VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I configure a conditional forwarder with CoreDNS in my Amazon EKS cluster?

I want to configure a conditional forwarder with CoreDNS in my Amazon Elastic Kubernetes Service (Amazon EKS) cluster.

Short descriptionYou can use CoreDNS to configure conditional forwarding for DNS queries sent to the domains resolved by a customized DNS server. For more information, see Customizing DNS Service on the Kubernetes website.Important: Apply the modifications in the following resolution to self-managed CoreDNS only. To make configuration changes to the CoreDNS Amazon EKS add-on, determine the settings that Amazon EKS manages by checking the Amazon EKS add-on configuration. Check the add-on configuration before making any changes, because modifying a field managed by Amazon EKS prevents Amazon EKS from managing the add-on. This could result in your changes being overwritten when an add-on is updated.Resolution1.    Modify the CoreDNS ConfigMap and add the conditional forwarder configuration:$ kubectl -n kube-system edit configmap corednsOutput:apiVersion: v1kind: ConfigMapmetadata:  annotations:  labels:    eks.amazonaws.com/component: coredns    k8s-app: kube-dns  name: coredns  namespace: kube-systemdata:  Corefile: |    .:53 {        errors        health        kubernetes cluster.local in-addr.arpa ip6.arpa {          pods insecure          fallthrough in-addr.arpa ip6.arpa        }        prometheus :9153        forward . /etc/resolv.conf        cache 30        loop        reload        loadbalance    }    domain-name:53 {        errors        cache 30        forward . custom-dns-server        reload    }Note: Replace domain-name with your domain name. Replace custom-dns-server with your custom DNS server IP address.2.    Verify that domain name resolution works:$ kubectl run busybox --restart=Never --image=busybox:1.28 -- sleep 3600$ kubectl exec busybox -- nslookup domain-nameNote: Replace domain-name with your domain name.
Question: How do I provide a counter-notice to a DMCA notice?

I have received a notice from AWS that someone has reported my content as infringing a copyright. How do I provide a counter-notice to a Digital Millennium Copyright Act (DMCA) notice?ResolutionCopyright-protected content can be removed or disabled if it was posted, used, or distributed using AWS resources without the copyright owner’s permission.If you believe that your content on AWS was removed or disabled pursuant to a DMCA takedown notice by mistake or due to misidentification of the content, you can contest the takedown by submitting a counter-notice to our DMCA Agent at ec2-abuse@amazon.com or abuse@amazonaws.com.Your counter-notice must include all the following information:The material alleged to be infringing, including its location.A statement by you declaring under penalty of perjury that you have a good-faith belief that the material at issue was either misidentified or mistakenly removed.Your name, address, and telephone number.One of the following two statements:(a) If you are located within the United States: "I consent to the jurisdiction of the United States federal district court for the judicial district in which my address is located and will accept service of process from the person who provided the notice set forth above or their agent."(b) If you are located outside of the United States: "I consent to the jurisdiction of any United States federal district court where AWS is located and will accept service of process from the person who provided the notice set forth above or their agent."Your physical or electronic signature.Note: False statements in your written counter-notice can lead to civil or criminal penalties. The AWS Abuse team won't open attachments under any circumstance. You must provide any necessary information in plaintext.What happens after you send a counter-notice?We'll review your counter-notice when we receive it. If we have questions, we'll email you asking for more information. Otherwise, if your counter-notice is complete and valid, we'll forward the information that you provided to the person who filed the complaint. If they don't notify us within 10-14 business days that they have filed a lawsuit against you, we'll take steps to restore the content that we removed or disabled.The information above is provided for general informational purposes only and is not legal advice. If you have any questions about this information or your specific situation or rights, seek legal advice from a professional.

Related informationHow do I submit a Digital Millennium Copyright Act (DMCA) notice to AWS?
Question: How can I share a portfolio with accounts in my organization using AWS Service Catalog?

I want to share a portfolio with accounts in my organization using AWS Service Catalog. Then, I want to allow users in the receiving account to view and launch those products.

Short descriptionTo share your portfolio, complete the steps in the following sections:Share the portfolio with the organization or a specific organizational unit (OU) from the provider accountImport the portfolio to the target accountAllow users to access products in the shared portfolio from the target account

