature if you suspect an improperly configured or corrupted registry.Capture logs: First, select from a list of relevant troubleshooting logs. This feature then automatically gathers and packages those logs into a zipped folder under the name and location that you specify.Related informationUse EC2Rescue for Windows ServerUse EC2Rescue for LinuxTroubleshoot EC2 Windows instancesFollow"


Question: How can I delete an Elastic Beanstalk environment that's out of sync with a deleted Amazon RDS database?

"When I try to delete my AWS Elastic Beanstalk environment, I get the following error message in my environment's event stream: "Deleting RDS database named: xxxxxxxxx failed Reason: DBInstance xxxxxxxxx was not found during DescribeDBInstances." Next, I get another error message: "Stack deletion failed: The following resource(s) failed to delete: [AWSEBRDSDatabase]."How can I resolve these errors and delete my Elastic Beanstalk environment?"

Answer: "When I try to delete my AWS Elastic Beanstalk environment, I get the following error message in my environment's event stream: "Deleting RDS database named: xxxxxxxxx failed Reason: DBInstance xxxxxxxxx was not found during DescribeDBInstances." Next, I get another error message: "Stack deletion failed: The following resource(s) failed to delete: [AWSEBRDSDatabase]."How can I resolve these errors and delete my Elastic Beanstalk environment?Short DescriptionYou receive this error if you delete an Amazon Relational Database Service (Amazon RDS) database that was created as part of your Elastic Beanstalk environment. The lifecycle of that database is tied to your Elastic Beanstalk environment. If you delete that database from the Amazon RDS console (called an out-of-band deletion), then Elastic Beanstalk gets out of sync with your database resource and can't be deleted.Resolution1.    Open the AWS CloudFormation console.2.    In the navigation pane, choose Stacks.3.    In the Stack name column, select the stack for the Elastic Beanstalk environment that you want to delete.Note: In the Status column for your stack, you should see DELETE_FAILED.Tip: You can identify your stack by verifying that the environment ID from the Description column in the AWS CloudFormation console matches the environment ID of your Elastic Beanstalk environment.4.    Choose Delete.5.    In the pop-up window, select the AWSEBRDSDatabase check box in the Resources to retain - optional section, and then choose Delete Stack.Note: AWSEBRDSDatabase is the name of the resource that you want to retain, or skip, when you delete the stack. If you skip this database resource, the stack can delete successfully.Tip: You can also use the AWS Command Line Interface (AWS CLI) to delete a stack with the following command:aws cloudformation delete-stack --stack-name YourStackName --retain-resources AWSEBRDSDatabase6.    After the stack changes to DELETE_COMPLETE status, terminate your Elastic Beanstalk environment.Follow"


Question: How do I resolve the "Access Denied" error in Kinesis Data Firehose when writing to an Amazon S3 bucket?

"I'm trying to write data from Amazon Kinesis Data Firehose to an Amazon Simple Storage Service (Amazon S3) bucket that's encrypted by AWS Key Management Service (AWS KMS). However, I receive an "Access Denied" error message. How do I resolve this?"

Answer: "I'm trying to write data from Amazon Kinesis Data Firehose to an Amazon Simple Storage Service (Amazon S3) bucket that's encrypted by AWS Key Management Service (AWS KMS). However, I receive an "Access Denied" error message. How do I resolve this?ResolutionImportant: Make sure that the AWS Identity and Access Management (IAM) role for Kinesis Data Firehose has relevant Amazon S3 permissions. For more information about S3 permissions, see Grant Kinesis Data Firehose access to an Amazon S3 destination.To resolve the "Access Denied" error message in Kinesis Data Firehose, perform the following steps:1.    Open the AWS KMS console.2.    Choose the KMS key that is currently used to encrypt your S3 bucket.3.    Choose Switch to policy view.4.    Check that you have the required permissions in the KMS key policy. Proper access allows you to encrypt data that is written to your S3 bucket.Note: For more information about KMS key policies, see Protecting data using server-side encryption with KMS keys stored in AWS Key Management Service (SSE-KMS).5.    Update your policy, granting Kinesis Data Firehose access to the KMS key:{            "Sid": "Allow use of the key",            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::<account-ID>:role/<FirehoseRole>"            },            "Action": [                "kms:Encrypt",                "kms:Decrypt",                "kms:ReEncrypt*",                "kms:GenerateDataKey*",                "kms:DescribeKey"            ],            "Resource": "<ARN of the KMS key>"}Be sure to specify the Amazon Resource Name (ARN) of the KMS key that encrypted your S3 bucket.6.    Choose Save.You can also resolve the "Access Denied" error message without modifying the policy. To resolve the error message, perform the following steps:1.    Open the AWS KMS console.2.    Choose the KMS key that is currently being used to encrypt your S3 bucket.3.    In the Key users section, choose Add.4.    Select your Kinesis Data Firehose role.5.    Choose Add. You now have the proper permissions to write data from Kinesis Data Firehose to the encrypted S3 bucket.Related informationEditing keysFollow"


Question: How can I run an Amazon ECS task on Fargate in a private subnet?

I want to run an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate in a private subnet.

Answer: "I want to run an Amazon Elastic Container Service (Amazon ECS) task on AWS Fargate in a private subnet.Short descriptionYou can run Fargate tasks in private subnets. However, based on your use case, you might require internet access for certain operations, such as pulling an image from a public repository. Or, you might want to prevent any internet access for your tasks.To run Fargate tasks in a private subnet without internet access, use VPC endpoints. VPC endpoints allow you to run Fargate tasks without granting the tasks access to the internet. The required endpoints are accessed over a private IP address.If you need your task to access the internet from a private subnet, grant internet access using a NAT Gateway. The required endpoints are accessed over the public IP address of the NAT gateway.ResolutionCreate a VPCCreate an Amazon Virtual Private Cloud (Amazon VPC) with public or private subnets.Then, depending on your use case, follow the steps in Use a private subnet without internet access (VPC endpoints method) or Use a Private subnet with internet access sections of this article.Use a private subnet without internet access (VPC endpoints method)To create interface endpoints and an S3 gateway:Create an S3 gateway endpoint.Create ECR interface endpoints.If your task uses Secrets Manager to inject secrets into the task and CloudWatch Logs, create interface endpoints for Secrets Manager and CloudWatch Logs.Then, follow the instructions in the Create an Amazon ECS cluster and service section of this article.Use a private subnet with internet accessCreate a NAT gateway.When you create your NAT gateway, be sure that you:Place your NAT gateway inside the public subnet.Update the route table of the private subnet. For Destination, enter 0.0.0.0/0. For Target, select the ID of your NAT gateway.Then, follow the instructions in the Create an Amazon ECS cluster and service section of this article.Create an Amazon ECS cluster and serviceCreate an Amazon ECS cluster using the Networking only template (powered by Fargate).Create an Amazon ECS service.When you configure the network for the service, be sure that you:Choose the cluster that you created in step 1 for your cluster VPC.Based on the method that you chose earlier, choose the private subnet that you configured for the VPC endpoints, or the subnet that you configured for the NAT gateway.Now, your new tasks will launch in the private subnet.Follow"


Question: What S3 bucket policy should I use to comply with the AWS Config rule s3-bucket-ssl-requests-only?

I enabled the AWS Config rule s3-bucket-ssl-requests-only to be sure that my Amazon Simple Storage Service (Amazon S3) bucket policies require encryption during data transit. How can I create bucket policies that comply with this rule?

