VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I reset the MariaDB root password on an Amazon EC2 instance that's running Amazon Linux 2?

How do I reset the MariaDB root password on an Amazon Elastic Compute Cloud (Amazon EC2) instance that's running Amazon Linux 2?Short descriptionBy default, MariaDB 5.5 on Amazon Linux 2 doesn't have a root password. If you create a root password for MariaDB and then lock yourself out of your database, you must reset the root password.Note: You can't query your database while you’re resetting the root password.Resolution1.    Verify that you have a recent snapshot of the volume where the MariaDB data directory resides. You can recreate the volume from this snapshot, if needed.2.    Stop the MariaDB service:sudo systemctl stop mariadb3.    Start MariaDB in safe mode:sudo mysqld_safe --skip-grant-tables --skip-networking &4.    Run the following command to set the MariaDB command history to /dev/null and log in to the MariaDB monitor:Important: Setting the command history /dev/null prevents your password information from appearing in plaintext in the history file. You can reset this value after completing the full procedure.export MYSQL_HISTFILE=/dev/nullmysql -u root5.    Update your MariaDB root password:UPDATE mysql.user SET Password = PASSWORD('new_password_here') WHERE User = 'root';The output looks like this:Query OK, 1 row affected (0.00 sec)Rows matched: 1  Changed: 1  Warnings: 06.    Flush the privileges to reload the grant tables. Your new password takes effect after the reload:FLUSH PRIVILEGES;7.    Exit the MariaDB monitor:exit8.    Stop the MariaDB process:sudo kill `sudo cat /var/run/mariadb/mariadb.pid`Note: The process might take a few seconds to terminate.9.    Start the MariaDB service:sudo systemctl start mariadb10.    Test your new MariaDB root password:mysql -u root -p
Question: Why do I get an error when I try to close my AWS account?

I tried to close my AWS account, but I got an error.

ResolutionIf you get an error when you try to close your AWS account, check the following:Be sure that you're signed in as the root user of the account. Only someone signed in as the root user can close the account. If you can't sign in as the root user of the account, then contact the root account user and ask them to close the account on your behalf.To close the management account for an organization, remove all member accounts in the organization first.Try using a different web browser to close the account.Note: For privacy and security purposes, AWS Support can't close accounts on request.

Related informationHow do I close my AWS account?How do I terminate active resources that I no longer need on my AWS account?
Question: How can I delete a subnet that is part of an Amazon RDS DB subnet group?

I want to delete a subnet that is in an Amazon Relational Database Service (Amazon RDS) DB subnet group.

Short descriptionTo launch an Amazon RDS DB instance, an RDS DB subnet group must contain at least two subnets. These subnets must be in different Availability Zones (AZs) in the same AWS Region. You can remove or delete a subnet from the DB subnet group only if:There are no DB instances associated with the subnet group.There are no DB instances launched in the subnet that you want to delete.If you launch a DB instance with a subnet group containing two subnets in two AZs, then you can't delete any subnets from the subnet group. For more information, see Working with a DB Instance in a VPC.If a Multi-AZ deployment has two or more subnets, then you can launch the instance in any subnets in the AZs.If a Single-AZ deployment has two or more subnets, then you can specify the AZ when you create a DB instance. If you didn't specify the AZ when you created the DB instance, then the instance is launched in any subnet of the two AZs.

ResolutionTo delete a subnet from a DB subnet group, isolate the subnet by moving the DB instance to another subnet. Then, remove the subnet from the DB subnet group. These steps are applicable for Amazon RDS for Oracle, PostgreSQL, MySQL, MariaDB, or SQL Server.Note: This resolution doesn't apply to Amazon Aurora because Aurora uses replicas as failover targets. If an Aurora primary DB instance fails, then the replica is promoted to the primary. This action is unlike most Multi-AZ deployments where there is a secondary DB instance in another Availability Zone.Delete a subnet from a Single-AZ Amazon RDS DB instanceModify the DB instance to be a Multi-AZ deployment. This creates a standby for the DB instance in a different AZ that uses a different subnet. Note: If you already have a Multi-AZ deployment, skip to step 2.Reboot the DB instance with failover. This promotes the standby to the primary DB instance.Modify the DB instance back to a Single-AZ DB instance. Note: After you do this, the Single-AZ DB instance is no longer in the subnet that you want to delete.Open the Amazon RDS console, and then choose Subnet groups from the navigation pane.Choose the subnet group that the DB instance is associated with.Choose Edit.From Add subnets, choose the subnet that you want to delete, and then choose Remove.Choose Save.