ResolutionShare the portfolio with the organization or a specific OU from the provider accountOpen the AWS Service Catalog console.In the navigation pane, choose Portfolios list.To choose the portfolio that you want to share, select the radio button next to the portfolio.Choose Share Portfolio.Choose Organization.For Node Type, choose Organization or Organizational Unit based on your needs.Note: To share the portfolio with all OUs in the organization, choose Organization. To share the portfolio with a single OU within the organization, choose Organizational Unit.For Input Value, enter your organization ID or OU ID.Choose Share.Now, a message confirms that you have successfully shared your portfolio.Import the portfolio to the target accountOpen the AWS Service Catalog console of the target account.In the navigation pane, choose Portfolios.Choose the Imported tab.Choose Actions, and then choose Import portfolio.For Portfolio ID, enter the portfolio ID that has been shared with this account from the management account.Choose Import.Now, the shared portfolio is listed in the Portfolios section of the Imported tab.Allow users to access products in the shared portfolio from the target accountTo allow other users, groups, and roles to see the products shared in the portfolio, complete the following steps from the target account:Open the AWS Service Catalog console of the target account.In the navigation pane, choose Portfolios list, and then choose the shared portfolio.Choose Users, Groups, and Roles, and then choose Add user, group or role.To give an AWS Identity and Access Management (IAM) entity access to products in the portfolio, choose the Groups tab, Users tab, or Roles tab, depending on your needs.Select the IAM entity that you want to add access for.Choose ADD ACCESS.
Question: How do I publish logs for Amazon RDS or Aurora for MySQL instances to CloudWatch?

I have an Amazon Relational Database Service (Amazon RDS) or Amazon Aurora instance that's running MySQL. How can I view the DB logs for my instance in Amazon CloudWatch?Short descriptionTo view Amazon RDS logs in CloudWatch, first allow logging on the DB instance or cluster. Then, you can configure log exports on the DB instance to send the logs to CloudWatch.

ResolutionAllow logging on your DB instanceFor Amazon RDS instances that run MySQL, modify the parameters for the  general_log and slow_query_log in a custom DB parameter group that's associated with the DB instance. To allow audit logging, add the MariaDB Audit Plugin to your custom option group. For more information, see How do I activate and monitor logs for an Amazon RDS for MySQL instance?For Aurora clusters that run MySQL, modify the paramters for the general_log and slow_query_log. Allow Advanced Auditing to audit the logs for your Aurora clusters by using a custom cluster parameter group.Publish logs to CloudWatchTo publish logs to CloudWatch, configure log exports on the DB instance and then set the log_output parameter to FILE. For Aurora, any selected log types are published for all instances of an Aurora DB cluster.Configure log exportsOpen the Amazon RDS console.Choose Databases from the navigation pane.Select the instance that you want to publish logs to CloudWatch for, and then choose Modify.From the Log exports section, select the log types that you want to publish.Choose Continue, and then choose Modify DB Instance.Note: This modification doesn't require downtime.Change the value of the log_output parameterNote: This step isn't required for Aurora clusters that run MySQL 5.7 unless the value of the log_output parameter was manually modified to TABLE. For Aurora clusters that run MySQL 5.7, the default value of the log_output parameter is FILE.Open the Amazon RDS console.Choose Parameter groups from the navigation pane.Select the parameter group that's associated with the instance that you want to publish logs for.Choose Parameter group actions, and then choose Edit.Use the Filter parameters field to search for the log_output parameter.Set the value of the log_output parameter to FILE.Choose Save changes.Note: This is a dynamic parameter, so this modification doesn't require a restart. For more information, see Working with parameter groups.

Related informationHow do I modify the values of an Amazon RDS DB parameter group?MySQL database log filesPublishing Amazon Aurora MySQL logs to Amazon CloudWatch logs
Question: How can I test the upload speed of Amazon S3 Transfer Acceleration for a specific file size?

I want to use S3 Transfer Acceleration to improve the file upload speed to my Amazon Simple Storage Service (Amazon S3) bucket. I also want to compare the speeds between uploading directly to the S3 bucket and using S3 Transfer Acceleration. How can I do that?ResolutionTo compare the general upload speed across Amazon S3 Regions, you can use the Amazon S3 Transfer Acceleration Speed Comparison tool. To test the upload speed of a specific file size, use the test-upload.sh from the Amazon Web Services - Labs GitHub website.Before you run test-upload.sh, the following requirements must be met:1.    Review your AWS Identity and Access Management (IAM) user credentials to be sure that you have the permissions to enable Transfer Acceleration. You need the s3:PutAccelerateConfiguration permission to enable or disable Transfer Acceleration. Additionally, you need the s3:GetAccelerateConfiguration permission to view whether a bucket has Transfer Acceleration enabled. For more information, see Requirements for using Amazon S3 Transfer Acceleration.2.    Enable Transfer Acceleration on your S3 bucket.3.    Install and configure the AWS Command Line Interface (AWS CLI) on your machine.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.Requirements for test-upload.shBefore you run test-upload.sh, you must first install the bc language on your Linux machine. Run this command to install bc on an Ubuntu or Debian machine:apt-get install bcRun this command to install bc on an Amazon Linux, CentOS, RHEL, or Fedora machine:yum install bcRequirements for test-upload.sh on a macOS machineBefore you run test-upload.sh, you must first install coreutils on your macOS machine using Homebrew. Follow these steps:1.    (Optional) If you don't have Homebrew installed, then follow the installation instructions on the Homebrew website.2.    Run this command to install coreutils using Homebrew:brew install coreutils

Related informationUser policy examplesUsing Transfer Acceleration from the AWS Command Line Interface (AWS CLI)
Question: How can I share a subnet in a VPC with another AWS account?