Answer: "I enabled the AWS Config rule s3-bucket-ssl-requests-only to be sure that my Amazon Simple Storage Service (Amazon S3) bucket policies require encryption during data transit. How can I create bucket policies that comply with this rule?ResolutionNote: Amazon S3 offers encryption in transit and encryption at rest. Encryption in transit refers to HTTPS and encryption at rest refers to client-side or server-side encryption.Amazon S3 allows both HTTP and HTTPS requests. By default, requests are made through the AWS Management Console, AWS Command Line Interface (AWS CLI), or HTTPS.To comply with the s3-bucket-ssl-requests-only rule, confirm that your bucket policies explicitly deny access to HTTP requests. Bucket policies that allow HTTPS requests without explicitly denying HTTP requests might not comply with the rule.To determine HTTP or HTTPS requests in a bucket policy, use a condition that checks for the key "aws:SecureTransport". When this key is true, then request is sent through HTTPS. To comply with the s3-bucket-ssl-requests-only rule, create a bucket policy that explicitly denies access when the request meets the condition "aws:SecureTransport": "false". This policy explicitly denies access to HTTP requests.Bucket policy that complies with s3-bucket-ssl-requests-only ruleFor example, the following bucket policy complies with the rule. The policy explicitly denies all actions on the bucket and objects when the request meets the condition "aws:SecureTransport": "false":{  "Id": "ExamplePolicy",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "AllowSSLRequestsOnly",      "Action": "s3:*",      "Effect": "Deny",      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"      ],      "Condition": {        "Bool": {          "aws:SecureTransport": "false"        }      },      "Principal": "*"    }  ]}Bucket policy that doesn't comply with s3-bucket-ssl-requests-only ruleIn contrast, the following bucket policy doesn't comply with the rule. Instead of using an explicit deny statement, the policy allows access to requests that meet the condition "aws:SecureTransport": "true". This statement allows anonymous access to s3:GetObject for all objects in the bucket if the request uses HTTPS. Avoid this type of bucket policy unless your use case requires anonymous access through HTTPS.{  "Id": "ExamplePolicy",  "Version": "2012-10-17",  "Statement": [    {      "Sid": "NOT-RECOMMENDED-FOR__AWSCONFIG-Rule_s3-bucket-ssl-requests-only",      "Action": "s3:GetObject",      "Effect": "Allow",      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*"      ],      "Condition": {        "Bool": {          "aws:SecureTransport": "true"        }      },      "Principal": "*"    }  ]}Related informationHow to use bucket policies and apply defense-in-depth to help secure your Amazon S3 dataFollow"


Question: Why didn't I receive a domain transfer confirmation or authorization email from Route 53?

"I'm trying to transfer my domain from another registrar to Amazon Route 53, but I didn't receive the confirmation or authorization emails. Why didn't I receive these emails, and how can I resend them so that I can transfer my domain?"

Answer: "I'm trying to transfer my domain from another registrar to Amazon Route 53, but I didn't receive the confirmation or authorization emails. Why didn't I receive these emails, and how can I resend them so that I can transfer my domain?Short descriptionIf you didn't receive the confirmation or authorization emails from Route 53, you can send a request to resend them. Before submitting a request to resend these emails, be sure that:Privacy protection features for your domain are turned offYour domain's current registrar has the correct contact informationResolutionVerify that the privacy protection feature for your domain is turned off with your current registrar.If necessary, update your registrant contact email address with your domain's current registrar.Resend your confirmation or authorization emails.Complete your domain registration transfer.Note: Due to General Data Protection Regulation (GDPR), it might not be possible to use WHOIS to determine your registrant contact information. If you're unable to transfer your domain due to GDPR, contact AWS Support.Related informationTransferring a domain to a different AWS accountTransferring registration for a domain to Amazon Route 53Contacting AWS Support about domain registration issuesFollow"


Question: How do I troubleshoot an Amazon SES configuration set that isn't working?

My Amazon Simple Email Service (Amazon SES) configuration set isn’t publishing the events that are specified in its rules. How do I troubleshoot this?

Answer: "My Amazon Simple Email Service (Amazon SES) configuration set isn’t publishing the events that are specified in its rules. How do I troubleshoot this?ResolutionApply a configuration setFirst, make sure that your configuration set is properly applied. To apply a configuration set to emails that you want to monitor, pass the name of the configuration set in the email header X-SES-CONFIGURATION-SET. For example:X-SES-CONFIGURATION-SET: example_configuration_set_nameBe sure to replace example_configuration_set_name with the name of the configuration set that you want to use. Or, you can assign a default configuration set to a specific verified identity. This makes sure that messages that are sent from the identity use the assigned configuration set.Note: If the verified identity in the FROM field has a default configuration that conflicts with a configuration set specified in the X-SES-CONFIGURATION-SET header, then the header’s configuration set takes precedence.To troubleshoot configuration sets that aren't working, verify that the configuration set is passed in the headers of the relevant emails. For more information on passing the configuration set as a header when using different methods for sending emails, see Specifying a configuration set when you send email.Amazon CloudWatch destinationIf you have issues with an Amazon SES configuration set to publish metrics to Amazon CloudWatch, then verify that the value source is configured correctly:Message tag: The message tag is a key-value pair that contains the dimension name that CloudWatch uses to pull events. For CloudWatch to detect the events, the tags must be specified as an email header using the X-SES-MESSAGE-TAGS header.Email header: With this value source, Amazon SES retrieves the dimension name and values from the email headers. However, you can't use these email headers as the dimension names: Received, To, From, DKIM-Signature, CC, message-id, or Return-Path.Link Tag: Link tags are key-value pairs. They’re used for publishing click events to CloudWatch for an email campaign that has embedded links. Be sure to verify that the link tag is configured correctly in both the embedded links and the configuration set.Amazon Simple Notification Service (Amazon SNS) DestinationIf you have issues with an Amazon SES configuration set to publish SES events to an SNS topic, then verify the following:The SNS topic is a Standard type topic. SES doesn’t support FIFO type topics.The SNS topic has an endpoint subscribed to the topic, and the correct endpoint is referenced for the published events.Note: Some endpoints have prerequisites that must be met before event publishing can begin. For instance, an Email/Email-JSON endpoint requires that you confirm the subscription before the email address can receive messages. Therefore, note the relevant requirements for each endpoint type while configuring your SNS topic.SES has the required permissions to publish notifications to your topic.If your SNS topic has encryption activated and uses an AWS KMS key, then verify that SES has the following KMS permissions on the key in use: kms:GenerateDataKeykms:DecryptAmazon Kinesis Data Firehose destinationIf you have issues with an Amazon SES configuration set to publish SES events to a Kinesis Data Firehose, then verify the following:The correct Delivery stream is being referenced for the published SES events.The AWS Identity and Access Management (IAM) role that Amazon SES uses has permissions to publish to your Kinesis Data Firehose delivery stream.Amazon Pinpoint destinationIf you have issues with an Amazon SES configuration set to publish SES events to Amazon Pinpoint, note that Amazon Pinpoint doesn’t support Delivery delays or Subscriptions event types.Follow"


Question: How do I troubleshoot time issues with my EC2 Windows instance?

I want to permanently change the time settings on my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance to my local time zone. I’m unable to change the time and date on my Instance. How do I troubleshoot this?

