VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why is my deleted EBS volume still showing as compliant or noncompliant in my AWS Config rule?

I deleted my Amazon Elastic Block Store (Amazon EBS). Why is my Amazon EBS volume still showing as compliant or noncompliant in my AWS Config rule?Short descriptionAmazon EBS volumes are durable, block-level storage devices that you can attach to Amazon Elastic Compute Cloud (Amazon EC2) instances. You can delete Amazon EBS volumes by:Stopping the Amazon EC2 instance, detaching the Amazon EBS volume, and then running the DeleteVolume API call.Setting the DeleteOnTermination attribute to true, and then running the TerminateInstances API call.

ResolutionAmazon EBS volumes deleted with the DeleteVolume API callAmazon EBS volumes deleted using the DeleteVolume API call invoke a DescribeVolumes API call on volume. The DescribeVolumes API call returns an InvalidVolume.NotFound error code, and the Amazon EBS volume is removed from the list of resources in AWS Config. The updated configuration of the volume is recorded as a configuration item with a status as ResourceDeleted, and then delivered to an Amazon Simple Storage Service (Amazon S3) bucket.Amazon EBS volumes deleted with the TerminateInstances API callTerminated Amazon EC2 instances use the DeleteOnTermination attribute for each attached EBS volume to determine to delete the volume. By default, the DeleteOnTermination attribute for the root volume of an Amazon EC2 instance is set to true, and set to false for all other volume types. Amazon EC2 deletes the Amazon EBS volume that have the DeleteOnTermination attribute set to true, but it does not publish the DeleteVolume API call. This is because AWS Config uses the DeleteVolume API call as a trigger with the rule, and the resource changes aren't recorded for the EBS volume. The EBS volume still shows as compliant or noncompliant.AWS Config performs a baseline every six hours to check for new configuration items with the ResourceDeleted status. The AWS Config rule removes the deleted EBS volumes from the evaluation results. If you choose the "Include deleted resources" check box, you can safely ignore any deleted Amazon EBS volumes.Note: Amazon EBS volumes associated with Amazon EC2 instances created by Auto Scaling groups use the TerminateInstances API call to terminate the instance.

Related informationDeleting an Amazon EBS volumeHow can I prevent my EBS volumes from being deleted when I terminate my EC2 instances?
Question: Why did I receive an Amazon GuardDuty finding type Trojan:EC2 alerts for my Amazon EC2 instance?

Amazon GuardDuty detected finding type Trojan:EC2 alerts for my Amazon Elastic Compute Cloud (Amazon EC2) instance.

ResolutionWhen GuardDuty detects anomalous Amazon EC2 activity, GuardDuty responds with a Trojan alert. Check each reference in this list to find the reason for the alert. Then, follow the instructions for remediating a compromised EC2 instance.Attempting to communicate with an IP address of a remote host that is a known black hole.Attempting to communicate with an IP address of a remote host that is known to hold credentials and other stolen data captured by malware.Querying a domain name that is being redirected to a black hole IP address.Querying a domain name of a remote host that is a known source of drive-by download attacks.Querying a domain name of a remote host that is known to hold credentials and other stolen data captured by malware.Querying algorithmically generated domains.Exfiltrating data through DNS queries.Querying domains involved in phishing attacks.For more information, see GuardDuty EC2 finding types and How Amazon GuardDuty uses its data sources.

Related informationCreating custom responses to GuardDuty findings with Amazon CloudWatch EventsHow to use Amazon GuardDuty and AWS Web Application Firewall to automatically block suspicious hostsSecurity solutions in AWS MarketplaceGuardDuty finding format
Question: How do I restrict CIDR IP addresses for a LoadBalancer type service in Amazon EKS?

I want to restrict CIDR IP addresses for a LoadBalancer type service in Amazon Elastic Kubernetes Service (Amazon EKS).

Short descriptionIf you create a service of type:LoadBalancer, then requests from the source 0.0.0.0/0 are allowed by default. If your load balancer is in a public subnet, then requests are routed to worker nodes from anywhere on the internet.

ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Set up your environment1.    Create an Amazon EKS cluster.2.    Create and launch worker nodes.3.    Set up kubectl.4.    Set up the AWS CLI.5.    Set up the AWS Load Balancer Controller.Note: The AWS Load Balancer Controller supports the following versions of the AWS Network Load Balancer for Services of type LoadBalancer: NLB ip mode (version 2.0.0 or above) and NLB instance mode (2.2.0 or above)Important: It's a best practice to use the AWS Load Balancer Controller when you provision a new Network Load Balancer for Services of type LoadBalancer. Use the AWS Load Balancer Controller instead of the Kubernetes in-tree service load balancer controller.Restrict CIDR IP addresses1.    In your service manifest file (svc.yaml), add the .spec.loadBalancerSourceRanges field. For example:apiVersion: v1kind: Servicemetadata:  labels:    app: nginx  name: nginx  annotations:    service.beta.kubernetes.io/aws-load-balancer-type: "external"    service.beta.kubernetes.io/aws-load-balancer-nlb-target-type: "instance"    service.beta.kubernetes.io/aws-load-balancer-scheme: "internet-facing"spec:  ports:  - port: 80    protocol: TCP    targetPort: 80  selector:    app: nginx  type: LoadBalancer  loadBalancerSourceRanges:  - "143.231.0.0/16"2.    To apply the manifest file, run the following command:$ kubectl apply -f svc.yaml3.    To confirm that the inbound rules on the security group are modified, run the following AWS CLI command:$ aws ec2 describe-security-groups --group-ids sg-XXXXXXXXXXXXXXXXX...    "CidrIp": "143.231.0.0/16"...Finally, consider the following:If you use NLB ip mode, then the .spec.loadBalancerSourceRanges field is ignored by default. In this case, use the following annotation:service.beta.kubernetes.io/aws-load-balancer-target-group-attributes: preserve_client_ip.enabled=trueThis annotation enables Client IP preservation.For a service with a Network Load Balancer type, consider the maximum security group limit. For each node port and subnet CIDR range, the controller creates rules on the worker node's security group.

Related informationCluster authenticationKubernetes Service
Question: How do I access the internet using Site-to-Site VPN in my on-premises network?

I want to connect my on-premises network to the internet using AWS Site-to-Site VPN and the AWS Transit Gateway.

Short descriptionAWS Site-to-Site VPN allows secured connectivity between AWS resources and the on-premises network such as a data center or a branch office.AWS Site-to-Site VPN provides two tunnels per connection, using the virtual private gateway or the AWS Transit Gateway. The virtual private gateway provides connectivity to a single Amazon Virtual Private Cloud (Amazon VPC) in a Region. The transit gateway provides connectivity to multiple Amazon VPCs in a region as well as to the internet.For more information on how AWS Site-to-Site VPN works, see What is AWS Site-to-Site VPN?ResolutionEstablish the Site-to-Site VPN connection through a transit gateway to get centralized internet access from your on-premises network. This centralized setup uses AWS Network Translation Service (NAT gateway) to connect to the internet.Follow these steps to gain internet access from your on-premises network:1.    Create a transit gateway.2.    Create a Site-to-Site VPN using a transit gateway.3.    Attach your Amazon VPC to a transit gateway in your Region.4.    Create a public NAT gateway in a public subnet in the same Amazon VPC.5.    Create a default-route 0.0.0.0/0 in the VPC’s subnet routing table associated with transit gateway. This route points to the NAT gateway that you created earlier.Destination  Target0.0.0.0/0    nat-123456789012345676.    Create a route for the on-premises CIDR in the public subnet routing table you used earlier. This route points to the transit gateway.Destination  Target10.0.0.0/16  tgw-123456789098765430.0.0.0/0    igw-123456789012345677.    Create a default route 0.0.0.0/0 in the transit gateway routing table associated with VPN attachment. Then, point it to the Amazon VPC attachment:CIDR        Attachment ID                  Resource ID        Resource type       Route type        Route state    Prefix list ID0.0.0.0     tgw-attach-98765432109876      vpc-987654321      VPC                 Static            Active         -8.    Create a route (Static route or propagate) for the on-premises CIDR in the transit gateway routing table associated with the Amazon VPC attachment. Then, point it to the VPN attachment:CIDR          Attachment ID               Resource ID         Resource type      Route type       Route state     Prefix list ID10.0.0.0/16   tgw-attach-1234567890123    vpn-1234567897      VPN                Static           Active          -Note: The Site-to-site VPN encryption domain must allow traffic between the on-premises CIDR and any (0.0.0.0) destination, a policy-based VPN.

