VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I log a query for Amazon Route 53?

I want to know what logging options are supported in Amazon Route 53 and how I can log different DNS queries.

Short descriptionIf you configure Amazon Route 53 as the DNS hosting service for your domain, then you can log all of the public DNS queries.By default, Amazon Virtual Private Cloud (Amazon VPC) uses Amazon Route 53 Resolver to resolve DNS queries that originate from your VPC resources. Route 53 Resolver uses Resolver query logging to log all DNS queries.

ResolutionPublic DNS query loggingYou must turn on Route 53 public query logging in each public hosted zone. Amazon Route 53 publishes the logs to Amazon CloudWatch Logs. Public query logging records the following information for all DNS queries:Log format versionQuery timestampHosted Zone IDQuery nameQuery typeDNS response codeLayer 4 protocolRoute53 edge locationResolver IP addressEDNS client subnetTurn on public DNS query loggingYou must turn on public DNS query logging in the AWS account that hosts your DNS. For more information, see Configuring logging for DNS queries.Resolver query loggingRoute 53 Resolver query logging records all DNS queries that your resolver handles. These query logs are useful in troubleshooting the following DNS queries:DNS queries generating from your VPCsDNS queries that inbound and outbound Resolver endpoints handleRoute 53 Resolver DNS firewall actionsYou can use CloudWatch Logs, an Amazon Simple Storage Service (Amazon S3) bucket, or Amazon Kinesis Data Firehose as your log destination.Resolver query logs collect the following details for all DNS queries:Query log versionAccount IDRegionVPC IDQuery timestampQuery nameQuery typeQuery classResponse codeAnswer typeRDATAAnswer classSource addressTransport layer protocolSource IDsInstance IDResolver endpointFirewall rule group IDFirewall rule actionFirewall domain list IDTurn on Resolver query loggingFor information on turning on Resolver query logging, see Managing Resolver query logging configurations.

Related informationMonitoring Amazon Route 53
Question: How do I reset a lost or broken MFA device for my AWS root user account?

I enabled multi-factor authentication (MFA) for AWS Identity and Access Management (IAM) users or the AWS account root user. I need to reset a lost or broken MFA device, but I no longer have access to my root user account.

ResolutionFollow these instructions to get access to your AWS root user account. Then, reset the MFA account.Get access to your AWS root user accountIf you have access to the root user email address and phone number, then follow the instructions for Recovering a root user MFA device.If you have access to the root user email address but don't have access to the phone number, then see How do I update my telephone number to reset my lost MFA device?If you need to reset or recover an AWS IAM or root user password, see How do I recover a lost or forgotten AWS password?If you need additional assistance, see Lost or unusable multi-factor authentication (MFA) device. Expand I'm still having problems and would like to contact AWS Support. Then, complete the Request assistance with lost or unusable MFA device form, and choose Submit.Reset the MFA deviceNow that you have access to your AWS root user account, follow the instructions for Recovering an IAM user MFA device.For more information, see Using multi-factor authentication (MFA) in AWS.

Related informationHow can I troubleshoot the "entity already exists" error when an IAM user tries to create a new MFA device?How can I require MFA authentication for IAM users that use the AWS CLI?How do I use an MFA token to authenticate access to my AWS resources through the AWS CLI?Reset your AWS root user account's lost MFA device faster by using the AWS Management Console
Question: Why does my Aurora PostgreSQL-Compatible instance have high CPU utilization after a major version upgrade?

My Amazon Aurora PostgreSQL-Compatible DB instance has a high CPU after a major version upgrade. Before the upgrade, my DB instance performed well.

Short descriptionFirst, follow the Aurora PostgreSQL-Compatible major upgrade process to make sure that your upgrade was successful. There are a number of steps to take before and after your major version upgrade, so check that you've followed the process step-by-step. If you skip any of the steps in the process, your upgrade might fail. Or, you might experience performance impacts, like high CPU, even if the upgrade itself is successful.

ResolutionBefore you upgrade a production Aurora PostgreSQL-Compatible cluster to a new major version, test the upgrade on a duplicate of your production database. To create a duplicate test instance, you can either restore your database from a recent snapshot, or clone your database.Every major version includes enhancements to the query optimizer that are designed to improve the database performance. But the DB planner/optimizer might not choose the most optimal plan for running your queries. As a result, you might see performance degradation when running the same queries in a new major version. So, it's a best practice to always test and review the performance of your queries before performing a major version upgrade. In Aurora PostgreSQL-Compatible, you can use the Query Plan Management (QPM) feature to manage query plan stability across different major versions.One main reason for high CPU utilization after a major version upgrade is that statistics aren't up to date. This happens because the statistics data that is stored in the catalog pg_statistic isn't transferred during the major version upgrade. This can cause the DB optimizer to not choose the most optimal plan for running your queries. To avoid this issue, regenerate all statistics running the ANALYZE operation to refresh the pg_statistic table. Do this for every database on your Aurora PostgreSQL-Compatible DB instances.Note: Make sure to run the ANALYZE command without any parameters to generate statistics for all regular tables in the current database.ANALYZE VERBOSEIf you experience performance issues after following these steps, see How can I troubleshoot high CPU utilization for Amazon RDS or Amazon Aurora PostgreSQL?Related informationEnsuring plan stability after a major version upgrade
Question: How do I make sure that the email that I received is actually from Amazon?