Answer: "I want to permanently change the time settings on my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance to my local time zone. I’m unable to change the time and date on my Instance. How do I troubleshoot this?Short descriptionThe following are common time-related issues that occur on Windows instances:Unable to change the time using Systems Settings or the Control Panel due to the following reasons:The Set Time Zone Automatically option is greyed out.The You do not have permission to perform this task error displays when trying to change time settings using the Control Panel.The time change doesn't persist after system reboots.The Amazon Time Sync Service is behind other atomic clocks by X minutes.It's a best practice to use Coordinated Universal Time (UTC) for your instances to avoid human error. Using UTC on your instances also facilitates synchronization across your AWS CloudWatch logs, metrics, local logs, and other services. You can use a different time zone to suit your requirements, if needed.ResolutionUnable to change the time using Systems Settings or the Control PanelAmazon provides the Amazon Time Sync Service, which is accessible from all EC2 instances. If you can't change the time zone and time/date, use the Command Prompt window to configure Amazon Time Sync Service on your instance.Before you begin, use the following steps to verify that the Prohibit access to Control Panel and PC settings policy is disabled in the Local Group Policy Editor:Open the Local Group Policy Editor.Select User Configuration, Administrative Templates, Control Panel.Highlight Prohibit access to Control Panel and PC settings, and then select Edit policy setting.Select Disabled.Change the time zone using Command PromptAfter verifying the policy setting, you can change the time zone from the Command Prompt window.Change the time and date settings using Command PromptRun a Command Prompt window as Administrator.Enter time or date in the Command Prompt window, then select OK.Enter the new time or date at the prompt.Enter a new time in HH:MM:SS AM/PM format. For example, 08:35:00 AM.Enter a new date in mm-dd-yyyy format. For example, 01-01-2021.The new time and date settings take effect immediately.Alternatively, you can use external network time protocol (NTP) sources. For more information, see Configure network time protocol (NTP).Note: Because the Citrix Xen Guest Agent service might cause issues with time synchronization, it's a best practice to update Citrix PV drivers to Amazon PV drivers.The time change doesn't persist after system rebootsIf you're running Windows Server 2008 or later, add a RealTimeIsUniversal registry key to make the new time persist after reboot.If your instance is domain joined to an AWS Managed Microsoft AD directory, change the time settings on your instance to use the domain controller as the time source to avoid a time skew. Skewing the time breaks authentication due to Kerberos restrictions. This might cause issues logging in to the instance. To prevent this, make sure that the RealTimeIsUniversal registry key is enabled before rebooting your instance.The Amazon Time Sync Service is behind other atomic clocks by X minutesTo resync the Amazon Time Sync Service to your instance, do the following:1.    Run the following command to reset the NTP server to point to the Amazon Time Sync Service server:w32tm /config /manualpeerlist:”169.254.169.123,0x9” /syncfromflags:manual /update2.    Run the following commands:net stop w32timew32tm /unregister3.    From the Start menu on the instance, select Run, and enter services.msc. Verify that Windows Time is deleted.4.    Run the following commands:W32tm /registerNet start w32timew32tm /query /configuration /verbosew32tm /resync /rediscover and w32tm /resync /forcew32tm /query /status /verbosew32tm /stripchart /computer:169.254.169.123 /period:5w32tm /query /sourceNote: If you see the local CMOS clock, wait a few minutes and then run the w32tm /query /source command again to verify the source.Related informationSet the time for a Windows instanceDefault network time protocol (NTP) settings for Amazon Windows AMIsFollow"


Question: What permissions do I need to access an Amazon SQS queue?

I want to access an Amazon Simple Queue Service (Amazon SQS) queue. What SQS access policy and AWS Identity and Access Management (IAM) policy permissions are required to access the queue?

Answer: "I want to access an Amazon Simple Queue Service (Amazon SQS) queue. What SQS access policy and AWS Identity and Access Management (IAM) policy permissions are required to access the queue?ResolutionTo access an Amazon SQS queue, you must add permissions to the SQS access policy, the IAM policy, or both. The specific permissions requirements differ depending on whether the SQS queue and IAM role are from the same account.Same accountA statement to allow access is required in either the SQS access policy or the IAM policy.Note: If either the SQS access policy or IAM policy explicitly allows access, but the other policy explicitly denies access, access to the queue is denied.IAM user policySQS access policyResultAllowAllowAllowAllowNeither Allow nor DenyAllowAllowDenyDenyNeither Allow nor DenyAllowAllowNeither Allow nor DenyNeither Allow nor DenyImplicit DenyNeither Allow nor DenyDenyDenyDenyAllowDenyDenyNeither Allow nor DenyDenyDenyDenyDenyDifferent accountA statement to allow access is required in both the SQS access policy and the IAM policy.IAM user policySQS access policyResultAllowAllowAllowAllowNeither Allow nor DenyImplicit DenyAllowDenyDenyNeither Allow nor DenyAllowImplicit DenyNeither Allow nor DenyNeither Allow nor DenyImplicit DenyNeither Allow nor DenyDenyDenyDenyAllowDenyDenyNeither Allow nor DenyDenyDenyDenyDenyExample policy statementsThe following example policies show the permissions that you must set on the IAM policy and SQS queue access policy to allow cross-account access for an SQS queue.The first policy grants permissions for username1 to send messages to the resource arn:aws:sqs:us-east-1:123456789012:queue_1.The second policy allows username1 to send messages to the queue.For more information on these these policies, see IAM policy types: How and when to use them.Example IAM policy statement for username1{   "Version": "2012-10-17",   "Statement": [{      "Effect": "Allow",      "Action": "sqs:SendMessage",      "Resource": "arn:aws:sqs:us-east-1:123456789012:queue_1"   }]}Example SQS resource policy statement for queue_1{   "Version": "2012-10-17",   "Id": "Queue1_Policy",   "Statement": [{      "Sid":"Queue1_AllActions",      "Effect": "Allow",      "Principal": {         "AWS": [            "arn:aws:iam::111122223333:user/username1"         ]      },      "Action": "sqs:SendMessage",      "Resource": "arn:aws:sqs:us-east-1:123456789012:queue_1"   }]}Follow"


Question: How do I configure my API Gateway REST API to pass query string parameters to a backend Lambda function or HTTP endpoint?

I need my Amazon API Gateway REST API to pass query string parameters to a backend AWS Lambda function and an HTTP endpoint.

Answer: "I need my Amazon API Gateway REST API to pass query string parameters to a backend AWS Lambda function and an HTTP endpoint.Short descriptionTo configure a REST API to pass query string parameters to a backend AWS Lambda function, use a Lambda custom integration.To pass query string parameters to an HTTP endpoint, use an HTTP custom integration.Important: Make sure that you supply the input data as the integration request payload. It’s a best practice to use a mapping template to supply the payload. For more information, see Map request and response payloads between method and integration.ResolutionPassing query string parameters to a backend Lambda function1.    Open the API Gateway console, and then choose your API.2.    In the Resources pane, choose the configured HTTP method.Note: If there’s more than one HTTP method configured for the API, then repeat steps 2 through 15 for each method.3.    In the Method Execution pane, choose Method Request.4.    Expand the URL Query String Parameters dropdown list, then choose Add query string.5.    For the Name field, enter pet, and then choose the check mark icon.6.    Choose the Required check box.7.    Choose the Method Execution pane.8.    Choose Integration Request.9.    Choose the Mapping Templates dropdown list, and then choose Add mapping template.10.    For the Content-Type field, enter application/json and then choose the check mark icon.11.    In the pop-up that appears, choose Yes, secure this integration.12.    For Request body passthrough, choose When there are no templates defined (recommended).13.    In the mapping template editor, copy and replace the existing script with the following code:{     "pet": "$input.params('pet')"}Note: For more information, see the $input variables.14.    Choose Save, and then choose Deploy the API.15.    To test the API's new endpoint, run the following curl command:curl -X GET https://jp58lnf5vh.execute-api.us-west-2.amazonaws.com/dev/lambda-non-proxy?pet=dogImportant: Make sure that the curl command has the query string parameter pet=dog.Passing query string parameters to an HTTP endpoint1.    Open the API Gateway console, and then choose your API.2.    In the Resources pane, choose the configured HTTP method.Note: If there’s more than one HTTP method configured for the API, then repeat steps two through 10 for each method.3.    In the Method Execution pane, choose Method Request.4.    Expand the URL Query String Parameters dropdown list, and then choose Add query string.5.    For the Name field, enter type, and then choose the check mark icon.6.    Choose the Method Execution pane.7.    Choose Integration Request.8.    Expand the URL Query String Parameters section.Note: By default, the method request query string parameters are mapped to the like-named integration request query string parameters. To view this, refresh the API Gateway console page. To map a method request parameter to a different integration request parameter, first delete the existing integration request parameter. Then, add a new query string with the desired method request parameter mapping expression.9.    Choose Save, then choose Deploy the API.10.    To test the API’s new endpoint, run the following curl command:curl -X GET https://jp58lnf5vh.execute-api.us-west-2.amazonaws.com/dev/http-endpoint?pet=dogImportant: Make sure that the curl command has the query string parameter pet=dog.Related informationTutorial: Build a Hello World REST API with Lambda proxy integrationTutorial: Build an API Gateway REST API with Lambda non-proxy integrationTutorial: Build a REST API with HTTP proxy integrationTutorial: Build a REST API with HTTP non-proxy integrationFollow"