Related informationWorking with DB subnet groups
Question: Why can't I connect to the AmazonRedshiftQueryEditor in Amazon Redshift?

I'm trying to connect to the Amazon Redshift Query Editor, but I'm getting "User not authorized" and "Access denied" errors.

ResolutionFind your Amazon Redshift cluster to connect to the query editorImportant: Be sure you're logged in to the same AWS Region where your Amazon Redshift cluster is present.Both query editor v1 and query editor v2 support connecting to the following provisioned Redshift cluster types:DC2.largeDC2.8xlargeDS2.xlargeDS2.8xlargeRA3.xplusRA3.4xlargeRA3.16xlargeNote: You can't query data in Amazon Redshift Serverless using the query editor v1. You must use Amazon Redshift query editor v2 instead.Getting a "User not authorized" or "Access denied" error when connecting to the query editor with Amazon RedshiftYou must have the correct permissions to access the query editor. To turn on access for query editor v1 or v2, do the following:For query editor v1To turn on access, attach the AmazonRedshiftQueryEditor and AmazonRedshiftReadOnlyAccess policies for AWS Identity and Access Management (IAM) to the user that accesses your Redshift cluster.AmazonRedshiftQueryEditor is an AWS managed policy that allows the redshift:GetClusterCredentials action. By default, the redshift:GetClusterCredentials action provides a superuser access to the database.For more information about how to provide a superuser access from the console, see Enabling access to the query editor.For query editor v2To turn on access, attach the AmazonRedshiftReadOnlyAccess policy and one of the following IAM policies to the user that accesses your Redshift cluster:AmazonRedshiftQueryEditorV2FullAccessAmazonRedshiftQueryEditorV2NoSharingAmazonRedshiftQueryEditorV2ReadSharingAmazonRedshiftQueryEditorV2ReadWriteSharingFor more information, see Accessing the query editor v2.To access the query editor v2 as a federated user, see Setting up principal tags to connect to query editor v2 as a federated user.
Question: How do I restore data from an Amazon RDS database snapshot?

I want to restore data from an Amazon Relational Database Service (Amazon RDS) DB snapshot.

ResolutionYou can restore your data from a DB snapshot using one of these services:Amazon RDS consoleAWS Command Line Interface (AWS CLI)Amazon RDS APINote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.You can restore data from both manual and automatic DB snapshots. First, select the DB snapshot that you want to restore from. Then, provide a name for the new DB instance that is created from the restore.Note: When you restore data from a DB snapshot, you must create a new DB instance. You can't restore data from a DB snapshot to an existing DB instance. Also, you can't restore a DB instance from a DB snapshot that is both shared and encrypted. Instead, first make a copy of the DB snapshot. Then, restore the DB instance from the copy.

Related informationCreating a DB snapshotCreating a Multi-AZ DB cluster snapshot
Question: How do I resolve errors with limitations for AWS Config advanced query?

How do I resolve errors with limitations for AWS Config advanced query with aggregated or account resources?ResolutionUse the following workarounds for your use case with advanced query.Note: You must have permission for the SelectResourceConfig and SelectAggregateResourceConfig APIs to use advanced query. For more information, see Query using the SQL editor (Console).Amazon EC2 instance operating system versionsAdvanced query can't get the list of all operating systems running in Amazon Elastic Compute Cloud (Amazon EC2) instances across all AWS Regions. To check the OS, see How can I find the OS platform or version my EC2 instance is using?Querying deleted resourcesYou can't use advanced query for deleted resources. To look up deleted resources, see Looking up resources that are discovered by AWS Config.Amazon S3 queriesAdvanced query can't get the results for Amazon Simple Storage Service (Amazon S3) buckets if public access is blocked. This is because the AWS Config resource type AWS::S3::AccountPublicAccessBlock returns results only if Amazon S3 Block Public Access is enabled at the account level. You can use a SQL query to return the name and attributes of an S3 bucket using a query similar to the following:SELECT  resourceId,  resourceType,  configuration,  supplementaryConfigurationWHERE  resourceType = 'AWS::S3::Bucket'SQL null valuesAdvanced query doesn't support SQL null values—you must explicitly include values.You can retrieve a list of Amazon EC2 Instances with a public IP address associated with the use of SQL BETWEEN operator similar to the following:SELECT  accountId,  resourceId,  configuration.publicDnsName,  configuration.publicIpAddressWHERE  resourceType = 'AWS::EC2::Instance'  AND (    configuration.publicIpAddress BETWEEN '0.0.0.0'    AND '255.255.255.255'    OR configuration.ipv6Addresses BETWEEN '0:0:0:0:0:0:0:0'    AND 'ffff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'  )Nested array queriesAdvanced query doesn't support nested array queries. For more information, see advanced query limitations.1.    As a workaround, you can use a custom query similar to the following:SELECT  configuration.targetResourceId,  configuration.targetResourceType,  configuration.complianceType,  configuration.configRuleListWHERE  configuration.complianceType = 'NON_COMPLIANT'  AND configuration.configRuleList.configRuleName = 'required-tags'2.    Then, follow the instructions to export the output as JSON.You can then use the command line JSON processor jq to filter and query the nested array. For more information and to download jq, see JSON output format.

