VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I apply a resource-based policy on an AWS Secrets Manager secret?

How can I control access to AWS Secrets Manager secrets using resource-based policies?Short descriptionWith resource-based policies, you can specify user access to a secret and what actions an AWS Identity and Access Management (IAM) user can perform.Note: A secret is defined as a resource with Secrets Manager.Common use cases for Secrets Manager resource-based policies are:Sharing a secret between AWS accounts.Enforcing permissions, such as adding an explicit deny to the secret.In this example resource-based policy, the IAM element Effect specifies whether the statement results in allow or an explicit deny. The IAM Action element defines the actions that are performed with the secret. The IAM Resource element is the secret that the policy is attached to. The IAM Principal element specifies the user with access to perform actions with the secret.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": "secretsmanager:*",      "Principal": {"AWS": "arn:aws:iam::123456789999:user/Mary"},      "Resource": "*"    }  ]}ResolutionFollow these instructions to apply a resource-based policy in Secrets Manager:Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.1.    Follow the instructions for creating a secret. Note the Secret ARN.2.    Copy and paste this policy into your favorite text editor, and then save it as a JSON file such as my_explicit_deny_policy.json.{ "Version": "2012-10-17","Statement": [    {      "Effect": "Deny",      "Action": "secretsmanager:GetSecretValue",      "Principal": {"AWS": "arn:aws:iam::123456789999:user/Mary"},      "Resource": "*"    }  ]}3.    Use the AWS CLI command put-resource-policy to place a resource policy for the secret to explicitly deny IAM user Mary from retrieving the secret value.aws secretsmanager put-resource-policy --secret-id My_Resource_Secret --resource-policy file:// My_explicit_deny_Policy.json4.    You receive an output similar to the following:{"ARN": "arn:aws:secretsmanager:<your region>:123456789999:secret:My_Resource_Secret","Name": "My_Resource_Secret"}Note: The AWS Key Management Service (AWS KMS) decrypt permission is required only if you use AWS KMS keys to encrypt your secret. A secret can't be retrieved by an IAM principal in a third-party account if the secret is encrypted by the default AWS KMS key.For more information, see Using resource-based policies for Secrets Manager.
Question: How do I create a certificate-based VPN using AWS Site-to-Site VPN?

I want to build a certificate-based IP Security (IPSec) VPN using AWS Site-to-Site VPN. How can I do this?Short descriptionAWS Site-to-Site VPN supports certificate-based authentication by integrating withAWS Certificate Manager Private Certificate Authority. Using digital certificates instead of pre-shared keys for IKE authentication, you can build IPSec tunnels with static or dynamic customer gateway IP addresses.

ResolutionTask 1: Create and install a root CA and a subordinate CAThe private certificate you'll create in task 2 must be issued by the subordinate CA. The subordinate CA must be in AWS Certificate Manager (ACM). If your CA is not in ACM, you can create a Certificate Signing Request (CSR) and import the signed subordinate CA into ACM.Task 2: Create a private certificate to use as the identity certificate for your customer gateway****Note: You'll install this certificate in task 5.Task 3: Create a customer gateway for your VPN connectionOpen the Amazon Virtual Private Cloud (Amazon VPC) console.Choose Customer Gateways, and then choose Create Customer Gateway.For Name, specify a name for your customer gateway.For Routing, select the routing type for your use case.Leave the IP Address field empty if your customer gateway IP address is dynamic. If your customer gateway IP address is static, you can leave this field empty, or you can specify the IP address.For Certificate ARN, choose the certificate ARN that you created in task 2.(Optional) For Device, specify a device name.Choose Create Customer Gateway.Task 4: Configure the AWS Site-to-Site VPN connection with a virtual private gatewayTask 5: Copy the end entity certificate (the private certificate that you created in task 2), root CA certificate, and subordinate CA certificate to the customer gateway deviceNote: The customer gateway presents the end entity certificate when requested by the AWS VPN endpoint for authentication. The customer gateway device must have all the certificates present (subordinate CA certificate and root CA certificate). If the customer gateway device doesn't have these certificates, VPN authentication fails when the AWS VPN endpoint presents its own certificate.