Question: How do I launch and troubleshoot Spot Instances using Amazon EKS managed node groups?

I want to create a managed node group with Spot capacity for my Amazon Elastic Kubernetes Service (Amazon EKS) cluster and troubleshoot issues.

Answer: "I want to create a managed node group with Spot capacity for my Amazon Elastic Kubernetes Service (Amazon EKS) cluster and troubleshoot issues.Resolution1.    Install eksctl.Important: Make sure to check all AWS Command Line Interface (AWS CLI) commands before using them and replace instances of example strings with your values. For example, replace example_cluster with your cluster name.2.    Create a managed node group with Spot capacity in your existing cluster by running the following command:#eksctl create nodegroup --cluster=<example_cluster> --spot --instance-types=<Comma-separated list of instance types> --region <EKS cluster AWS region. Defaults to the value set in your AWS config (~/.aws/config)>Example:#eksctl create nodegroup --cluster=demo --spot --instance-types=c3.large,c4.large,c5.large --region us-east-1Note: There are other flags you can set up while creating a Spot managed node group, like --name, --nodes, --nodes-min, and --nodes-max. Get the complete list of all available flags by running the following command:#eksctl create nodegroup --help3.    If you maintain an eksctl ClusterConfig config file for your cluster, then you can also create a Spot managed node group with that file. Create Spot Instances using managed node groups with a spot-cluster.yaml config fileby running the following command:apiVersion: eksctl.io/v1alpha5kind: ClusterConfigmetadata:  name: <example_cluster>  region: <example_region>managedNodeGroups:- name: spot  instanceTypes: ["c3.large","c4.large","c5.large","c5d.large","c5n.large","c5a.large"]  spot: true4.    Create a node group using the config file by running the following command:# eksctl create nodegroup -f spot-cluster.yamlTroubleshooting issues related to Spot Instances in Amazon EKSCheck the health of a managed node group by using eksctl or the Amazon EKS console as follows:$ eksctl utils nodegroup-health --name=<example_nodegroup> --cluster=<example_cluster>The health of Spot managed node groups can degrade with an error, due to a lack of Spot capacity for used instance types. See the following error for example:AsgInstanceLaunchFailures Could not launch Spot Instances. UnfulfillableCapacity - Unable to fulfill capacity due to your request configuration. Please adjust your request and try again. Launching EC2 instance failed.Note: To successfully adopt Spot Instances, it's a best practice to implement Spot Instance diversification as part of your Spot managed node group configuration. Spot Instance diversification helps to get capacity from multiple Spot Instance pools. Getting this capacity is for both scaling up and replacing Spot Instances that might receive a Spot Instance termination notification.If your cluster Spot node groups must be provisioned with instance types that adhere to a 1 vCPU:4 GB of RAM ratio, then diversify your Spot Instance pools. Diversify your instance pools by using one of the following strategies:Create multiple node groups with each having different sizes. For example, a node group of size 4 vCPUs and 16 GB of RAM, and another node group of 8 vCPUs and 32 GB of RAM.Implement instance diversification within the node groups. Do this by selecting a mix of instance types and families from different Spot Instance pools that meet the same vCPUs and memory criteria.Use amazon-ec2-instance-selector to select the relevant instance types and families with sufficient number of vCPUs and RAM by running the following command:curl -Lo ec2-instance-selector https://github.com/aws/amazon-ec2-instance-selector/releases/download/v2.0.3/ec2-instance-selector-`uname | tr '[:upper:]' '[:lower:]'`-amd64 && chmod +x ec2-instance-selectorsudo mv ec2-instance-selector /usr/local/bin/ec2-instance-selector --versionExample:ec2-instance-selector --vcpus 4 --memory 16 --gpus 0 --current-generation -a x86_64 --deny-list '.*[ni].*'The preceding command displays a list similar to the following. Use these instances as part of one of your node groups.m4.xlargem5.xlargem5a.xlargem5ad.xlargem5d.xlarget2.xlarget3.xlarget3a.xlargeNote: Instance types of existing node groups can't be changed using Amazon EKS API. It's a best practice to create a new Spot node group with your desired instance types. Enter the following into the eksctl create nodegroup command. Note the new eksctl flag to indicate that a node group runs Spot Instances: --spot.$eksctl create nodegroup --cluster=<example_cluster> --spot --instance-types m5.xlarge,m4.xlarge,m5a.xlarge,m5d.xlarge,m5n.xlarge,m5ad.xlarge --region <example_region>Follow"


Question: How do I stop and start Amazon EC2 instances at regular intervals using Lambda?

I want to reduce my Amazon Elastic Compute Cloud (Amazon EC2) usage by stopping and starting my EC2 instances automatically.

