VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How can I audit deleted or missing objects from my Amazon S3 bucket?

There's an object or file that's missing from my Amazon Simple Storage Service (Amazon S3) bucket. Where can I find information about how the object or file was deleted? How can I prevent future accidental deletions?ResolutionTo find out how an S3 object was deleted, you can review either server access logs or AWS CloudTrail logs.Note: Logging must be enabled on the bucket before the deletion event occurs. You receive logs only for events that occurred after logging was enabled.Server access logs track S3 operations performed manually or as part of a lifecycle configuration. To enable server access logging, see How do I enable server access logging for an S3 bucket? For more information on how to analyze server access logs, see How do I analyze my Amazon S3 server access logs using Athena?CloudTrail logs can track object-level data events in an S3 bucket, such as GetObject, DeleteObject, and PutObject. To enable CloudTrail logs for object-level events, see How do I enable object-level logging for an S3 bucket with AWS CloudTrail data events? For more information on how to find specific events, see I enabled object-level logging for my Amazon S3 bucket. Where can I find the events in the CloudTrail event history?Note: By default, CloudTrail records bucket-level events. To get logs for object-level operations like GetObject, DeleteObject, and PutObject, you must configure object-level logging. Object-level logging incurs additional charges, so be sure to review the pricing for CloudTrail data events.To prevent or mitigate future accidental deletions, consider the following features:Enable versioning to keep historical versions of an object.Enable Cross-Region Replication of objects.Enable MFA delete to require multi-factor authentication (MFA) when deleting an object version.
Question: How do I troubleshoot connectivity issues that I'm experiencing while using an Amazon VPC?

I'm unable to connect to my destination server using an Amazon Virtual Private Cloud (Amazon VPC) resource as the source.

ResolutionTo troubleshoot VPC connectivity issues, use the AWSSupport-ConnectivityTroubleshooter automation document to check for common issues with:Security group configurationsNetwork access control list (network ACL) configurationsRoute table configurationsConfirm that you have the required permissions to run the automation documentThe following AWS Identity and Access Management (IAM) permissions are required to run the automation document:ec2:DescribeNetworkInterfacesec2:DescribeRouteTablesec2:DescribeSecurityGroupsec2:DescribeNetworkAclsec2:DescribeNatGatewaysec2:DescribeVpcPeeringConnectionsRun the automation documentFrom the AWS Management Console:Open the document in the AWS Systems Manager console. Be sure to open the document in the Region where your resources are located.For SourceIP, enter the private IP address of the VPC resource.For DestinationIP, enter the destination server IP address.For DestinationPort, enter the destination server port.Choose Execute.Monitor the progress of the document's execution. If the document status is Success, the automation didn't find any misconfigurations. If the document status is Failed, check the step that failed for details to resolve the issue.From the AWS Command Line Interface (AWS CLI):Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.For example, to diagnose connectivity issues from 172.31.2.7 to 172.31.2.8 on port 443 in an Amazon VPC:aws ssm start-automation-execution --document-name "AWSSupport-ConnectivityTroubleshooter" --parameters "SourceIP=172.31.2.7,DestinationIP=172.31.2.8,DestinationPort=443" --region <region>
Question: Why can't my Amazon EC2 instance connect to the internet using an internet gateway?

My Amazon Elastic Compute Cloud (Amazon EC2) instance in a public subnet has a public IP address or an internet gateway, but can’t access the internet.

Short descriptionTo troubleshoot why your Amazon EC2 can't access the internet, do the following:Verify that the EC2 instance meets all prerequisites.Verify that the instance has a public IP address.Verify that a firewall isn't blocking the access.

ResolutionVerify that the instance meets all prerequisitesThe instance must meet the following conditions:The route table that's associated with your instance’s subnet has a default route to an internet gateway (0.0.0.0/0).The internet gateway that's associated with the route isn't deleted.The security group that's attached to the instance’s elastic network interface has rules allowing outbound internet traffic (0.0.0.0/0) for your ports and protocols.The network access control list (network ACL) that is associated with the instance's subnet has rules allowing both outbound and inbound traffic to the internet.Verify that the instance has a public IP addressIf the instance in a public subnet doesn't have a public IP address, then the instance isn't accessible outside the virtual private cloud (VPC) where it resides in. This is true even if the instance has an internet gateway.To allow the instance connectivity to the internet, allocate an Elastic IP address, and then associate this Elastic IP address with the instance.Verify that a firewall isn't blocking accessIf the instance meets the preceding conditions and internet connectivity issues persist, then you might have a local firewall running in the operating system. It's a best practice to use security groups instead of having a local firewall in the operating system. Be sure that disabling the local firewall doesn't impact your workload.# For Uncomplicated Firewallsudo ufw disable# For firewalldsudo systemctl disable firewalld --nowIf you must use a firewall, then the internet connectivity issues are usually related to the OUTPUT chain. You can allow outgoing traffic by running the following commands:sudo iptables -P OUTPUT ACCEPTsudo iptables -I OUTPUT 1 -j ACCEPTWindows Server:For Windows Server default firewalls, run the following command:netsh advfirewall firewall show rule name=allIf the preceding command indicates blocked traffic, then remove the old rule or add a new rule allowing traffic for that specific port. For more information, see the Microsoft documentation for Understanding Windows firewall with advanced security rules.