I want to share a subnet in an Amazon Virtual Private Cloud (Amazon VPC) in my account with another AWS account. How can I do this?ResolutionImportant: A subnet can be shared only across accounts that are in the same AWS Organization.Turn on resource sharing within AWS Organizations using the management account.Create a resource share.Share a subnet from the account that owns the VPC (owner account) to the account that will use the subnet (participant account). The shared subnet automatically appears in the participant account.

Related informationHow Amazon VPC worksShare your VPC with other accounts
Question: Why can't I connect to a service when the security group and network ACL allow inbound traffic?

I can't connect to a service running on an Amazon Elastic Compute Cloud (Amazon EC2) instance. I allowed inbound traffic to the necessary ports in both the security group and the network access control list (network ACL), but it's still not working. How can I fix this?Short descriptionSecurity groups are stateful, so allowing inbound traffic to the necessary ports activates the connection. Network ACLs are stateless, so you must allow both inbound and outbound traffic.

ResolutionTo turn on the connection to a service running on an instance, the associated network ACL must allow the following:Inbound traffic on the port that the service is listening onOutbound traffic to ephemeral portsWhen a client connects to a server, a random port from the ephemeral port range (1024-65535) becomes the client's source port.The designated ephemeral port becomes the destination port for return traffic from the service. Outbound traffic to the ephemeral port must be allowed in the network ACL. For more information on modifying network ACL rules, see Add and delete rules.By default, network ACLs allow all inbound and outbound traffic. If your network ACL is more restrictive, then you need to explicitly allow traffic to the ephemeral port range.Note: If you accept traffic from the internet, then you also must establish a route through an internet gateway. If you accept traffic over VPN/AWS Direct Connect/Transit Gateway, then you must establish a corresponding route through a virtual private gateway/transit gateway.

Related informationControl traffic to subnets using Network ACLsControl traffic to resources using security groups
Question: Can I migrate a CloudFront distribution to another AWS account?

How can I migrate my Amazon CloudFront distribution to another AWS account?ResolutionCloudFront doesn't support the migration of a distribution from one AWS account to another AWS account.However, CloudFront does support the migration of a custom CNAME from one distribution to another distribution. You can migrate the CNAME to a distribution in the same AWS account, or to a distribution in another AWS account. For instructions on how to migrate a CNAME to another CloudFront distribution, see How do I resolve the error CNAMEAlreadyExists error when I set up a CNAME alias for my CloudFront distribution?Note: The default CloudFront domain name on your distribution can't be migrated between AWS accounts. The domain name format is similar to: d1234abcd.cloudfront.net

Related informationUsing custom URLs by adding alternate domain names (CNAMEs)Adding an alternate domain name
Question: Who turned on public access to my Amazon S3 bucket?

How can I find out which user turned on public access to an Amazon Simple Storage Service (Amazon S3) bucket?ResolutionReview the AWS CloudTrail event history to see which user updated either the bucket access control list (ACL) or the bucket policy to allow public access.Note: CloudTrail event history shows logs of up to 90 days. If the event occurred after 90 days, you must query and analyze CloudTrail logs delivered to your bucket.CloudTrail consoleFollow these steps to find the user by using the CloudTrail console:Open the CloudTrail console.From the Region selector in the navigation bar, select the AWS Region that your bucket is in.From the navigation pane, choose Event history.For Lookup attribute, select the filter that you want to use to find the event that granted public access to your bucket:To filter events by your bucket's name, select Resource name, and then enter your bucket's name.To filter events by changes to a bucket ACL, select Event name, and then enter "PutBucketAcl".To filter events by changes to a bucket policy, select Event name, and then enter "PutBucketPolicy".After you find the event that granted public access to your bucket, review the event's User name column. Then, expand the event item and choose View event to see more details, such as the user's Amazon Resource Name (ARN).AWS Command Line Interface (AWS CLI)Run this command to list CloudTrail events associated with your bucket (using your bucket's name):aws cloudtrail lookup-events --lookup-attributes AttributeKey=ResourceName,AttributeValue=example-bucket-name --region example-regionRun this command to list events that are changes to a bucket ACL:aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=PutBucketAcl --region example-regionRun this command to list events that are changes to a bucket policy:aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=PutBucketPolicy --region example-region

Related informationViewing events with CloudTrail Event historyCloudTrail record contentslookup-events
Question: How can I use AWS Identity and Access Management (IAM) to allow user access to resources?

