VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why am I unable to read or update a KMS key policy in AWS KMS?

I want to update a AWS KMS key policy in AWS Key Management Service (AWS KMS). I verified that I have administrator permissions for my AWS Identity and Access Management (IAM) identities (users, groups, and roles), but I can't read or update the KMS key policy.

Short descriptionIAM principals must have the API action permission GetKeyPolicy to read a key policy, and PutKeyPolicy to update a policy. These permissions are granted either directly with the key policy, or a combination of the key and IAM policies. For more information, see Managing access to AWS KMS keys.The default KMS key IAM policy contains a statement similar to the following:{  "Sid": "Enable IAM User Permissions",  "Effect": "Allow",  "Principal": {    "AWS": "arn:aws:iam::111122223333:root"  },  "Action": "kms:*",  "Resource": "*"}The IAM entities for the AWS account 111122223333 can perform any AWS KMS actions allowed in the attached policy. If the entities can't perform API actions such as GetKeyPolicy or PutKeyPolicy even if allowed permissions in their attached policies, then the statement "Enable IAM User Permissions" might have changed.

ResolutionVerify IAM policy permissionsMake sure that your IAM entities have permission to read and update a KMS key similar to the following IAM policy:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "kms:Create*",        "kms:Describe*",        "kms:Enable*",        "kms:List*",        "kms:Put*",        "kms:Update*",        "kms:Revoke*",        "kms:Disable*",        "kms:Get*",        "kms:Delete*",        "kms:TagResource",        "kms:UntagResource",        "kms:ScheduleKeyDeletion",        "kms:CancelKeyDeletion"      ],      "Resource": "arn:aws:kms:*:111122223333:key/*"    }  ]}Use CloudTrail event history1.    Open the AWS CloudTrail console, and then choose Event history.2.    Choose the Lookup attributes dropdown list, and then choose Event name.3.    In the search window, enter PutKeyPolicy.4.    Open the most recent PutKeyPolicy event.5.    In Event record, copy the policy, and paste it into your favorite text editor.6.    Parse the policy into a readable format.7.    In the IAM policy Sid "Allow access for Key Administrators", note the IAM identity administrators similar to the following:{  "Sid": "Allow access for Key Administrators",  "Effect": "Allow",  "Principal": {    "AWS": [      "arn:aws:iam::111122223333:role/Administrator"    ]   },Key administrators can then be used to regain access to the key.Use Athena queriesIf the CloudTrail event history event is past 90 days, you can use Amazon Athena to search through CloudTrail logs.For instructions, see Using the CloudTrail console to create an Athena table for CloudTrail logs.For more information, see How do I automatically create tables in Athena to search through CloudTrail logs?Related informationBest practices for managing AWS access keysAWS KMS keys
Question: Why aren't my Amazon EC2 Reserved Instances applying to my AWS billing in the way that I expected?

I purchased an Amazon Elastic Compute Cloud (Amazon EC2) Reserved Instance (RI), but it's being used in a way that I didn't expect.

ResolutionIf your RI isn't applying to any usage at all, see Why isn't my Reserved Instance applying to my AWS billing?The most common reason that an RI discount isn't applying to the instance in the way that you expect is that the terms of the RI don't match any instances running on your account. The RI that you purchase must match the platform, type, size (or size footprint), Availability Zone (if applicable), and tenancy of a running On-Demand Instance for it to apply. Check the terms of your RI and the instance it applies to.If your RI is active and matches the specifications of a running On-Demand Instance, then use Cost Explorer to analyze your spending and usage. You can use AWS Cost Explorer to generate the RI Utilization and RI coverage reports. For more information, see How do I view my Reserved Instance utilization and coverage?If the RI terms do match the instance that you intended it to apply to, consider the following:RI discounts are applied differently in an organization's consolidated bill, depending on whether RI sharing is turned on or off. For more information, see How is the pricing benefit of a Reserved Instance applied across an organization's consolidated bill?For size-flexible RIs, the billing benefit isn't necessarily applied to an instance exactly matching the terms of the RI before it matches a complementary grouping of smaller instances. For example, if you run an m3.large instance and two m3.medium instances, and you purchase a Reserved Instance for an m3.large instance, the RI billing benefit might apply to either of these groups of instances. To see which instances are covered by RIs on your account, use one of the bill reporting options here: How do I find out if my Amazon EC2 Reserved Instances are being fully used?Related informationHow can I find out if my Amazon EC2 Reserved Instance provides regional benefit or size flexibility?
Question: How do I increase logging levels for the AWS SCT when using AWS DMS?