Related informationConnect to the internet using an internet gatewayControl traffic to resources using security groupsWhy can't my Amazon EC2 instance in a private subnet connect to the internet using a NAT gateway?
Question: How can I activate a BAA agreement for my organization using AWS Artifact?

I need to activate or manage a Business Associate Addendum (BAA) agreement for AWS Organizations with an AWS account for an organization.

Short descriptionAWS BAA agreements are required for some organizations that are subject to the Health Insurance Portability and Accountability Act (HIPAA). HIPAA compliance safeguards protected health information (PHI). You can use AWS Artifact to manage agreements for your AWS account or for all accounts in your organization if you use AWS Organizations. For more information, see Managing agreements in AWS Artifact.

ResolutionFollow these instructions to download and accept the AWS BAA agreement with a single AWS account or multiple accounts in an organization for AWS Organizations.Managing an agreement for a single account in AWS ArtifactManaging an agreement for multiple accounts in AWS ArtifactIn the AWS Artifact console, the Agreement state is now Active.

Related informationIntroducing the Self-Service Business Associate AddendumHow to use AWS Artifact to accept an agreement for your accountHIPAA eligible services referenceAWS Artifact FAQs
Question: How do I run a command on a new EC2 Windows instance at launch?

I want to run a custom script when I launch a new Amazon Elastic Compute Cloud (Amazon EC2) Windows instance.

Short descriptionTo run a script that starts when the instance launches, add the script to user data. User data is processed by EC2Config (Windows Server 2012 R2 and earlier) or EC2Launch or EC2Launch V2 (Windows Server 2016 and later).

ResolutionWhen you add the script to user data, you must enclose it within a special tag. This tag determines whether the commands run in a command prompt window or use Windows PowerShell. For more information, see Run commands on your Windows instance at launch.When you launch a new EC2 Windows instance, you can specify user data during configuration to run a custom script at startup.Important: If you launch an instance from a custom AMI, then you must shut down the original instance that created the AMI. To do this, use EC2Launch, EC2Launch V2, or EC2Config. From the EC2Launch, EC2Launch V2, or EC2Config settings, choose Shutdown with Sysprep or Shutdown without Sysprep.1.    Open the Amazon EC2 console, and then choose AMIs from the navigation pane.2.    Select an AMI, and then choose Launch.3.    Select an instance type, and then choose Next: Configure Instance Details.4.    For Advanced Details, enter your custom script in the User data text box. Be sure to use the correct tag.Note: To run user data scripts every time you reboot or restart the instance, add the following command:<persist>true</persist>5.    Complete the launch wizard to start the instance.For additional troubleshooting, EC2Launch, EC2Launch V2, and EC2Config log files contain the output from the standard output and standard error streams. You can find log files in the following locations:EC2Launch: C:\ProgramData\Amazon\EC2-Windows\Launch\Log\UserdataExecution.logEC2Launch V2: C:\ProgramData\Amazon\EC2Launch\log\agent.logEC2Config: C:\Program Files\Amazon\Ec2ConfigService\Logs\Ec2Config.log

Related informationHow do I run a command on an existing EC2 Windows instance when I reboot or start the instance?
Question: How do I check the current status of my VPN tunnel?