I received an email that looks like it's from Amazon, but I'm not sure and want to protect myself.

ResolutionBe aware that forged email addresses can appear to come from Amazon.com or another Amazon domain. If you receive an email that appears to be from Amazon, but you're not sure that it is, don't open any links or attachments.Instead, sign in to your Amazon Web Services (AWS) account or Amazon.com account to take action or view notifications.If you're still not sure, check the following:Does the subject of the email match the content of the email?Are the grammar and spelling of the email correct? Incorrect grammar or spelling often indicates suspicious sources.Does the email request the password or any other account-specific details of your Amazon account? Amazon and AWS never request sensitive information over email.Does the content of the email make sense in context? For example, if the email appears to be confirming a password reset, have you recently reset your password? If it appears to be requesting address information to complete an order, have you recently ordered anything from Amazon.com?If you can answer "no" to one or more of the preceding questions, the email you received might be a spoofing email. For more information on identifying spoofing attempts, see Identifying whether an email, phone call, text message, or webpage is from Amazon.To report potential email spoofing scams, see Report suspicious emails.

Related informationAWS Compliance Support contact usHow do I stop receiving email spam?How do I unsubscribe from AWS emails?
Question: Why do I need to put my tax registration number (TRN) on all accounts in my organization in AWS Organizations?

Why do I need to put my tax registration number (for example, a VAT number or VAT ID) on all accounts in my organization in AWS Organizations?Short descriptionAWS assesses whether tax is due on the usage of each individual account based on the following:Each account's contact address.Each account's billing address.Each account's Tax Registration Number (TRN), if applicable.Adding a TRN to each applicable account means that the relevant TRN appears on each of your tax invoices. This enables you to claim credits from your local tax authorities, if applicable.

ResolutionAdding a TRN, business legal name, and business legal address to each of these accounts in your organization does the following:Identifies each account as a "Business" customer.Helps determine if AWS needs to collect tax for each individual account.Allows AWS to issue tax-compliant invoices for each applicable account.The TRN on a member account can be the same as the TRN on the payer account. Accounts with the same TRN are grouped together on a single, itemized VAT invoice. If there are accounts in your organization without a TRN, each account receives its own tax invoice, if applicable.If your organization includes different legal entities or different countries, you can have different TRNs for each account. Payer accounts in an organization can check or update multiple linked accounts at the same time.For example, assume that your organization has the following:A payer account with a specific TRN.Four member accounts with the same TRN as the payer account.Six member accounts without a TRN.You receive a total of seven VAT invoices:One VAT invoice for the five accounts sharing the same TRN.One invoice for each account without a TRN.If your TRN is applicable to the six accounts that don't currently have a TRN, and you add the TRN to these accounts, you receive only one VAT invoice.You can use the tax registration number of the payer account for your linked accounts by enabling your tax settings inheritance. When you enable tax settings inheritance, the tax registration information on the payer account is added to all accounts in your AWS Organizations account. This feature saves you the effort of registering redundant information. After you enable tax setting inheritance, the tax information on all accounts in your organization is consistent. You receive a single tax invoice that consolidates the usage from all accounts in your organization. For information on how to enable tax settings inheritance, see Enabling tax setting inheritance.

Related informationHow do I add or update my tax registration number or business legal address for my AWS account?What do I do if the tax I'm charged for AWS services is incorrect?
Question: How can I be notified when a DataSync task execution succeeds or fails?