Related informationAWS Site-to-Site VPN now supports certificate authentication
Question: How can I set up access logging for API Gateway?

I'm trying to set up access logging for Amazon API Gateway. How can I do this?Short descriptionTo debug issues related to request execution or client access to your API, you can activate Amazon CloudWatch Logs to log API calls.

ResolutionBefore you begin, make sure that you have:Deployed your API to a stage.Granted API Gateway permission to read and write logs to CloudWatch for your account.Next, to activate access logging follow steps 1-5 and 7-8 (skip step 6) in the instructions for setting up CloudWatch API logging using the API Gateway console.Note: It's a best practice not to log the full API requests and responses for production APIs. Full API requests and responses can result in logging sensitive data.You now have CloudWatch logs activated for debugging. To find errors, see How do I find API Gateway REST API errors in my CloudWatch logs?For more information, see Monitoring REST API execution with Amazon CloudWatch metrics.

Related informationHow do I troubleshoot "Invalid permissions on Lambda function" errors from API Gateway REST APIs?How do I find 5xx errors from API Gateway in my CloudWatch logs?How do I turn on CloudWatch Logs for troubleshooting my API Gateway REST API or WebSocket API?
Question: Why am I being charged too much for Amazon Lightsail?

I signed up for an Amazon Lightsail plan, but I'm charged more than I expected.

Short descriptionHere are a few reasons why you might have incurred unexpected charges with your Amazon Lightsail plan:You signed up for the Lightsail plan that comes with the one-month free trial, but the free trial expired.You signed up for a more expensive Lightsail plan than you meant to.You signed up for Lightsail without meaning to.You exceeded your monthly data transfer allowance.In either of these cases, delete your Lightsail instance and any associated snapshots to stop charges from accruing.

ResolutionSign in to the Lightsail console, and check each resource tab to see if you have any running resources. Running resources will be under the Instances, Databases, Networking, Storage, or Snapshots tabs.If you don't need a particular resource, choose the menu icon (⋮) next to the resource name, and then choose Delete.For snapshots, expand the list of snapshots, choose the menu icon (⋮) for each snapshot, and then choose Delete.Note: Lightsail instance snapshots cost less per hour than running instances. Also, you can use snapshots to relaunch an identical instance later on. If you want to save your work, consider creating or retaining snapshots as a backup.After you delete all your Lightsail resources, no more Lightsail charges accrue.

Related informationLightsail pricingHow do I shut down my Amazon Lightsail resources?
Question: How can I find which AWS API call is causing a "Rate exceeded" error?

I receive a "Rate exceeded" error message when I try to create, update, or access an AWS service. How do I determine which AWS API call is causing the error?Short descriptionTo determine which API call is causing a Rate exceeded error in your AWS account, do the following:1.    Create an Amazon Athena table for AWS CloudTrail logs.2.    Run an Amazon Athena query to find the API call that's associated with the Rate exceeded error.To troubleshoot the issue, see the To troubleshoot Rate exceeded errors based on the associated API call and AWS service section of this article.Note: To log API activity in your AWS account, you must first create a trail in CloudTrail. Any data events that occur in your account before you create a trail aren't logged by the trail.

ResolutionCreate an Amazon Athena table for CloudTrail logsFor instructions, see Using the CloudTrail console to create an Athena table for CloudTrail logs.Create and run the Athena query to find the associated API call1.    Open the Athena console.2.    Choose the New query tab.3.    Copy and paste the following example query into the query text box, and then choose Run query:Important: Replace cloudtrail-table-name with the name of your CloudTrail table.select eventname, errorcode,eventsource,awsregion, useragent,COUNT(*) count FROM cloudtrail-table-name   where errorcode = 'ThrottlingException'AND eventtime between '2018-10-14T03:00:08Z' and '2018-10-23T07:15:08Z'group by errorcode,awsregion, eventsource, useragent, eventnameorder by count desc;4.    In the query output, identify the API calls listed in eventname and eventsource that are associated with the errorcode, "ThrottlingException".To troubleshoot Rate exceeded errors based on the associated API call and AWS serviceNote: Rate exceeded errors can occur with different throttling conditions, depending on the AWS service and API call that you're using.Refer to the following troubleshooting documentation for the API call and service that's associated with the Rate exceeded error that you're receiving:For GetResourceConfigHistory or ListDiscoveredResources API callsSee How can I troubleshoot AWS Config console error messages?For the PutMetricData API callSee How do I avoid throttling when I call PutMetricData in the CloudWatch API?For API calls related to AWS Auto ScalingSee My Auto Scaling API calls are getting throttled. What can I do to avoid this?For API calls related to an AWS Lambda functionSee How do I troubleshoot Lambda function throttling with "Rate exceeded" and 429 "TooManyRequestsException" errors?For API calls related to AWS Elastic BeanstalkSee How can I resolve API throttling or "Rate Exceeded" errors in Elastic Beanstalk?Note: You can also allow AWS API calls to retry after throttling occurs by adding a wait statement. For more information, see Error retries and exponential backoff in AWS.