Answer: "I want to reduce my Amazon Elastic Compute Cloud (Amazon EC2) usage by stopping and starting my EC2 instances automatically.Short descriptionYou can use AWS Lambda and Amazon EventBridge to automatically stop and start EC2 instances.Note: The following resolution is a simple solution. For a more advanced solution, use the AWS Instance Scheduler. For more information, see Automate starting and stopping AWS instances.To use Lambda to stop and start EC2 instances at regular intervals, complete the following steps:1.    Create a custom AWS Identity and Access Management (IAM) policy and execution role for your Lambda function.2.    Create Lambda functions that stop and start your EC2 instances.3.    Test your Lambda functions.4.    Create EventBridge rules that run your function on a schedule.Note: You can also create rules that react to events that take place in your AWS account.ResolutionNote: If you receive a Client error on launch error after completing the following steps, then see When I start my instance with encrypted volumes attached, the instance immediately stops with the error "client error on launch".Get the IDs of the EC2 instances that you want to stop and start. Then, follow these steps.Create an IAM policy and execution role for your Lambda function1.    Create an IAM policy using the JSON policy editor. Copy and paste the following JSON policy document into the policy editor:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "logs:CreateLogGroup",        "logs:CreateLogStream",        "logs:PutLogEvents"      ],      "Resource": "arn:aws:logs:*:*:*"    },    {      "Effect": "Allow",      "Action": [        "ec2:Start*",        "ec2:Stop*"      ],      "Resource": "*"    }  ]}2.    Create an IAM role for Lambda.Important: When attaching a permissions policy to Lambda, make sure that you choose the IAM policy that you just created.Create Lambda functions that stop and start your EC2 instances1.    Open the Lambda console, and then choose Create function.2.    Choose Author from scratch.3.    Under Basic information, add the following information:For Function name, enter a name that identifies it as the function that's used to stop your EC2 instances. For example, "StopEC2Instances".For Runtime, choose Python 3.9.Under Permissions, expand Change default execution role.Under Execution role, choose Use an existing role.Under Existing role, choose the IAM role that you created.4.    Choose Create function.5.    Under Code, Code source, copy and paste the following code into the editor pane in the code editor: (lambda_function). This code stops the EC2 instances that you identify.Example function code to stop EC2 instancesimport boto3region = 'us-west-1'instances = ['i-12345cb6de4f78g9h', 'i-08ce9b2d7eccf6d26']ec2 = boto3.client('ec2', region_name=region)def lambda_handler(event, context):    ec2.stop_instances(InstanceIds=instances)    print('stopped your instances: ' + str(instances))Important: For region, replace "us-west-1" with the AWS Region that your instances are in. For instances, replace the example EC2 instance IDs with the IDs of the specific instances that you want to stop and start.6.    Choose Deploy.7.    On the Configuration tab, choose General configuration, Edit. Set Timeout to 10 seconds, and then choose Save.Note: Configure the Lambda function settings as needed for your use case. For example, to stop and start multiple instances, you might use a different value for Timeout and Memory.8.    Repeat steps 1-7 to create another function. Complete the following steps differently so that this function starts your EC2 instances:In step 3, enter a different Function name than the one that you used before. For example, "StartEC2Instances".In step 5, copy and paste the following code into the editor pane in the code editor: ( lambda_function).Example function code to start EC2 instancesimport boto3region = 'us-west-1'instances = ['i-12345cb6de4f78g9h', 'i-08ce9b2d7eccf6d26']ec2 = boto3.client('ec2', region_name=region)def lambda_handler(event, context):    ec2.start_instances(InstanceIds=instances)    print('started your instances: ' + str(instances))Important: For region and instances, use the same values that you used for the code to stop your EC2 instances.Test your Lambda functions1.    Open the Lambda console, and then choose Functions.2.    Choose one of the functions that you created.3.    Choose the Code tab.4.    In the Code source section, choose Test.5.    In the Configure test event dialog box, choose Create new test event.6.    Enter an Event name. Then, choose Create.Note: Don't change the JSON code for the test event. The function doesn't use it.7.    Choose Test to run the function.8.    Repeat steps 1-7 for the other function that you created.Check the status of your EC2 instancesAWS Management ConsoleYou can check the status of your EC2 instances before and after testing to confirm that your functions work as expected.AWS CloudTrailYou can use CloudTrail to check for events to confirm that the Lambda function stopped or started the EC2 instance.1.    Open the CloudTrail console.2.    In the navigation pane, choose Event history.3.    Choose the Lookup attributes dropdown list, and then choose Event name.4.    In the search bar, enter StopInstances to review the results.5.     In the search bar, enter StartInstances to review the results.If there are no results, then the Lambda function didn't stop or start the EC2 instances.Create EventBridge rules that run your Lambda functions1.    Open the EventBridge console.2.    Select Create rule.3.    Enter a Name for your rule, such as "StopEC2Instances". (Optional) Enter a description for the rule in Description.4.    For Rule type, choose Schedule, and then choose Continue in EventBridge Scheduler.5.    For Schedule pattern, choose Recurring schedule. Complete one of the following steps:Under Schedule pattern, for Occurrence, choose Recurring schedule. Then complete one of the following steps:When Schedule type is Rate-based schedule, for Rate expression, enter a rate value and choose an interval of time in minutes, hours, or days.When Schedule type is Cron-based schedule, for Cron expression, enter an expression that tells Lambda when to stop your instance. For information on expression syntax, see Schedule expressions for rules.Note: Cron expressions are evaluated in UTC. Make sure that you adjust the expression for your preferred time zone.6.    In Select targets, choose Lambda function from the Target dropdown list.7.    For Function, choose the function that stops your EC2 instances.8.    Choose Skip to review and create, and then choose Create.9.    Repeat steps 1-8 to create a rule to start your EC2 instances. Complete the following steps differently:Enter a name for your rule, such as "StartEC2Instances".(Optional) In Description, enter a description for your rule, such as "Starts EC2 instances every morning at 7 AM."In step 5, for Cron expression, enter an expression that tells Lambda when to start your instances.In step 7, for Function, choose the function that starts your EC2 instances.Related informationTutorial: Schedule Lambda functions using EventBridgeEvents from AWS servicesAdding stop actions to Amazon CloudWatch alarmsScheduled Reserved InstancesFollow"


Question: Why didn't my AD users sync to IAM Identity Center?

My Active Directory (AD) users didn't sync to AWS Identity and Access Management (IAM) Identity Center (successor to AWS Single Sign-On).

Answer: "My Active Directory (AD) users didn't sync to AWS Identity and Access Management (IAM) Identity Center (successor to AWS Single Sign-On).ResolutionAfter connecting your AWS Managed AD or self-managed AD to IAM Identity Center, users in the default "Domain Users" group won't sync to IAM Identity Center. This is because IAM Identity Center can't read AD primary groups and their memberships.To resolve this issue, create new groups in your Managed AD, assign users to the groups, and then sync the users to IAM Identity Center. Using new groups instead of the default "Domain Users" group allows group membership in the IAM Identity Center identity store.For more information, see Active Directory “Domain Users” group does not properly sync into IAM Identity Center.Related informationIAM Identity Center configurable AD syncConnect to a Microsoft AD directoryHow do I get started with using IAM Identity Center and access the AWS access portal?Follow"


Question: How do I extend my Linux file system after increasing my EBS volume on my EC2 instance?

"I increased the size of my Amazon Elastic Block Store (Amazon EBS) volume, but my file systems aren't using the full volume. How do I fix that?"

Answer: "I increased the size of my Amazon Elastic Block Store (Amazon EBS) volume, but my file systems aren't using the full volume. How do I fix that?ResolutionWhen a volume is expanded to a larger size, the file system must also be resized to take advantage of the larger volume size. You can resize a file system as soon as it's in the optimizing state.The following procedure extends an 8 GB ext4 file system to get full use of a 16 GB volume. The file system is on an Amazon Elastic Compute Cloud (Amazon EC2) instance running Ubuntu.1.    Create a snapshot of your volume before changing your volume or file system. For more information, see Create Amazon EBS Snapshots.2.    Use the df -h command to show the size and the percentage used by the file system.ubuntu@ip-172-31-32-114:~$ df -hFilesystem      Size  Used Avail Use% Mounted on/dev/xvda1      7.7G  7.7G     0 100% //dev/xvdf       7.9G  7.1G  370M  96% /home/ubuntu/testIn this example, the /dev/xvdf/ file system size is 7.9G and is 96% full.3.    Use the lsblk command to show the size of the xvdf volume.ubuntu@ip-172-31-32-114:~$ lsblkNAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTxvda    202:0    0    8G  0 disk└─xvda1 202:1    0    8G  0 part /xvdf    202:80   0   16G  0 disk /home/ubuntu/testIn this example, the size of the xvdf volume is 16G.4.    Connect to your instance using SSH. For more information, see Connect to your Linux instance.5.    If the volume has a partition containing a file system, that partition must be resized before the file system is expanded.6.    Use the resize2fs command to automatically extend the size of the /dev/xvdf/ file system to the full space on the volume.ubuntu@ip-172-31-32-114:~$ sudo resize2fs /dev/xvdfNote: In this example, the volume is using an ext4 file system. Depending on your file system, you might need to use a different utility. For more information, see Extend a Linux file system after resizing a volume.7.    Rerun the df –h command.ubuntu@ip-172-31-32-114:~$ df -hFilesystem      Size  Used Avail Use% Mounted on/dev/xvda1      7.7G  7.7G     0 100% //dev/xvdf        16G  7.1G  8.0G  48% /home/ubuntu/testThe /dev/xvdf/ file system is now 16G in size and only 48% full.Related informationView information about an Amazon EBS volumeMake an Amazon EBS volume available for use on LinuxExtend a Windows file system after resizing a volumeFollow"


Question: How do I understand the configurationItemDiff field in Amazon SNS ConfigurationItemChangeNotification notifications?