Related informationAWS Config launches ability to save advanced queriesQuerying the current configuration state of AWS resources
Question: How can I set up a CloudWatch alarm to automatically recover my EC2 instance?

I want to set up automatic recovery of an Amazon Elastic Compute Cloud (Amazon EC2) instance using Amazon CloudWatch.

Short descriptionIf your instance fails a system status check, then you can use CloudWatch alarm actions to automatically recover your instance. The recover option is available for over 90% of deployed Amazon EC2 instances. However, the recover option works only for system check failures, not for instance status check failures. In addition, if you terminate your instance, then it can't be recovered.If your instance fails a status check, then you might need to reboot the instance or change the configuration. For more information, see Types of status checks.

ResolutionCreate an alarm1.    Open the Amazon EC2 console.2.    In the navigation pane, choose Instances.3.    Select the instance that you want to configure.4.    Choose Actions, and then choose Monitor and troubleshoot. Then, choose Manage CloudWatch alarms.5.    Choose Create an alarm.Note: To create an alarm, you must have AWS Identity and Access Management (IAM) permissions to stop and start the associated instance. For more information, see Creating IAM roles.6.    For Alarm notification, choose an existing Amazon Simple Notification Service (Amazon SNS) topic. To create a new topic, see Creating an Amazon SNS topic. Note: To receive notifications when an alarm is triggered, you must be subscribed to the SNS topic.7.    Toggle on Alarm action, and then choose Recover.8.    For Group samples by and Type of data to sample, choose an appropriate statistic and metric for your use case.9.    For Consecutive period and Period, specify the evaluation period for the alarm.10.    (Optional) Modify the automatically created Alarm name.11.    Choose Create.Set alarm for reboot1.    Open the CloudWatch console.2.    In the navigation pane, choose All Alarms.3.    Select the alarm that you created. Choose Action, and then choose Edit.4.    In the Additional Configuration section, select Treat missing data as bad (breaching threshold).5.    Choose Save.

Related informationCreate alarms that stop, terminate, reboot, or recover an instance
Question: Should I use an AWS KMS managed key or a customer managed KMS key to encrypt my objects on Amazon S3?

I want to use server-side encryption with AWS Key Management Service (SSE-KMS) for my objects stored on Amazon Simple Storage Service (Amazon S3). Should I use a customer managed AWS KMS key? Or, should I use the AWS KMS managed key called aws/s3? What's the difference between the two?ResolutionAWS Key Management Service (AWS KMS) manages the default aws/s3 AWS KMS key, but you have full control over a customer managed key.Using the default aws/s3 KMS keyNote: The name of the KMS key is aws/s3 in the Amazon S3 console. However, don't specify that name or ID if you use the AWS Command Line Interface (AWS CLI).Consider using the default aws/s3 KMS key if:You're uploading or accessing S3 objects using AWS Identity and Access Management (IAM) principals that are in the same AWS account as the AWS KMS key.You don't want to manage policies for the KMS key.To encrypt an object using the default aws/s3 KMS key, define the encryption method as SSE-KMS during the upload, but don't specify a key:aws s3 cp ./mytextfile.txt s3://DOC-EXAMPLE-BUCKET/ --sse aws:kmsNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Using a customer managed keyConsider using a customer managed key if:You want to create, rotate, disable, or define access controls for the key.You want to grant cross-account access to your S3 objects. You can configure the policy of a customer managed key to allow access from another account.To encrypt an object using a customer managed key, define the encryption method as SSE-KMS during the upload. Then, specify your customer managed key as the key (--sse-kms-key-id):aws s3 cp ./mytextfile.txt s3://DOC-EXAMPLE-BUCKET/ --sse aws:kms --sse-kms-key-id testkeyTo control access to your customer managed key, modify the key policy. For more information on how to create a key policy, see Creating a key policy.