Related informationHow do I automatically create tables in Amazon Athena to search through AWS CloudTrail logs?
Question: How can I troubleshoot Direct Connect gateway routing issues?

How do I troubleshoot routing issues between my VPC and on-premises network involving Private VIF and AWS Direct Connect gateway with Virtual Private Gateway as the association?Short descriptionI can't connect from an on-premises data center to Virtual Private Cloud (Amazon VPC) resources over a private virtual interface associated with a Direct Connect gateway and virtual private gateway.

ResolutionFollow these troubleshooting steps for your virtual private gateway.Check the Amazon VPC subnet route table. Make sure that it has a static or propagated route entry for the on premises network pointing to the virtual private gateway.Be sure that the Direct Connect gateway is associated with the correct virtual private gateway.Make sure that the virtual private gateway has the allowed prefixes for the Direct Connect gateway entered as the entire VPC CIDR, or a CIDR wider than the VPC CIDR. Note: If you specify a CIDR less than the VPC CIDR, you won't receive a route on your gateway router.Make sure that your router is advertising the on premises prefix to AWS over the Border Gateway Protocol (BGP) session of the private VIF.Verify that the security group rules and the network ACLs allow traffic to and from the on premises network.Verify that the firewall rules on your router allow traffic from the Amazon VPC subnet CIDR.To troubleshoot transit virtual interfaces, see Why can't I connect to VPC resources over a transit virtual interface using a Direct Connect connection?Related informationHow do I configure routing for my Direct Connect private virtual interface?How can I control the routes advertised and received over the AWS public virtual interface with Direct Connect?
Question: How do I remove local administrator rights from WorkSpaces users?

I want to turn off local administrator rights for Amazon WorkSpaces users.

ResolutionTo turn off administrator rights, update the Local Administrator Setting from the WorkSpaces console. For instructions, see Manage local administrator permissions.Note: When you update the directory details to turn off access for local administrators, the change applies only to newly created WorkSpaces. To apply the change to an existing WorkSpace, rebuild the WorkSpace.To make changes to a WorkSpace's operating system after removing local administrator rights, connect to the WorkSpace using a Remote Desktop Protocol (RDP) client. When connecting with an RDP, you still must use a WorkSpaces user account that has administrator permissions, such as a domain administrator. If you connect to the WorkSpace with RDP as a regular WorkSpaces user or domain user, then you're prompted for elevated access rights.

Related informationAdminister your WorkSpaces
Question: Can I merge multiple AWS accounts together?

I have resources on multiple AWS accounts, and I want to merge all the resources together under one account.

ResolutionIt's not possible to merge multiple AWS accounts together.However, you can use AWS Organizations to manage multiple AWS accounts, and then combine the billing in one consolidated bill.You can also transfer some AWS resources between AWS accounts. For example, with Amazon Elastic Compute Cloud (Amazon EC2), you can share custom Amazon Machine Images (AMIs) between accounts. This allows you to transfer instances between accounts. Because each AWS service is unique, the way to move resources between accounts varies by service. For more details, see AWS Documentation.

Related informationShare an AMI with specific AWS accounts
Question: How do I remove the restriction on port 25 from my Lightsail instance?

I'm having trouble sending email over port 25 from my Amazon Lightsail instance.