"I received a ConfigurationItemChangeNotification Amazon Simple Notification Service (Amazon SNS) notification. Why did I get this notification, and how do I interpret the information in the configurationItemDiff field?"

Answer: "I received a ConfigurationItemChangeNotification Amazon Simple Notification Service (Amazon SNS) notification. Why did I get this notification, and how do I interpret the information in the configurationItemDiff field?ResolutionAWS Config creates a configuration item whenever the configuration of a resource changes (create/update/delete). For a list of resources that AWS Config supports, see Supported resource types. AWS Config uses Amazon SNS to deliver a notification as the changes occur. The Amazon SNS notification payload includes fields to help you track the resource changes in a given AWS Region. For more information, see Example configuration item change notifications.To understand why you receive a ConfigurationItemChangeNotification notification, review the configurationItemDiff details. The fields vary depending on the change type and can form different combinations such as UPDATE-UPDATE, UPDATE-CREATE, and DELETE-DELETE. The following are explanations of some common combinations.UPDATE-CREATE and UPDATE-UPDATEThe following example includes changes in the resource direct relationships and resource configurations. The configurationItemDiff details reveal the following information:Action performed: A managed policy present in the account was attached to an AWS Identity and Access Management (IAM) role.Basic operation performed: UPDATE (updating the number of associations of the resource type AWS::IAM::Policy in an account).Change type combinations:Resource direct relationship change UPDATE-CREATE. A new attachment or association was created between an IAM policy and an IAM role.Resource configuration change UPDATE-UPDATE. The number IAM policy associations increased from 2 to 3 when the policy was attached to the IAM role.Example UPDATE-CREATE and UPDATE-UPDATE configurationItemDiff notification:{    "configurationItemDiff": {        "changedProperties": {            "Relationships.0": {                "previousValue": null,                "updatedValue": {                    "resourceId": "AROA6D3M4S53*********",                    "resourceName": "Test1",                    "resourceType": "AWS::IAM::Role",                    "name": "Is attached to Role"                },                "changeType": "CREATE"                >>>>>>>>>>>>>>>>>>>> 1            },            "Configuration.AttachmentCount": {                "previousValue": 2,                "updatedValue": 3,                "changeType": "UPDATE"                 >>>>>>>>>>>>>>>>>>>> 2            }        },        "changeType": "UPDATE"    }}UPDATE-DELETEThe following example includes changes in the resource direct relationships. The configurationItemDiff details reveal the following information:Action performed: A managed policy present in the account was detached from an IAM user.Basic operation performed: UPDATE (updating the permissions policy associated with the resource type AWS::IAM::User).Change type combination: Resource direct relationship change UPDATE-DELETE. The association between an IAM user and an IAM policy in an account was deleted.Example UPDATE-DELETE configurationItemDiff notification:{  "configurationItemDiff": {    "changedProperties": {      "Configuration.UserPolicyList.0": {        "previousValue": {          "policyName": "Test2",          "policyDocument": "{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "VisualEditor0",            "Effect": "Allow",            "Action": "ec2:RunInstances",            "Resource": "arn:aws:ec2:*:*:instance/*",            "Condition": {                "StringLike": {                    "aws:RequestTag/VPCId": "*"                }            }        }    ]}"        },        "updatedValue": null,        "changeType": "DELETE"                                >>>>>>>>>>>>>>>>>>>> 3      }    },    "changeType": "UPDATE"  }}DELETE-DELETEThe following example includes changes in the resource direct relationships and resource configurations. The configurationItemDiff details reveal the following information:Action performed: An IAM role present in an account was deleted.Basic operation performed: DELETE (a resource of the resource type AWS::IAM::Role was deleted).Change type combination: Resource direct relationship change and resource configuration change DELETE-DELETE. The deletion of the IAM role also deleted the association of the IAM policy with the IAM role.Example DELETE-DELETE configurationItemDiff notification:{  "configurationItemDiff": {    "changedProperties": {      "Relationships.0": {        "previousValue": {          "resourceId": "ANPAIJ5MXUKK*********",          "resourceName": "AWSCloudTrailAccessPolicy",          "resourceType": "AWS::IAM::Policy",          "name": "Is attached to CustomerManagedPolicy"        },        "updatedValue": null,        "changeType": "DELETE"      },      "Configuration": {        "previousValue": {          "path": "/",          "roleName": "CloudTrailRole",          "roleId": "AROAJITJ6YGM*********",          "arn": "arn:aws:iam::123456789012:role/CloudTrailRole",          "createDate": "2017-12-06T10:27:51.000Z",          "assumeRolePolicyDocument": "{"Version":"2012-10-17","Statement":[{"Sid":"","Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole","Condition":{"StringEquals":{"sts:ExternalId":"123456"}}}]}",          "instanceProfileList": [],          "rolePolicyList": [],          "attachedManagedPolicies": [            {              "policyName": "AWSCloudTrailAccessPolicy",              "policyArn": "arn:aws:iam::123456789012:policy/AWSCloudTrailAccessPolicy"            }          ],          "permissionsBoundary": null,          "tags": [],          "roleLastUsed": null        },        "updatedValue": null,        "changeType": "DELETE"      }    },    "changeType": "DELETE"  }Related informationNotifications that AWS Config sends to an Amazon SNS topicFollow"


Question: How do I use CloudFront to serve HTTPS requests for my Amazon S3 bucket?

I want to configure an Amazon CloudFront distribution to serve HTTPS requests for my Amazon Simple Storage Service (Amazon S3).

Answer: "I want to configure an Amazon CloudFront distribution to serve HTTPS requests for my Amazon Simple Storage Service (Amazon S3).ResolutionOpen the CloudFront console.Choose Create Distribution.Under Origin, for Origin domain, choose your S3 bucket's REST API endpoint from the dropdown list. Or, enter your S3 bucket's website endpoint. For more information, see Key differences between a website endpoint and a REST API endpoint.Under Default cache behavior, Viewer, for Viewer Protocol Policy, select HTTP and HTTPS or Redirect HTTP to HTTPS.Note: Choosing HTTPS Only blocks all HTTP requests.If you're not using an Alternate domain name (CNAME) with CloudFront, then choose Create Distribution to complete the process. If you are using a CNAME, then follow these additional steps before you create the distribution:For Alternate Domain Names (CNAMEs), choose Add item, and then enter your alternate domain name.For Custom SSL Certificate, choose the custom SSL certificate from the dropdown list that covers your CNAME to assign it to the distribution.Note: For more information on installing a certificate, see How do I configure my CloudFront distribution to use an SSL/TLS certificate?Choose Create distribution.Note: After you choose Create distribution, 20 or more minutes can elapse for your distribution to be deployed.For information on using your distribution with Amazon S3, see Using an Amazon S3 bucket. When you use the Amazon S3 static website endpoint, connections between CloudFront and Amazon S3 are available only over HTTP. For information on HTTPS connections between CloudFront and Amazon S3, see How do I use CloudFront to serve a static website hosted on Amazon S3?Be sure to update the DNS for your domain to a CNAME record that points to the CloudFront distribution's provided domain. You can find your distribution's domain name in the CloudFront console.If you're using Amazon Route 53 as your DNS provider, then see Configuring Amazon Route 53 to route traffic to a CloudFront distribution. If you're using another DNS provider, then you can create a CNAME record (www.example.com CNAME d111111abcdef8.cloudfront.net) to point to the distribution's domain.Important: DNS standards require that an apex domain (example.com) use an authoritative (A) record that maps to an IP address. You can point your apex domain to your CloudFront distribution only if you're using Route 53. If you're using another DNS provider, then you must use a subdomain (www.example.com).For additional troubleshooting based on your endpoint type, see the following:I'm using an S3 REST API endpoint as the origin of my CloudFront distribution. Why am I getting 403 Access Denied errors?I'm using an S3 website endpoint as the origin of my CloudFront distribution. Why am I getting 403 Access Denied errors?Related informationAmazon CloudFront pricingRequiring HTTPS for communication between CloudFront and your Amazon S3 originWebsite endpointsCreate a CloudFront distributionFollow"


Question: How do I send email using Lambda and Amazon SES?