I don’t see network traffic flowing on the AWS side of my Amazon Virtual Private Cloud (Amazon VPC) connection. How do I check the AWS VPN tunnel status?ResolutionVerify whether you are using static or dynamic Site-to-Site VPN routing. VPN devices that don’t support Border Gateway Protocol (BGP) must use static routing. VPN devices that support BGP can use dynamic routing.Check the current status using the Amazon VPC consoleIf you use a static VPN, then follow these steps:Sign in to the Amazon VPC console.In the navigation pane, under Site-to-Site VPN Connections, choose Site-to-Site VPN Connections.Select your VPN connection.Choose the Tunnel Details view.Review the Status of your VPN tunnel.If the tunnel status is UP, then choose the Static Routes view. Be sure to specify any private networks behind your on-premises firewall.If the tunnel status is DOWN, then verify that your on-premises firewall is properly configured.Be sure to turn on route propagation in your VPC route table.If you use a dynamic VPN with BGP, then follow these steps:Sign in to the Amazon VPC console.In the navigation pane, under Site-to-Site VPN Connections, choose Site-to-Site VPN Connections.Select your VPN connection.Choose the Tunnel Details view.Review the Status of your VPN tunnel.If the tunnel status is UP, then verify that the Details column has one or more BGP routes listed.If the tunnel status is DOWN but the Details column is IPSEC IS UP, then be sure to configure BGP properly on your firewall. Phase 2 of Internet Protocol Security (IPSec) is established, but BGP isn’t established.Be sure to turn on route propagation in your VPC route table.If you continue to experience issues, then follow these steps:Verify that the security groups of Amazon Elastic Compute Cloud (Amazon EC2) instances in your VPC allow appropriate access. For more information, see Security groups for your VPC.Verify that your local firewall allows the same service in its access control lists (ACLs) and firewall policies.For more information, see Troubleshooting your customer gateway device.Monitor your VPN tunnel using Amazon CloudWatchYou can also use CloudWatch to check the status of a VPN tunnel and be notified when the status of the tunnel changes. CloudWatch can be used to access metric data over time to help evaluate the tunnel's stability. For more information, see Monitoring VPN tunnels using Amazon CloudWatch.

Related informationHow do I troubleshoot BGP connection issues over VPN?
Question: How can I create CloudWatch alarms to monitor my Amazon RDS SQL Server DB instance’s memory consumption using Enhanced Monitoring?

My Amazon Relational Database Service (Amazon RDS) SQL Server DB instance is using more memory than expected. How can I set an Amazon CloudWatch alarm to monitor how much memory is consumed by SQL Server?Short descriptionAfter you enable Enhanced Monitoring for your RDS DB instance, you can create a CloudWatch alarm and use Amazon Simple Notification Service (Amazon SNS) to receive notifications about SQL Server memory consumption. This example uses the Enhanced Monitoring metric sqlServerTotKb to create a CloudWatch alarm and sends an SNS notification about the memory consumed by your Amazon RDS for SQL Server DB instance.

ResolutionOpen the CloudWatch console, and then choose Log groups from the navigation pane.Filter for RDSOSMetrics from the list of Log Groups, select RDSOSMetrics. Navigate to Metric filters, and then choose Create Metric Filter.Enter a Filter Pattern for your RDS DB instance, such as {$.instanceID = "nameOfYourRDSInstance"}. For example, you can enter the RDS DB instance name {$.instanceID ="sqltest"}.From the Select Log Data to Test section, choose the resource ID of your RDS DB instance.Note: To find the resource ID of your RDS DB instance, open the Amazon RDS console, and then choose Databases from the navigation pane. Choose your RDS DB instance, and navigate to the Configuration tab. The resource ID appears in the Instance section.Select Next to assign a Filter name.Filter name: MyFilterEnter a Metric Namespace and Metric Name. See the following example:Metric Namespace: EMMetricMetric Name: SQLServerMemoryConsumptionEnter the metric value $.memory.sqlServerTotKb and then choose Next.Choose Create Metric Filter. A custom metric with the name specified is created. This metric reports the Enhanced Monitoring data in a CloudWatch graph.Select the Metric Filter, and then choose Create Alarm.From the Metrics section on the next page, verify the Namespace and Metric name, and then set the Period to 1 minute.From the Conditions section, define the threshold of the metric alarm. See the following example:Threshold type: StaticWhenever SQLServerMemoryConsumption is: Greater > thresholdThen: Enter 20971520Note: To specify 20 GiB as a threshold, enter the value in KiB. For example, 20971520 (20 * 1024 * 1024).Choose Next.From the Configure Action section, choose In Alarm.Select an SNS topic, or choose Create new topic using the email address where you want to receive alerts, and then choose Next.Enter an alarm name and description and choose Next. See the following example:Alarm name: RDS DB instance: SQLTEST: SQL Server Memory Consumption> 20 GiBAlarm description: SQL Server Memory consumption on your RDS DB instance is highFrom the Preview and Create page, verify the details of your alarm.Choose Create alarm.After the alarm is created, you can view it under Alarms on the CloudWatch console. Whenever your SQL Server memory usage exceeds the defined threshold, your alarm enters the ALARM state and you receive an email notification.
Question: How can I use Security Hub to monitor security issues for my AWS environment?

I want to use AWS Security Hub to monitor security issues in my AWS environment.

Short descriptionSecurity Hub provides you with a detailed view of your security state and helps check your environment against security standards and best practices.Benefits of Security Hub include:Reduced effort to collect and prioritize findingsAutomatic security checks against best practices and standardsConsolidated view of findings across accounts and providersAbility to automate remediation of findingsSupports integration with Amazon EventBridge.For more information, seeBenefits of AWS Security Hub.