Short descriptionBy default, AWS blocks outbound traffic on port 25 on all Lightsail instances. To send outbound traffic on port 25, request that this restriction be removed.

ResolutionTo request that AWS remove the port 25 restriction on your Lightsail instance, do the following:Sign in to the Amazon Lightsail console as the AWS account root user.Open the Request to remove email sending limitations form.Enter your email address.Provide the required information in the Use case description field:A clear and detailed use case for sending email from your Lightsail instance.A statement outlining your plan to confirm that your account isn't implicated in sending unwanted emails.Confirmation that the request is for the Lightsail instance. You can also provide the Lightsail instance name.The Region where your Lightsail instance is hosted.(Optional) In the Elastic IP address field, provide the AWS owned Elastic IP addresses that you use to send outbound emails.(Optional) In the Reverse DNS record field, enter any reverse DNS (rDNS) records that AWS must associate with the Elastic IP addresses. When you send emails, it's a best practice to set up an rDNS record to help prevent outbound emails from being flagged as spam. Make sure to link the rDNS record to your static IP address using a DNS A record. For example, if mail.example.com is the rDNS record that you're setting, be sure that you create an A record for mail.example.com that points to the Static IP address. This is the domain that is returned when the reverse DNS lookup is performed.Choose Submit.Note: If you have instances in more than one Region, then submit a separate request for each Region.You receive an email with the Request ID after submitting the request form. It might take up to 48 hours to process your request. If your request is approved, you receive an email to notify you that the port 25 restriction is removed. If you don't receive an update within 48 hours after submitting the request, then reply to the initial email that you received.

Related informationHow do I remove the restriction on port 25 from my Amazon EC2 instance or AWS Lambda function?Configuring reverse DNS for an email server on your Amazon Lightsail instance
Question: Can I use Amazon S3 for Hadoop storage instead of HDFS?

I want to configure Amazon EMR to use Amazon Simple Storage Service (Amazon S3) as the Apache Hadoop storage system instead of the Hadoop Distributed File System (HDFS).

ResolutionYou can't configure Amazon EMR to use Amazon S3 instead of HDFS for the Hadoop storage layer. HDFS and the EMR File System (EMRFS), which uses Amazon S3, are both compatible with Amazon EMR, but they're not interchangeable. HDFS is an implementation of the Hadoop FileSystem API, which models POSIX file system behavior. EMRFS is an object store, not a file system. For more information, see Hadoop documentation for Object Stores vs. Filesystems.For an overview of the storage layers in Amazon EMR, see Overview of Amazon EMR architecture.For recommendations about when to use each file system, see Work with storage and file systems.

Related informationEMR File System (EMRFS)HDFS configuration
Question: How do I resolve authorization errors when trying to add subscribers to an Amazon SNS topic?

I receive AWS Identity and Access Management (IAM) authorization errors when I add subscribers to my Amazon Simple Notification Service (Amazon SNS) topic. How do I resolve the errors?Short descriptionWhen an IAM entity tries to add a subscription to an Amazon SNS topic without Subscribe API action permissions, SNS returns the following error:An error occurred (AuthorizationError) when calling the Subscribe operation: User: your_IAM_user_or_role is not authorized to perform: sns:Subscribe on resource: YOUR_SNS_TOPIC_ARNNote: The IAM entity could be an IAM user or role.To resolve the error, grant the IAM entity permission to run the Subscribe API action on the Amazon SNS topic.If you receive a similar error that ends in an "explicit deny"Remove any policy statements that explicitly deny the IAM entity access to the SNS resource.