I want to use AWS Lambda to send email using Amazon Simple Email Service (Amazon SES).

Answer: "I want to use AWS Lambda to send email using Amazon Simple Email Service (Amazon SES).Short descriptionTo send email from a Lambda function using Amazon SES, complete these steps:1.    Create an AWS Identity and Access Management (IAM) policy and execution role for Lambda to run the API call.2.    Verify your Amazon SES identity (domain or email address).3.    Create or update a Lambda function that includes logic for sending email through Amazon SES.Note: To include a PDF attachment in your emails, you must use the Amazon SES SendRawEmail API operation. For more information, see Sending raw email using the Amazon SES API on GitHub.ResolutionNote: The Node.js, Python, and Ruby Lambda function code examples in this article requires modification depending on your use case. Adapt the example to your use case, or design your own in your preferred programming language.Create an IAM policy and execution role for Lambda to run the API call1.    Create an IAM policy using the JSON policy editor. When you create the policy, paste the following JSON policy document into the policy editor:{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "ses:SendEmail", "ses:SendRawEmail" ], "Resource": "*" } ]}Note: For more information and examples of how to restrict access to this policy, see Example IAM policies for Amazon SES.2.    Attach the IAM policy to an IAM role. For instructions, see the To use a managed policy as a permissions policy for an identity (console) section in Adding IAM identity permissions (console).Note: You'll assign this IAM role to your Lambda function in the following steps.Verify your Amazon SES identity (domain or email address)To verify a domain, see Verifying a DKIM domain identity with your DNS provider.To verify an email address, see Verifying an email address identity.Create or update a Lambda function that includes logic for sending email through Amazon SES1.    If you haven't done so already, create a Lambda function.Note: You can create a Lambda function by using the Lambda console or by building and uploading a deployment package.2.    In the Lambda console, in the left navigation pane, choose Functions.3.    Choose the name of your function.4.    On the Configuration tab, in the Permissions pane, look at the function's Execution Role. Verify that the IAM role with Amazon SES permissions that you created earlier is listed. If the correct IAM role isn't listed, then assign the correct role to the function.5.    Under Function code, in the editor pane, paste one of the following function code examples. Be sure to use the relevant example for your runtime and version of Node.js, Python, or Ruby.Important: Replace us-west-2 with the AWS Region that your verified Amazon SES identity is in. Replace "RecipientEmailAddress", ... with the email address or addresses that you want to send the email to. Replace SourceEmailAddress with your Amazon SES-verified sender email address, or any email address from an Amazon SES-verified domain. Optionally, edit the message body ("Test") and subject line ("Test Email").For Node.js versions 18 and newer, see the following example code:// Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.// SPDX-License-Identifier: Apache-2.0import { SESClient, SendEmailCommand } from "@aws-sdk/client-ses";const ses = new SESClient({ region: "us-west-2" });export const handler = async(event) => {  const command = new SendEmailCommand({    Destination: {      ToAddresses: ["RecipientEmailAddress", ...],    },    Message: {      Body: {        Text: { Data: "Test" },      },      Subject: { Data: "Test Email" },    },    Source: "SourceEmailAddress",  });  try {    let response = await ses.send(command);    // process data.    return response;  }  catch (error) {    // error handling.  }  finally {    // finally.  }};For Node.js versions 16 and older, see the following example code::// Copyright 2019 Amazon.com, Inc. or its affiliates. All Rights Reserved.// SPDX-License-Identifier: Apache-2.0var aws = require("aws-sdk");var ses = new aws.SES({ region: "us-west-2" });exports.handler = async function (event) {  var params = {    Destination: {      ToAddresses: ["RecipientEmailAddress", ...],    },    Message: {      Body: {        Text: { Data: "Test" },      },      Subject: { Data: "Test Email" },    },    Source: "SourceEmailAddress",  };   return ses.sendEmail(params).promise()};For Python version 3.9, see the following example code:import jsonimport boto3client = boto3.client('ses', region_name='us-west-2')def lambda_handler(event, context):        response = client.send_email(    Destination={        'ToAddresses': ['RecipientEmailAddress']    },    Message={        'Body': {            'Text': {                'Charset': 'UTF-8',                'Data': 'This is the message body in text format.',            }        },        'Subject': {            'Charset': 'UTF-8',            'Data': 'Test email',        },    },    Source='SourceEmailAddress'    )        print(response)        return {        'statusCode': 200,        'body': json.dumps("Email Sent Successfully. MessageId is: " + response['MessageId'])    }For Ruby version 2.7, see the following example code:require "aws-sdk-ses"$ses = Aws::SES::Client.new(region: "us-west-2")def lambda_handler(event:, context:)    resp = $ses.send_email({  destination: {    to_addresses: ["RecipientEmailAddress"],   },   message: {    body: {      text: {        charset: "UTF-8",         data: "This is the message body in text format.",       },     },     subject: {      charset: "UTF-8",       data: "Test email",     },   },  source: "SourceEmailAddress"})    { statusCode: 200, body: JSON.generate("Message Sent Successfully. #{resp.to_h} ") }endFor more information about using the sendEmail API, see the AWS SDK documentation for JavaScript, Python, Ruby, and Java V2.6.    Choose Deploy.(Optional) Send a test email1.    In the Lambda console, configure a test event for your function.Note: The test payload is required but isn't used for this code example.2.    Choose Test. Lambda uses Amazon SES to send the test email to your recipient.Related informationSending email using Amazon SESIdentity and access management in Amazon SESFollow"


Question: How do I copy an Amazon Redshift provisioned cluster to a different AWS account?

I want to copy an Amazon Redshift provisioned cluster from one AWS account to another. How can I do that?

Answer: "I want to copy an Amazon Redshift provisioned cluster from one AWS account to another. How can I do that?Short descriptionBefore you begin, consider the following requirements:New clusters will have a different Domain Name System (DNS) endpoint. This means that you must update all clients, application codes, and Amazon Kinesis Data Firehose delivery streams to refer to the new endpoint.Amazon Simple Storage Service (Amazon S3) log settings aren't migrated. You must activate database audit logging on the new cluster.Historic information that is stored in STL and SVL tables aren't retained in the new cluster.ResolutionTo copy an Amazon Redshift provisioned cluster to another AWS account, follow these steps:1.    Create a manual snapshot of the cluster that you want to migrate.2.    Share a cluster snapshot with another AWS account.3.    In the destination AWS account, restore the cluster from a snapshot.Related informationAmazon Redshift snapshotsHow do I move my Amazon Redshift cluster from one VPC to another VPC?Managing snapshots using the AWS CLI and Amazon Redshift APIDNS attributes for your VPCFollow"


Question: How can I optimize file transfer performance over Direct Connect?