Related informationCreating a transit gateway VPN attachmentTransit gateway route tables
Question: How do I create event subscriptions to send alerts or notifications for AWS DMS?

I want to receive notifications when AWS Database Migration Service (AWS DMS). How do I create event subscriptions for AWS DMS?Short descriptionUse AWS DMS event subscriptions to receive notifications when a specified event occurs for a replication task or replication instance. For example, you can receive notifications when replication instances are created or deleted.For replication tasks, you can create subscriptions for the following events:Configuration changeCreationDeletionFailureState changeFor replication instances, you can create subscriptions for the following events:Configuration changeCreationDeletionFailoverFailureLow storageMaintenance

ResolutionOpen the AWS DMS console, and then choose Event subscriptions.Choose Create event subscription.Enter a Name for your subscription.Choose the Target and Event source. If you already created Amazon Simple Notification Service (Amazon SNS) topics, select a topic. If you haven't created a topic, choose Create new email topic or Create new SMS topic. Then, enter the topic name and recipients.For Event source, select replication-instance or replication-task.Choose All event categories or Select specific event categories, such as deletion or creation.Choose All tasks (or instances) or choose Select specific tasks (or instances).Choose Create event subscription.If you created the subscription with a new email topic, you receive a notification that asks you to confirm the subscription by clicking a link. Otherwise, you receive an SMS notification or confirmation email with the topic details, and a link to unsubscribe. For more information, see Subscribing to AWS DMS event notification.

Related informationWorking with events and notifications in AWS Database Migration ServiceEventSubscription
Question: How do I remove a member account from an organization in AWS Organizations when I can't sign in to the member account?

I want to remove a member account from an organization and turn that account into a standalone account. However, I can't sign in to the member account. What should I do?ResolutionTo gain access to a member account in an organization, first try the following:Contact the administrator of the member account and ask them to grant you access.If you have access to the email address associated with the account, but have forgotten the password, reset the password.If the preceding steps don't work, use AWS Identity and Access Management (IAM) to assume an administrator's role for the account:If the member account was created using the AWS Organizations Console, the IAM role OrganizationAccountAccessRole was automatically created to grant administrative permissions to the management account.If the account was invited to the organization, the IAM role OrganizationAccountAccessRole wasn't automatically created. To create the AWS Organizations admin role for an invited member account, see Creating the OrganizationAccountAccessRole in an invited member account.Add permissions to assume an administrator's IAM role for the member account. For more information, see Accessing a member account that has a management account access role. Then, switch to the IAM role in the AWS Management Console. After you assume the OrganizationAccountAccessRole for the member account, do the following:Open the IAM console, choose Users from the navigation pane, and then choose Add user.Enter a user name, and then select AWS Management Console access.Select Custom password, and then enter a password.Clear Require password reset.Choose Next: Permissions.Choose Attach existing policies directly, choose AdministratorAccess from the list of policies, and then choose Next: Tags.(Optional) On the Add tags page, enter values for Key and Value.Choose Next: Review.Review the details of your new IAM user, and then choose Create user.After you complete these steps, verify the necessary details, and then remove the member account from the organization.Note: If you want to close a member account and make sure that additional charges aren't incurred, open the AWS Organizations console. Then, follow the instructions at Closing an AWS account. You can also close the account by signing in as the root user of your member account.