How can I increase logging levels for the AWS Schema Conversion Tool (AWS SCT) when using the AWS Database Migration Service (AWS DMS)?ResolutionInstall the AWS SCT, and then confirm that you installed the required database drivers on your system.After installation, check that you see the AWS Schema Conversion Tool in your applications folder.Open the application by choosing the icon.Note: If you see an update notification, you can choose to update before or after your project is complete.If an auto-project window opens, close the window, and then create a project manually.Choose Settings, and then select Global settings.From the Global settings window, choose Logging.In the Debug mode field, select True.From the Message level section, you can modify the following types of logs:GeneralLoaderParserPrinterResolverTelemetryConverterBy default, all Message levels are set to Info. For each of the Message level types, you can choose from these levels of logging:Trace (most detailed logging)DebugInfoWarningError (least detailed logging)CriticalMandatoryChoose Apply to modify other settings for your project. Choose OK to close the Global settings window.

Related informationHow do I install the AWS SCT and database drivers for Windows to convert the database schema for my AWS DMS task?Working with AWS DMS TasksTroubleshooting migration tasks in AWS Database Migration ServiceWhat is the AWS Schema Conversion Tool?
Question: How can I get temporary credentials for an IAM Identity Center user using the AWS CLI?

I want to get temporary credentials for an AWS IAM Identity Center (successor to AWS Single Sign-On) user.

Short descriptionConfiguring a named profile to use IAM Identity Center creates a JSON file in the $ cd ~/.aws/sso/cache directory. The JSON file contains a JSON Web Token (JWT) used to get the temporary security credentials with the get-role-credentials API call. The access token is valid for 8 hours as noted in the expiresAt timestamp in the JSON file. Expired tokens must re-authenticate using the get-role-credentials API call.

ResolutionYou can use the AWS Command Line Interface (AWS CLI) to get the temporary credentials for an IAM Identity Center user.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent AWS CLI version.Open the JSON file and copy the access token:$ cat 535a8450b05870c9045c8a7b95870.json{"startUrl": "https://my-sso-portal.awsapps.com/start", "region": "us-east-1", "accessToken": "eyJlbmMiOiJBM….”, "expiresAt": "2020-06-17T10:02:08UTC"}Run the AWS CLI command get-role-credentials to get the credentials for the IAM Identity Center user similar to the following:$ aws sso get-role-credentials --account-id 123456789012 --role-name <permission-set-name> --access-token eyJlbmMiOiJBM…. --region <enter_the_same_sso_region_same_in_the_JSON_file>Example output:{    "roleCredentials": {        "accessKeyId": "ASIA*************”,        "secretAccessKey": “**********************************”,        "sessionToken": “****************************************”,        "expiration": 1592362463000    }}Then, follow the instructions to configure the credentials as environment variables.

Related informationHow do I use IAM Identity Center permission sets?
Question: How do I remove an AWS Backup Vault Lock?

I want to delete an AWS Backup Vault Lock for my backup vault.