ResolutionIf the IAM entity and the SNS topic are in different AWS accountsDo both of the following:Attach an IAM policy statement to the IAM entity that allows entity to run the "sns:Subscribe" actionFor instructions, see Adding and removing IAM identity permissions. Attach the following example IAM policy statement:Important: Replace "YOUR_SNS_TOPIC_ARN" with your Amazon SNS topic's Amazon Resource Name (ARN).{    "Version": "2012-10-17",    "Statement": [        {            "Sid": "SNSSubscribePermission",            "Effect": "Allow",            "Action": "sns:Subscribe",            "Resource": "YOUR_SNS_TOPIC_ARN"        }    ]}Attach an Amazon SNS policy statement to your topic's access policy that allows the IAM entity to run the "sns:Subscribe" actionFor instructions, see How do I edit my Amazon SNS topic's access policy? Attach the following example Amazon SNS policy statement:Important: Replace "YOUR_IAM USER/ROLE_ARN" with your IAM entity's ARN. Replace "YOUR_SNS_TOPIC_ARN" with your Amazon SNS topic's ARN.{  "Sid": "AllowIAMEntity",  "Effect": "Allow",  "Principal": {    "AWS": "YOUR_IAM USER/ROLE_ARN "  },  "Action": "sns:Subscribe",  "Resource": "YOUR_SNS_TOPIC_ARN"}If the IAM entity and the SNS topic are in the same accountDo either of the following, but not both:Attach an IAM policy statement to the IAM entity that allows entity to run the "sns:Subscribe" action.-or-Attach an Amazon SNS policy statement to your topic's access policy that allows the IAM entity to run the "sns:Subscribe" action.For example policy statements, see the If the IAM entity and the SNS topic are in different AWS accounts section of this article.Verify that neither the IAM entity's policy or SNS topic's access policy explicitly denies access to the SNS resourceReview the IAM entity's policy and SNS topic's access policy. Then, remove any policy statements that explicitly deny the IAM entity access to the SNS resource.For more information, see The difference between explicit an implicit denies.

Related informationUsing identity-based policies with Amazon SNS
Question: Why did AWS Global Accelerator fail over to an endpoint in a different Region?

I want to troubleshoot what caused AWS Global Accelerator to fail over to an endpoint in a different Region.

Short descriptionThe AWS Global Accelerator uses traffic dial settings to route traffic to endpoint groups. It also uses endpoint weight to determine the proportion of traffic that's directed to an endpoint. If there's no healthy endpoint with a weight greater than zero (0), then Global Accelerator fails over to a healthy endpoint with a weight greater than 0 in another endpoint group.

ResolutionPrevent Global Accelerator's failover to a different endpoint group by checking the traffic dial setting and the endpoint weights in the endpoint groups. Then, verify the health of the endpoints.Check the traffic dial settingGlobal Accelerator uses traffic dial to route traffic between different endpoint groups. An endpoint group with 0 traffic dial doesn't receive any traffic. However, if there's no healthy endpoint in an endpoint group with a weight greater than 0, then the accelerator fails over to another endpoint group with a healthy endpoint and a weight greater than 0. For this failover, the accelerator ignores traffic dial settings.Example: Let's say that you configure Global Accelerator with three endpoint groups, with traffic dial setting as shown here:EndpointGroup 1: Dial 100EndpointGroup 2: Dial 0EndpointGroup 3: Dial 0If EndpointGroup 1 doesn't have healthy endpoints with a weight greater than 0, then Global Accelerator checks up to two additional endpoint groups for a healthy endpoint. If endpoint groups 2 and 3 are closest to the client and are healthy with a weight greater than 0, then the accelerator fails over. It routes traffic to the endpoint in these endpoint groups, ignoring the traffic dial settings.Check weight of endpoints in endpoint groupsGlobal Accelerator uses weight to route traffic within an endpoint group. An endpoint with 0 weight does not receive any traffic, even if the endpoint is healthy. If all the endpoints have 0 weight, then the accelerator tries to find endpoints with a weight greater than 0 in another endpoint group. If it locates a healthy endpoint with a weight greater than 0, the accelerator routes traffic to that endpoint. If not, the accelerator fails open and includes endpoints in the nearest endpoint group.Example: Let's say that you've configured instance 1 as an endpoint in EndpointGroup 1 and instance 2 as an endpoint in EndpointGroup 2. If the weight of instance-1 is 0, then the accelerator fails over and routes traffic to instance-2 if it's healthy and has a weight greater than 0.Verify if the endpoints are healthyCheck if the endpoints are passing a health check by using health check status. For more information on how to remedy health check failures, see Why is Global Accelerator failing health checks with endpoints?Related informationDeploying multi-Region applications in AWS using AWS Global AcceleratorTraffic management with AWS Global Accelerator