I want to know when my AWS DataSync task execution succeeds or fails. How can I set up notifications for a DataSync task execution?ResolutionConfigure Amazon Simple Notification Service (Amazon SNS) and Amazon EventsBridge to send you an email notification when a DataSync task execution status changes to SUCCESS or ERROR. Follow these steps:Important: Before you begin, you must have already created a DataSync task.Create an Amazon SNS topic and subscribe your email to the topic1.    Open the Amazon SNS console.2.    In the navigation pane, choose Topics.3.    Choose Create topic.4.    For Name, enter a name for this topic.5.    Choose Create topic.6.    On the page of your newly created topic, choose the Subscriptions tab.7.    Choose Create subscription.8.    On the Create subscription page, enter the following:For Protocol, select Email.For Endpoint, enter the email address where you want to receive notifications.9.    Choose Create subscription.10.    You'll receive a subscription confirmation message at the email address that you specified. Choose the Confirm subscription link in the email message.Create an EventBridge rule for DataSync and set the SNS topic as the target1.    Open the Amazon EventBridge console.2.    In the navigation pane, choose Rules.3.    Choose Create rule.4.    Enter a name and description for the rule.5.    For Define pattern, select Event pattern.6.    For Event matching pattern, select Pre-defined pattern by service.7.    For Service provider, select AWS.8.    For Service name, select Datasync.9.    For Event type, select Datasync Task Execution State Change.10.    Under Event pattern, copy and paste the following JSON code:{  "source": [    "aws.datasync"  ],  "detail-type": [    "DataSync Task Execution State Change"  ],  "detail": {    "State": [      "SUCCESS",      "ERROR"    ]  }}11.    Under Select Targets, do the following:For Target, select SNS topic.For Topic, select the topic that you created.12.    Choose Create.Start a DataSync task to test email notificationsTo test email notifications for DataSync task execution, first create a task, and then start the task.After you start the task, you'll get an email notification about the status of the DataSync task execution. For a task execution that succeeded, you receive a notification similar to the following:{"version":"0","id":"example0-c014-d9e9-d7ac-44f00d5d1200","detail-type":"DataSync Task Execution State Change","source":"aws.datasync","account":"111122223333","time":"2019-01-23T12:35:26Z","region":"us-west-2","resources":["arn:aws:sync:us-west-2:9111122223333:task/task-example23d67d5be5/execution/exec-example316440271f"],"detail":{"State":"SUCCESS"}}Related informationDataSync task statusesCreating Amazon EventBridge rules that react to events
Question: How can I set up my VPC endpoint service to use a custom private DNS name?

I'm a service provider. I created a virtual private cloud (VPC) endpoint service (AWS PrivateLink) in my Amazon Virtual Private Cloud (Amazon VPC). How can I confirm that consumers of my service can access my VPC endpoint using a custom private domain name system (DNS) name?Short descriptionService providers can specify a private DNS name for a new or existing endpoint service. To use a private DNS name, you need to turn on the feature and then specify a private DNS name. Before your service consumers can use the private DNS name, you must verify that you control the domain or subdomain. You can initiate domain ownership verification using the Amazon VPC console or API. After the domain ownership verification is complete, consumers can access the endpoint using the private DNS name.

ResolutionService provider configurationCreate a VPC endpoint service, if you don't already have one. Be sure to turn on "Private DNS Name" and provide the private DNS name when creating your VPC endpoint service. If you created an endpoint service but didn't specify a private DNS name, you can associate a private DNS name with your endpoint service.As a service provider, you must create DNS records in the public domain used for the private DNS validation. You can register or add a new domain using Amazon Route 53.View the endpoint service private DNS name configuration details. Note the "Domain verification value" and "Domain verification name" that you need to create the DNS server records.Add the provided TXT record to the DNS service for your domain. If you're using Route 53 as a DNS provider, see Creating records by using the Amazon Route 53 console.Verify the private DNS name to confirm that you (the service provider) own the domain name. For verification steps, see Domain ownership verification.Service consumer configurationSet "enableDnsHostnames" and "enableDnsSupport" to "true" for the VPC where you plan to configure the VPC interface endpoints. For more information, see View and update DNS attributes for your VPC.Create the VPC interface endpoints in the VPC of your service consumer account using the service name provided by the service provider. You can't turn on private DNS names until the endpoint connection request is accepted by the service provider.Note: If your service provider doesn't require their acceptance, you can turn on private DNS names and then skip the following steps.Contact the service provider to request their acceptance of the connection request. See Accept or reject connection requests.Note: After an interface endpoint is accepted, it is in the "Available" state. You can verify the endpoint's acceptance by referring to the "Status" of the VPC interface endpoint in your service consumer account.Modify the private DNS names for the VPC interface endpoint that you created in step 2, and then select "Enable for this endpoint".

Related informationShare your services through AWS PrivateLinkManage DNS names for VPC endpoint services
Question: Why is there an unknown principal format in my IAM resource-based policy?

I tried to edit and save my AWS Identity and Access Management (IAM) resource-based policy, but it has an unknown principal with random characters.