ResolutionWhen you create a vault lock, you have a choice of two modes: governance or compliance mode. For more information on modes, see Vault lock modes.A vault lock with compliance mode has a grace time period. To delete a vault lock with compliance mode, you must delete the lock before the grace time expires. After the grace time is expired, the vault and its lock are immutable. No user or service can change it. If you try to delete the vault lock after the grace time period, you receive an InvalidRequestException error.To delete a vault lock with governance mode, you must have the appropriate AWS Identity and Access Management (IAM) permissions. The required IAM permission to delete a backup vault is backup:DeleteBackupVaultLockConfiguration.Delete a vault lock using the AWS Backup consoleTo delete a vault lock with governance mode or compliance mode (during grace time), complete the following steps:Open the AWS Backup console.In the navigation pane, under My account, choose Backup vaults. Then, choose Backup Vault Lock.Choose the vault lock you want to remove. Then, choose Manage vault lock.Choose Delete vault lock. A confirmation window appears.Enter confirm in the text box and then choose confirm.If the steps have been completed successfully, then a Success banner appears at the top of the console.Delete a vault lock programmaticallyTo delete your vault lock during grace time using an AWS Command Line Interface (AWS CLI) command, use DeleteBackupVaultLockConfiguration.The following is an example of the DeleteBackupVaultLockConfiguration command:Note: If you receive errors when running AWS CLI commands, make sure that you're using the most recent version of the AWS CLI.aws backup delete-backup-vault-lock-configuration \--backup-vault-name my_vault_to_lockImportant: Deleting the vault lock doesn't delete the backup vault or recovery point. You can delete the vault or recovery point after the lock is removed.

Related informationEnhance the security posture of your backups with AWS Backup Vault LockVault lock removal during grace time (Compliance mode)
Question: How can I configure my EC2 Spot Instances so that the root EBS volume won’t be deleted when I terminate the instance?

I want to configure my Amazon Elastic Compute Cloud (Amazon EC2) Spot Instances so that the root Amazon Elastic Block Store (Amazon EBS) volume isn't deleted when I terminate the instance.

ResolutionBy default, when EC2 Spot Instances are terminated, all EBS volumes attached to that instance are deleted because the DeleteOnTermination attribute is set to true.To change the DeleteOnTermination attribute for a new Spot requestOpen the Amazon EC2 console, and then choose Spot Requests from the navigation pane.Choose Request Spot Instances.Choose an Availability Zone, and then choose Next.In EBS volumes, clear Delete.After you clear the Delete box, finish creating your Spot request. Any new instances that are launched when this Spot request is fulfilled will have DeleteOnTermination set to false.Note: EBS volumes with DeleteOnTermination set to false incur charges and remain in your EBS volume console. You must manually delete the volume. For more information, see Amazon EBS pricing.To change the DeleteOnTermination attribute for a running Spot InstanceUse the modify-instance-attribute command in the AWS Command Line Interface (AWS CLI) to configure the root EBS volume to persist on termination.

Related informationSpot Instances
Question: Why am I receiving the error "Your requested instance type is not supported in your requested Availability Zone" when launching an EC2 instance?

I received the error message "Your requested instance type is not supported in your requested Availability Zone" when launching an Amazon Elastic Compute Cloud (Amazon EC2) instance. How can I determine which Availability Zone to use?Short descriptionSome Availability Zones don't support particular instance types. If you receive the error "Your requested instance type is not supported in your requested Availability Zone," do the following:Determine which Availability Zones support your instance type.Retry the request and specify an Availability Zone that supports your chosen instance type. Or, submit the request without specifying an Availability Zone.Note: This error is different from an insufficient instance capacity error. For information on insufficient capacity errors, see Insufficient instance capacity.