I want to allow users or groups access to my AWS resources. How can I do that using AWS Identity and Access Management (IAM)?ResolutionYou can create IAM identities (users, groups, roles) and assign custom permissions sets (IAM policies) to those identities. This allows you to grant each user access to only the services, resources, and information that they need to perform tasks. Each user can also be assigned unique security credentials, access keys, and multi-factor authentication devices.Note: It's a best practice to grant least privilege for only the permissions required to perform a task. For more information, see Grant least privilege.You can also integrate IAM policies and permissions with directories that you already manage, including Microsoft Active Directory, AWS Directory Service, or an OpenID Connect provider. For more information, see Identity providers and federation.You can interact with IAM through the web-based IAM console, the AWS Command Line Interface, or the AWS API or SDKs. IAM is offered at no additional charge. For more information, see Getting started with IAM.For a list of AWS services that support IAM, see AWS services that work with IAM.

Related informationIdentity federation in AWSSecurity best practices in IAM
Question: How do I reset my AWS root user account MFA device?

I want to reset my AWS root user account multi-factor authentication (MFA) device. How do I reset it?ResolutionTo reset your MFA device, you must have access to the AWS root user account email address and phone number associated with the account.Note: If you are an AWS Identity and Access Management (IAM) user, you can't reset MFA by yourself. You must contact your administrator to deactivate the device. For more information, see Recovering an IAM user MFA device.Sign in using your AWS account root user email address.On the Root user sign in page, enter the password of your root account.On the Amazon Web Services Sign In With Authentication Device page, choose Troubleshoot MFA? Click here.On the Troubleshoot Your Authentication Device page, choose Sign In using alternative factors.On Step 1: Email address verification, validate that the email address is correct and choose Send verification email.In the email from AWS with the subject line, AWS Email Verification, choose Verify your email address. The Step 2 page in the verification process appears.On Step 2: Phone number verification, confirm the phone number listed is correct, and then choose Call me now.Note: If you didn't receive the automated telephone call or you need to update the phone number, see How do I update my telephone number to reset my lost MFA device?Answer the phone call from AWS and use your phone’s keypad to submit the six-digit verification code that appears on your device's screen.On Step 3: Sign In, choose Sign in to the console. You are automatically redirected to your Security Credentials.Choose Deactivate, next to the MFA device that you want to reset.Choose Activate MFA to add an MFA device.Note: It's a best practice to enable a new MFA device on your root account as soon as possible to make sure that your root account is protected by MFA.If you lost your MFA device, you can still protect your root account with MFA by adding a virtual device, see Enabling a virtual multi-factor authentication (MFA) device.If you need additional assistance, see Lost or unusable multi-factor authentication (MFA) device . Choose the button I'm still having problems and would like to contact AWS Support. Then, complete the Request assistance with lost or unusable MFA device form and choose Submit.
Question: Why can't I see Amazon EMR cluster logs in an S3 bucket that has an attached policy enforcing SSE-KMS encryption?

My Amazon EMR cluster logs aren't being archived to the Amazon Simple Storage Service (Amazon S3) bucket that I specified. The S3 bucket has an attached policy that enforces server-side encryption with AWS Key Management Service (SSE-KMS). Log writing fails with a 403 error similar to the following:2020-01-15 04:01:25,247 INFO logspusher-6: Failed to upload 126 logs:USE: /emr/instance-state/instance-state.log-2020-01-14-20-15.gz reason: Access Denied (Service: Amazon S3; Status Code: 403; Error Code: AccessDenied; Request ID: 8B99FE94D1678AAB)

Short descriptionWhen logging is enabled for an Amazon EMR cluster, the LogPusher service archives cluster logs to the specified S3 bucket. LogPusher uses AES-256 encryption, rather than SSE-KMS, to write logs. To write logs to an S3 bucket that has an SSE-KMS encryption policy, use the sync command to manually upload the files.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.

ResolutionNote: With Amazon EMR version 5.30.0 and later (except Amazon EMR 6.0.0), you can encrypt log files stored in Amazon S3 with an AWS KMS customer managed key.1.    Connect to the master node using SSH.2.    Find the log files that you want to copy. For example, step logs are stored at /mnt/var/log/hadoop/steps on the master node.3.    To copy the log files to the S3 bucket, run the sync command with the --sse-kms-key-id field. Example:aws s3 sync /mnt/var/log/hadoop/steps/ s3://awsexamplebucket/elasticmapreduce/${cluster_id}/steps/ --sse aws:kms --sse-kms-key-id 17246c74-6ff4-4adb-86e5-76f7f1603f00You can use a cron job to automate the sync command. To configure the cron job, run a custom bootstrap action on all nodes when you launch an Amazon EMR cluster.

Related informationProtecting data using server-side encryption with AWS KMS keys stored in AWS Key Management ServiceWhat happens to new or existing objects when I enable default encryption with AWS KMS on my Amazon S3 bucket?