Short descriptionIf your resource-based policy contains a Principal element with an Amazon Resource Name (ARN) for specific IAM entities, the ARN changes to a unique principal ID when it's saved. This unique Principal ID has the prefix AIDA for IAM users, and AROA for IAM roles.Example format before the resource-based policy is saved:"arn:aws:iam::123456789012:user/user-name""arn:aws:iam::123456789012:role/role-name"Example format after the resource-based policy is saved:"AIDAJQABLZS4A3QDU576Q""AROAKSCDLFT9R5DQP782U"For more information, see IAM role principals.

ResolutionThe unique principal ID in a resource-based policy indicates that the IAM user or role was deleted. The principal ID appears because AWS can't map it back to a valid ARN. If you edit the resource-based policy, you must either remove the principal ID or replace it with a valid Principal ARN. The ARN changes to the user or roles new unique ID after you save the policy.For more information, see IAM role principals.

Related informationHow can I use AWS Identity and Access Management (IAM) to allow user access to resources?How do I allow users from another account to access resources in my account through IAM?How can I resolve the IAM trust policy error "Failed to update trust policy. Invalid principal in policy"?
Question: What is Amazon Mechanical Turk?

What is Amazon Mechanical Turk?ResolutionAmazon Mechanical Turk is a forum where Requesters post work as Human Intelligence Tasks (HITs). Workers complete HITs in exchange for a reward. You write, test, and publish your HIT using the Mechanical Turk developer sandbox, Amazon Mechanical Turk APIs, and AWS SDKs.Here are some common tasks posted by Requesters:Localization and transcription servicesAudio editingInformation gathering tasks (surveys)Machine learningInformation gatheringPhoto and video processingData collectionTo set up your AWS account and develop solutions using the Mechanical Turk web service, see Setting up accounts and tools. For other common scenarios and resources, see Common use scenarios.

Related informationAmazon Mechanical TurkAmazon Mechanical Turk FAQsAmazon Mechanical Turk Worker FAQsImplementing Amazon Mechanical Turk
Question: How do I identify the cause of Lambda function invocation spikes?

My AWS Lambda function invocation requests have increased causing a billing spike.

ResolutionFollow these instructions to detect, stop, and identify the cause of the invocation requests.Detect the increased invocation requestsSet up an Amazon CloudWatch alarm for Lambda function invocations or throttle metrics. The alarm then notifies user of the number of invocation requests. For instructions, see Create a CloudWatch alarm based on a static threshold.Stop the increased invocation requestsUse reserved concurrency and set the amount of concurrency to 0 to throttle all function invocations. For more information, see Managing concurrency for a Lambda function.Identify the cause of the invocation requests spikeUse these best practices to identify the cause of the invocation spike.Turn on AWS CloudTrail data events. The Lambda invoke API action are then logged in CloudTrail for analysis of patterns and the source of the invocations.Log the event object for the Lambda function. The event object provides the Lambda function data and metadata.Be sure that the client or source application isn't undergoing a DDoS attack that invokes the Lambda function into unexpected spikes.Avoid using recursive function code in the Lambda function. Recursive Lambda function code calls itself until the condition is met. This results in unexpected function invocations and billing charges. For more information, see Best practices for working with AWS Lambda functions.

Related informationRecursive patterns that cause run-away Lambda functionsUsing Lambda with Amazon Simple Storage Service (Amazon S3)
Question: How do I update the image of an existing Amazon AppStream 2.0 fleet?

I want to update my Amazon AppStream 2.0 fleet with a new image. How do I do this?ResolutionYou can update a running fleet with a new image using the AppStream 2.0 console or the AWS Command Line Interface (AWS CLI).Note: Updating the image doesn't disrupt users who are connected to an active streaming session. The streaming instance is terminated after the streaming session is finished. Any new streaming instances use the updated image. All existing fleet instances must be exhausted before new sessions begin to launch with the updated image. To rapidly push the new image to all new sessions, you must stop and start the fleet. For more information, see Update an AppStream 2.0 fleet with a new image.Use the AppStream 2.0 consoleOpen the AppStream 2.0 console, and then choose Fleets from the navigation pane.Select the fleet that you want to update.For Actions, choose Edit.For Name, choose the new image.Choose Update Fleet.Use the AWS CLINote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.For public and private images, enter the following command, replacing ExampleImage and ExampleFleet with your values:aws appstream update-fleet --image-name ExampleImage --name ExampleFleetShared images require the image-arn parameter. For shared images, use the following command, replacing arn:aws:appstream:us-east-1:123456789012:image/ExampleImage and ExampleFleet with your values:aws appstream update-fleet --image-arn  arn:aws:appstream:us-east-1:123456789012:image/ExampleImage --name ExampleFleet

Related informationWhat is Amazon AppStream 2.0?Fleets and stacksUsing the AWS CLIFleet Auto Scaling for Amazon AppStream 2.0