ResolutionDetermine which Availability Zones support your instance typeFrom the Amazon EC2 console:Open the Amazon EC2 console.Choose the Region where you want to launch the instance.Select Instance Types.For Filter instance types, enter your preferred instance type.Select your preferred instance type.Under Networking, review the Availability Zones listed under Availability Zones.From the AWS Command Line Interface (AWS CLI):Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Use the describe-instance-type-offerings command and include filters for the Availability Zone and the instance type you want to launch. Add additional filters as needed. The following example command filters the search results by Availability Zone, instance type, and Region. For more information on the describe-instance-type-offerings command, see describe-instance-type-offerings in the AWS CLI Command Reference.# aws ec2 describe-instance-type-offerings --location-type availability-zone  --filters Name=instance-type,Values=c5.xlarge --region af-south-1 --output tableNote: Availability Zone names might not map to the same location across accounts. For more information, see Availability Zones. Use the location-type availability-zone-id command to have the output list Availability Zone IDs. You can use the Availability Zone ID to validate the Availability Zone mapping on your account.Retry the requestWhen launching the instance, choose a supported Availability Zone during instance launch. You can launch an instance to an Availability Zone using the old launch wizard, new launch wizard, or using AWS CLI. Or, don't specify an Availability Zone in your request. If you don't specify an Availability Zone, Amazon EC2 chooses an Availability Zone for you that supports your instance type.
Question: How do I create a DHCP options set for my AWS directory?

I want to create Dynamic Host Configuration Protocol (DHCP) options set for my AWS Directory Service directory. How can I do this?Short DescriptionBy default, Amazon Virtual Private Cloud (Amazon VPC) uses AWS DNS instead of your directory service DNS. It's a best practice that you create a DHCP options set for your AWS Directory Service directory. Then, assign the DHCP options set to the VPC that your directory runs in. This allows any instances in that VPC to point to the specified domain and for DNS servers to resolve their domain names.

ResolutionTo create a DHCP options set for your AWS directory, follow the instructions to Create a DHCP Options Set.
Question: Why doesn't the CurrItems metric in my Memcached cluster decrease when the keys expire?

Why doesn't the CurrItems metric in my Memcached cluster decrease when the keys expire?ResolutionThis is an expected behavior. Memcached uses lazy expiration to remove keys when the time to live (TTL) expires. This means that the key isn't removed from the node even though it's expired. However, when someone tries to access an expired key, Memcached checks the key, identifies that the key is expired, and then removes it from memory.If there are no free chunks or free pages left in the appropriate slab class to accommodate new keys, then Memcached removes the expired keys, or uses a least recently used (LRU) algorithm to evict keys if it can't find an already expired key. The CurrItems metric decreases after the keys are removed from memory.The lru_crawler thread, which is an optional background thread, also clears expired keys from memory. The lru_crawler is a conservative task, and, even if enabled, has limited action over expired keys. Therefore, even with lru_crawler enabled, it might take some time for the CurrItems metric and keyspace memory to show a decrease in usage.Use TTL to make a key available for a particular amount of time. When the key becomes invalid (expires), it's eventually removed. Keys can't be retrieved after their expiration time.

Related informationMemcached specific parameters
Question: How do I host multiple public websites using IIS on the same EC2 Windows Server instance?

I want to use Internet Information Services (IIS) to host multiple websites on a single Amazon Elastic Compute Cloud (Amazon EC2) Windows Server instance.

ResolutionIf you have multiple public websites, then you can host them in IIS on the same EC2 Windows Server instance. IIS uses bindings to differentiate between websites. Bindings are a combination of the protocol type, IP address, port, and hostname. To avoid IP address and port conflicts, you must add a hostname.To configure the IIS server on your instance to host multiple websites, follow these steps:Set up your websites on the EC2 Windows Server instance. Make sure to install and configure IIS (from the Microsoft website) on the instance.Use the Amazon EC2 console to get the IP addresses of the EC2 Windows Server instance.Use Remote Desktop Protocol to connect to the instance.Open IIS Manager. In the Connections pane, choose the site that you want to add a hostname to.In the Actions pane, complete the following steps:Choose Bindings.Choose Edit.In the hostname field, enter a name.Choose OK.Update the hosts file with the hostname to access the website locally from the IIS server:Open a text editor with the Run as Administrator option, and then open the hosts file in the C:\Windows\System32\drivers\etc directory.Enter the private IP address of the EC2 instance and the hostname of your website, and then save the file.Repeat steps 4 through 6 for each additional website.To access your websites, use the private IP address locally from the hosts file on the same EC2 Windows Server instance. For public access, use your DNS host provider or Amazon Route 53 to add the public IP address in your public hosted zone.
Question: How can I set up alerts to see when an IAM access key is used?