Related informationProtecting data using server-side encryptionHow Amazon Simple Storage Service (Amazon S3) uses AWS KMS
Question: How do I increase my web ACL capacity units for AWS WAF?

I want to increase my web ACL capacity units (WCU). How can I do this?ResolutionAWS WAF Web ACL capacity units (WCU) calculate and control the operating resources required to run your rules, rule groups, and web ACLs. The default quota per account per Region for a web ACL is 1,500. If you need more capacity, you can request a WCU quota increase.Important: It's a best practice to first deploy AWS WAF without exceeding the 1,500 WCU quota. After your AWS WAF rules, rule groups, and web ACL are created, request a WCU quota increase for the web ACL. After the increase is approved, you can add more rules to your AWS WAF policy.Request a WCU quota increaseNote: WCU quota increases are approved per web ACL and can’t be approved at the account or AWS Organization level. The web ACL must exist first because quota increases apply only to existing web ACLs.To request an increase for a web ACL that's expected to exceed more than 1,500 WCUs, do the following:Open the Service Quotas dashboard.In the navigation pane, choose AWS Services.In AWS services, enter AWS WAF.In Quota name, choose Maximum number of web ACL capacity units in a web ACL in WAF for regional or Maximum number of web ACL capacity units in a web ACL in WAF for CloudFront.Choose Request quota increase.In Change quota value, enter the value of WCU that you want your quota to be increased to, and then choose Request.Then, to minimize the approval time, do the following:Open the AWS Support Center.In Open support cases, choose the open support case with a Subject of Limit Increase: WAF.In Correspondence, choose Reply.Provide the following information, and then choose Submit.A description of your use case that requires increasing WCU.The Amazon Resource Name (ARN) of the AWS WAF web ACL that you want to have its WCU limit increased and its planned WCU usage.If your request is approved, you can use the increased WCU immediately. However, it might still show a maximum of 1,500 WCU on the AWS WAF console.Note: Requests for quota increases are subject to review by AWS engineering teams. Quota increase requests aren't processed immediately after you submit a request. You will receive an email after your request is processed.

Related informationAWS WAF quotasAWS Firewall Manager quotas
Question: How do I share my AWS Managed AD directory from one AWS account to another?

I want to share an AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) directory from one AWS account to another. How do I do this?Short descriptionYou can share an AWS Managed Microsoft AD directory using one of two methods:AWS Organizations: Share your directory with other trusted AWS accounts within the same organization.Handshake: Share your directory with AWS accounts that are outside of the organization.For more information, see Sharing methods.

ResolutionFor a detailed tutorial, see Tutorial: Sharing your AWS Managed Microsoft AD directory for seamless EC2 domain-join.Note: Directory sharing is a Regional feature of AWS Managed Microsoft AD. If you're using multi-Region replication, share the directory separately in each Region.

Related informationShare your directoryKey directory sharing concepts
Question: How can I prevent containers from accessing Amazon EC2 instance metadata in Amazon ECS?

I want to prevent containers from accessing Amazon Elastic Compute Cloud (Amazon EC2) instance metadata in Amazon Elastic Container Service (Amazon ECS).

Short descriptionIf you run containers in an Amazon EC2 instance, it's a best practice for security reasons to avoid allowing your applications to assume an instance role.Amazon ECS provides the following networking modes to run a task with external connectivity:The bridge mode. The task uses Docker's built-in virtual network.The awsvpc mode. The task allocates an elastic network interface, and all the containers share the same networking namespace.The host mode. The containers share the host's networking namespace.The following resolution shows you how to prevent containers from accessing the instance metadata using the bridge and awsvpc networking modes.Note: It's not possible to prevent access with the host networking mode, because the Amazon ECS agent runs on the host networking namespace and requires access to it.