ResolutionTo automate remediation of specific findings, you can define custom actions to take when a finding is received.Follow these instructions to create a custom action, define an EventBridge rule, and send findings.Create a custom actionIf you haven't already done so, start the configuration recorder in AWS Config.1.    Open the Security Hub console, choose Settings, and then choose Custom actions.2.    Choose Create custom action.3.    Enter an Action name and Description.4.    For Custom action ID, enter a unique ID, and then choose Create custom action.5.    In Custom action ARN, take note of the ARN.Define a rule in EventBridgeIf you haven't already done so, create an Amazon Simple Notification Service (Amazon SNS) topic.1.    Open the EventBridge console in the same AWS Region as Security Hub, expand Events, and then choose Rules.2.    Choose Create rule.3.    Enter a Rule name and Description.4.    From the Event bus drop down menu, choose either the default or custom bus.5.    Make sure that the Enable the rule on the selected event bus switch is turned on.6.    For Rule type, choose Rule with an event pattern, and then choose Next.7.    For Event source, choose AWS events or EventBridge partner events.8.    In Event pattern, choose the following:For Event source, choose AWS services.For AWS service, choose Security Hub.For Event type, choose Security Hub Findings - Custom Action, choose Specific custom action ARN(s), and then choose Next.9.    Choose the Select a target drop down menu, choose your target type, choose Next, Next, and then choose Create rule.For more information, see Amazon EventBridge event patterns.Send findings to EventBridge1.    Open the Security Hub console, and then choose Findings.2.    Follow the instructions to send findings to EventBridge.Note:You can create up to 50 custom actions.If you created cross-Region aggregation and manage finding from the aggregation Region, create custom actions in that Region.For more information, see Findings in AWS Security Hub.

Related informationHow Security Hub worksAWS Security Hub endpoints and quotas
Question: How can I migrate my Amazon Redshift data from one cluster to another?

I want to migrate my Amazon Redshift data from one cluster to another cluster.

ResolutionYou can use data sharing, Amazon Redshift Spectrum, Amazon Simple Storage Service (Amazon S3), or a cluster snapshot to migrate Amazon Redshift data.Data sharingYou can use data sharing to share live data across Amazon Redshift clusters with AWS accounts or AWS Regions.Note: Amazon Redshift data sharing is available only on RA3 node types. For RA3 node migrations, see How do I migrate my Amazon Redshift cluster to an RA3 node type?For AWS accounts, see Sharing data within an AWS account and Sharing data across AWS accounts.For AWS Regions, see Sharing data across AWS Regions.For more information, see Sharing data across clusters in Amazon Redshift.Amazon Redshift SpectrumYou can use Amazon Redshift Spectrum to query external data. You can also use Amazon Redshift Spectrum to share data on multiple clusters. For instructions, see How do I create and query an external table in Amazon Redshift Spectrum?Amazon S3You can move data from Amazon Redshift to an Amazon S3 bucket. For instructions, see How do I COPY or UNLOAD data from Amazon Redshift to an Amazon S3 bucket in another account?Or, you can use the Amazon Redshift Unload/Copy Utility to migrate data between Amazon Redshift clusters or databases to Amazon S3.Cluster snapshotYou can copy an Amazon Redshift provisioned cluster to another AWS account by creating and sharing a manual snapshot. For instructions, see How do I copy an Amazon Redshift provisioned cluster to a different AWS account?Related informationGetting started data sharingHow do I move my Amazon Redshift provisioned cluster from one VPC to another VPC?Managing snapshots using the AWS Command Line Interface (AWS CLI) and Amazon Redshift APIHow can I copy S3 objects from another AWS account?
Question: How do I use the Reserved Instance utilization report in Cost Explorer?

I want to use the Cost Explorer reports to understand the utilization of my Reserved Instances (RIs).

ResolutionYou can use the RI utilization reports in Cost Explorer to do the following:View the combined usage of your purchased RIs in the chart by selecting up to ten leases at one time.View the utilization of individual RIs in the chart by selecting the RI from the table.View the utilization of your RIs as the percentage of purchased RI hours in the chart.View the number of RI hours used against the number of RI hours purchased in the table.Define a utilization threshold, known as a utilization target, and identify RIs that meet your utilization target and RIs that are underutilized.To define the utilization target, enter the preferred value for Utilization target (%), and select Show target line on chart. You can see the target utilization as a dotted line in the chart and as an RI utilization status bar in the table.RIs with a red status bar haven't used reservation hours.RIs with a yellow status bar are under your utilization target.RIs with a green status bar have met your utilization target.Instances with a gray bar aren't using reservations.

Related informationRI utilization reportsHow do I use the Reserved Instance coverage report in Cost Explorer?How can I use Cost Explorer to analyze my spending and usage?