I want to set up notifications to see when a specific AWS Identity and Access Management (IAM) credential or access key is used.

ResolutionThere are no predefined rules to track and send notifications about the use of IAM credentials. However, you can use a custom rule that combines AWS CloudTrail and Amazon EventBridge. This lets you send a notification to an Amazon Simple Notification Service (Amazon SNS) topic or Amazon Simple Queue Service (Amazon SQS) queue.EventBridge rules are represented as JSON objects. A rule has a simple match or no match logic that applies to events. Based on the structure of events, you can build custom patterns for the specific criteria that you want to match.The following example rule tracks a single access key in the same AWS Region where the rule is configured.Important:You must have an active trail to send events for EventBridge to invoke notifications to your SNS topic or SQS queue.Your trail's management events must be configured as Write-only or All. Trail management events that are configured as Read-only don't invoke the EventBridge rule. For more information, see Read and write events, Events from AWS services, and CloudTrail supported services and integrations.1.    Open the EventBridge console, and then choose Rules.2.    Choose Create rule.3.    Enter a Name for the rule. You can optionally enter a Description. Then, choose Next.4.    For Event source, choose Other.5.    For Creation method, choose Custom pattern (JSON editor).6.    For Event pattern, enter a JSON template that's similar to the following:Note: You can modify this template to track notifications for a range of criteria, such as access keys, login types, or specific identities.{    "detail-type": [        "AWS API Call via CloudTrail"    ],    "detail": {        "userIdentity": {            "accessKeyId": [                "AKIAIOSFODNN7EXAMPLE"            ]        }    }}7.    Choose Next.8.    For Target types, choose AWS service. Then, complete the following fields:For Select a target, select SNS topic or SQS queue.For Topic, select the topic that you want to respond to the event. Then, choose Next.9.    (Optional) Choose tags for your rule, if desired.10.    Choose Next to review your rule. Then, choose Create rule.

Related informationAmazon EventBridge event patternsGetting credential reports for your AWS account
Question: Why am I receiving errors when deleting a static IP address using the Amazon Lightsail console?

I'm receiving the error "The specified Static IP address cannot be released from your account. A reverse DNS record may be associated with the Static IP address." when deleting a static IP address from my Amazon Lightsail console. How do I resolve this issue?Short descriptionYou might receive the specified Static IP address cannot be released error message when a reverse Domain Name System (rDNS) record was previously created for your static IP address and the rDNS entry isn't removed.To confirm if the static IP address has rDNS mapping to the domain, run the following command on the Terminal or Powershell:$ nslookup -type=ptr 8.8.8.8Note: Replace IP address 8.8.8.8 with your static IP address.If the rDNS record doesn't end with "compute.amazonaws.com" but instead ends with a custom record of your domain, then you must request for rDNS removal.

ResolutionTo resolve the issue, submit a request to remove the rDNS record for the static IP address.Open the Request to remove email sending limitations form.Complete the form using the following information:Email Address: Your email address.Use Case Description: Provide your specific use case for requesting rDNS removal.Elastic IP address: Enter IP address here.Reverse DNS record: Enter "Remove rDNS record".Note: You have the option to enter up to 100 Elastic IP addresses.Choose Submit.Note: rDNS removal might take a few hours to propagate through the system.You receive an email with the Request ID after submitting the request form. It might take up to 48 hours to process your request. If your request is approved, then you receive an email to notify you that the rDNS record is removed. After you receive confirmation that the associated rDNS record is removed, you can delete the static IP address from the Lightsail console. If you don't receive an update within 48 hours after submitting the request, then reply to the initial email that you received.