ResolutionFor tasks using the awsvpc networking mode, add the following parameter to the Amazon ECS configuration file /etc/ecs/ecs.config:ECS_AWSVPC_BLOCK_IMDS=trueFor tasks using the bridge networking mode, use iptables to block the network traffic from the docker0 bridge.You can specify the configuration of iptables in your custom Amazon Machine Image (AMI) or at launch in Amazon EC2 instance user data. See the following example for Amazon Linux 2 AMIs.Note: If you choose Amazon EC2 instance user data, the following configuration must be written before the Docker daemon starts. The cloud-boothook user data format executes earlier in the boot process than most services.#cloud-boothookyum install iptables-services -ycat <<EOF > /etc/sysconfig/iptables *filter:DOCKER-USER - [0:0]-A DOCKER-USER -d 169.254.169.254/32 -j DROPCOMMITEOFsystemctl enable iptables && systemctl start iptablesTo include this configuration with your existing user data, use the MIME multi part archive. See the following example:Content-Type: multipart/mixed; boundary="==BOUNDARY=="MIME-Version: 1.0--==BOUNDARY==Content-Type: text/cloud-boothook; charset="us-ascii"# Set iptables configurationyum install iptables-services -ycat <<EOF > /etc/sysconfig/iptables *filter:DOCKER-USER - [0:0]-A DOCKER-USER -d 169.254.169.254/32 -j DROPCOMMITEOFsystemctl enable iptables && systemctl start iptables--==BOUNDARY==Content-Type: text/x-shellscript; charset="us-ascii"#!/bin/bash# Set any ECS agent configuration optionsecho "ECS_CLUSTER=my-ecs-cluster" >> /etc/ecs/ecs.config--==BOUNDARY==--
Question: Why did I receive an HTTP 5xx error when connecting to web servers running on EC2 instances configured to use Classic Load Balancing?

I received an HTTP 502, 503, or 504 errors when I tried to connect to web servers running on EC2 instances configured to use Classic Load Balancing. How can I troubleshoot and resolve 5xx errors?ResolutionHTTP 502 (Bad Gateway)You might receive an HTTP 502 error if either the web server or associated backend application servers running on EC2 instances return a message that can't parsed by Classic Load Balancer (CLB).To resolve this error, see I get HTTP 502 errors when I make requests through a Classic Load Balancer. How do I troubleshoot these errors?HTTP 503 (Service Unavailable)HTTP 503 errors can occur for several reasons, including:The surge queue is full. Check that your instances have enough capacity to handle the request rate by reviewing the SpilloverCount metric.There are no healthy instances. Make sure that you have healthy instances in every Availability Zone that your load balancer responds. To do this, review the HealthyHostCount metric. For more information, see Troubleshoot a Classic Load Balancer: Health checks.You haven't registered at least one instance in every AZ that your load balancer responds in. If you can't confirm that an instance is registered in each AZ, then turn on cross-zone load balancing.Connection draining is not turned on for the Classic Load Balancer that your web server instances are registered with.For help resolving this error, see How do I troubleshoot HTTP 503 errors returned while using Classic Load Balancer?HTTP 504 (Gateway Timeout)HTTP 504 errors occur for the following reasons:Web server instances or backend application server instances are busy and can't respond to requests within the configured Elastic Load Balancing (ELB) idle timeout limit. For more information, see Troubleshoot high latency on my ELB Classic Load Balancer.Web server instances or backend application server instances terminate connections before the load balancer does. This results in premature connection terminations.Web server instances or backend application server instances have crashed or restarted server processes when requests are in-flight. This results in the server breaking all connections.Apache web server instances have the AcceptFilter http/https option turned on. This instructs Apache to implement TCP_DEFER_ACCEPT on the connections.Apache web server instances have the event MPM turned on but have not optimally configured the prefork and worker MPMs. The default ELB idle timeout limit of 60 seconds. For more information, see What are the optimal settings for using Apache or NGINX as a backend server for ELB?For help resolving this error, see How do I troubleshoot HTTP 504 errors returned while using a Classic Load Balancer?Related informationWhat is Elastic Load Balancing?Tutorial: Create a Classic Load BalancerConfigure health checks for your Classic Load BalancerMonitor your Classic Load Balancer