I'm experiencing slow file transfer speeds over my AWS Direct Connect connection.

Answer: "I'm experiencing slow file transfer speeds over my AWS Direct Connect connection.ResolutionUse the following troubleshooting steps for your use case.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Use Amazon CloudWatch metrics to check for Direct Connect connection over utilization and errorsYou can use CloudWatch metrics to monitor Direct Connect connections and virtual interfaces. For Direct Connect dedicated connections, check the ConnectionBpsEgress and ConnectionBpsIngress metrics for values that exceed network port speeds. Check the ConnectionErrorCount metric for MAC level errors. For more information on troubleshooting MAC level errors, see the ConnectionErrorCount section in Direct Connect connection metrics.For hosted connections, review the VirtualInterfaceBpsEgress and VirtualInterfaceBpsIngress metrics. You can only create one Direct Connect virtual interface for each hosted connection. These metrics are an estimate of the total bitrate of network traffic for the hosted connection.For more information, see Viewing Direct Connect CloudWatch metrics.Optimizing performance when uploading large files to Amazon Simple Storage Service (Amazon S3)For uploading large files to Amazon S3, it's a best practice to leverage multipart uploads. If you're using the AWS CLI, all high-level Amazon S3 commands like cp and sync automatically perform multipart uploads for large files.Use the following AWS CLI Amazon S3 configuration values:max_concurrent_requests - The maximum number of concurrent requests. The default value is 10. Make sure that you have enough resources to support the maximum number of requests.max_queue_size - The maximum number of tasks in the task queue.multipart_threshold - The size threshold the CLI uses for multipart transfers of individual files.multipart_chunksize - When using multipart transfers, this is the chunk size that the CLI uses for multipart transfers of individual files. This value sets the size of each part that the AWS CLI uploads in a multipart upload for an individual file. This setting allows you to break down a larger file (for example, 300 MB) into smaller parts for quicker upload speeds. The default value is 8MB while the minimum value you can set is 5MB.Note: A multipart upload requires that a single file uploaded in a maximum of 10,000 parts. Be sure that the chunksize that you set balances the file size and the number of parts.max_bandwidth - The maximum bandwidth that will be consumed for uploading and downloading data to and from Amazon S3.For more information, see Migrate small sets of data from on premises to Amazon S3 using AWS SFTP.Performance tuning for Server Message Block (SMB) Windows file serversTo optimize network performance for Windows SMB file servers, the Server Message Block (SMB) 3.0 protocol must be negotiated between each client and file server. This is because SMB 3.0 uses protocol improves performance for SMB file servers including the following features:SMB Direct - This feature ensures SMB detects RDMA network interfaces on the files server and automatically uses Remote Direct Memory Access (RDMA). RDMA increases throughput, provides low latency, and low CPU utilization.SMB Multichannel - This feature allows file servers to use multiple network connections simultaneously and provides increased throughput.SMB Scale-Out - This feature allows SMB 3.0 in cluster configurations to show a share in all nodes of a cluster in an active/active configuration. This ensures the maximum share bandwidth is the total bandwidth of all file server cluster nodes.For SMB clients, use the robocopy multithreaded feature to copy files and folders to the file server over multiple parallel connections.You can also use Explicit Congestion Notification (ECN) and Large Send Offload (LSO) to reduce throughput.Check for packet loss on the Direct Connect connectionPacket loss occurs when transmitted data packets fail to arrive at their destination resulting in network performance issues. Packet loss is caused by low signal strength at the destination, excessive system utilization, network congestion and network route misconfigurations.For more information, seeHow can I troubleshoot packet loss for my Direct Connect connection?Isolate and diagnose network and application performance issuesYou can use utilities such as iPerf3, tcpdump, and Wireshark to troubleshoot Direct Connect performance issues and analyze network results. Take note of the following settings that affect network throughput on a single TCP stream:Receiver Window Size (RWS) - This indicates the maximum number of bytes the receiver can accept without overflowing buffers.The senders send buffers - This may limit the maximum number of bytes that the receiver can acknowledged. The sender can't discard unacknowledged bytes until it receives acknowledgment. Unacknowledged bytes may have to be retransmitted after a timeout period.The senders MSS (Maximum Segment Size) - The maximum number of bytes a TCP segment can have as a payload. The smaller the MSS, the less the network throughput.The Round Trip Time (RTT) - The higher the RTT is between the sender and receiver, the lower the available network bandwidth.Tip: It's a best practice for the sender to initiate several parallel connections to the receiver during file transfers.For more information, see How can I troubleshoot Direct Connect network performance issues?Related informationAWS Direct Connect featuresBest practices for configuring network interfacesFollow"


Question: How do I monitor my transit gateway and Site-to-Site VPN on a transit gateway using Network Manager?

I want to monitor my transit gateway and my Site-to-Site VPN on transit gateway. How do I do this using AWS Network Manager?

Answer: "I want to monitor my transit gateway and my Site-to-Site VPN on transit gateway. How do I do this using AWS Network Manager?ResolutionBefore you can monitor your transit gateway and your Site-to-Site VPN on a transit gateway using AWS Network Manager, you must have already done the following:Created a global networkRegistered your transit gateway to the global network.Important: If the transit gateway isn't located in the same AWS account as the global account, then you must turn on multi-account support.When the transit gateway is registered to the global network, you see metrics in the Monitoring tab. The Monitoring tab is where you can view transit gateway metrics. For additional information on visualizing and monitoring your transit gateways, see Visualize transit gateways.To monitor your Site-to-Site VPN on transit gateway using Network ManagerFirst, be sure that you have created a Site-to-Site VPN connection on your transit gateway, then do the following:Create a site to represent the physical location of your network.Create a link to represent an internet connection from a device for your new site.Create a device to represent a physical or virtual appliance for your new site.In the newly created device, choose Overview, and then choose Associate Site to associate the newly created site.Associate the customer gateway with your new device.Monitoring optionsTo view the transit gateways VPN status, do the following:Open the Network Manager console.In the navigation pane, choose Global networks.Select your global network ID.Choose Transit gateways.There are three VPN statuses:Down – The percentage of your total transit gateway VPNs that are down.Impaired VPN – The percentage of your total VPNs that are impaired.Up VPN – The percentage of your total VPNs that are up.To see the status of your tunnels, choose Devices, and then choose the VPNs tab. You can also see Amazon CloudWatch metrics for Bytes in and Bytes out for your VPN and tunnel down count in the Monitoring tab.To view events for your IPsec VPN tunnels in the global network, first choose the Transit gateways tab. Then, select the transit gateway where you created the VPN. For more information, see Status update events.You can check the event details in the Amazon CloudWatch console under Logs Insights.To check the event details, choose /aws/events/networkmanagerloggroup in the US West (Oregon) AWS Region and then run the following command:Note: Replace global network ARN with the ARN for your global network and transit gateway ARN with the ARN that you have the Site-to-Site VPN. Replace event name with one of the following events for Site-to-Site VPN:IPsec for a VPN connection has come up.IPsec for a VPN connection has gone downBGP for a VPN connection has been established.BGP for a VPN connection has gone down.Routes in one or more Transit Gateway route tables have been installed.Routes in one or more Transit Gateway route tables have been uninstalled.fields detail.region as Region, detail.changeDescription as Message, resources.1 as Resource,  @timestamp as Timestamp    | filter resources.0 = "global network ARN” and resources.1 not like 'core-network-'    and detail.transitGatewayArn= “transit gateway ARN” and detail.changeDescription= “event name”    | sort @timestamp desc    | limit 200Note: This command works only if you already onboarded to CloudWatch Logs Insights. For more information, see Monitoring your global network with CloudWatch Events.Follow"