Related informationAccessing and administering the member accounts in your organizationHow do I remove a member account from an organization's consolidated bill in AWS Organizations?
Question: Why does my Amazon EMR application fail with an HTTP 404 "Not Found" AmazonS3Exception?

When I run an application on Amazon EMR, the application fails with the HTTP 404 "Not Found" AmazonS3Exception:java.io.IOException: com.amazon.ws.emr.hadoop.fs.shaded.com.amazonaws.services.s3.model.AmazonS3Exception: Not Found (Service: Amazon S3; Status Code: 404; Error Code: 404 Not Found; Request ID: 3FEDF6CC9E4A8102; S3 Extended Request ID: 4oznJE5O44ySDrMMQ4g3F0L1+1ETqD0ANPWc0kYw0278zRX+TovNyu1ceLfcw21jasFxkkPfOuM=), S3 Extended Request ID: 4oznJE5O44ySDrMMQ4g3F0L1+1ETqD0ANPWc0kYw0278zRX+TovNyu1ceLfcw21jasFxkkPfOuM=ResolutionThis error indicates that your application tried to access an Amazon Simple Storage Service (Amazon S3) file or path that doesn't exist. Here are some common causes and solutions:The Amazon S3 path was mistyped or deleted: Before launching your application, confirm that you correctly entered the Amazon S3 path and that the path exists.Other applications or accounts are accessing the same Amazon S3 files: It's possible that the file or path was deleted by another application or account. Before launching your application, check if other applications or accounts are actively accessing the same Amazon S3 path.

Related informationWhy does my Spark or Hive job on Amazon EMR fail with an HTTP 503 "Slow Down" AmazonS3Exception?Why does my Amazon EMR application fail with an HTTP 403 "Access Denied" AmazonS3Exception?Error responses
Question: How do I create and synchronize SQL and Windows logins on Amazon RDS for SQL Server read replica?

Amazon Relational Database Service (Amazon RDS) for Microsoft SQL Server read replica asynchronously replicates changes made on the master instance. One of the limitations is that logins don't synchronize after instance creation. How do I create and synchronize the logins after an instance is created?ResolutionUse the following steps to create, confirm, and synchronize the SQL Server and Windows logins on the master instance:SQL loginsSQL server logins are authenticated by database engine instances and the login passwords are stored in the master database. SQL logins can be mapped to a database user in one database or different users in different databases. Logins and users generate a unique statement ID (SID). This means that when synchronizing logins on read replica, you must make sure that the Login SID matches the SID on the master instance.Create SQL login on master instance and synchronize with read replica1.    On the master instance create a SQL Server login named "testlogin".USE [master]GOCREATE LOGIN [testlogin] WITH PASSWORD=N'Pa$$word';2.    Confirm that the login "testlogin" is created on the master instance.SELECT name FROM sys.sql_logins WHERE name = 'testlogin';3.    On the master instance, find the SID mapped to the login "testlogin".select name, sid  FROM sys.sql_logins WHERE name = 'testlogin'name                                         sid-------------------------------------------------------------------------------testlogin                      0xEBF23823BDEAED42823C76C8706F4B6B4.    On the read replica, create a new login "testlogin" mapped to the SID from the master instance.CREATE Login testlogin  WITH password = ' Pa$$word', SID = 0xEBF23823BDEAED42823C76C8706F4B6B5.    Confirm that the new login is created with matching SID.SELECT name, sid  FROM sys.sql_logins WHERE name = 'testlogin'Windows loginsWindows-authenticated SQL server logins are instance-level logins where the operating system handles the authentication. Windows logins can be mapped to a user account, local security group, or a domain account.Create Windows login on master instance and read replicaTo create a Windows login on the master instance and read replica, do the following:1.    On the master instance, create a windows login ‘[SQLAD\user1]’.CREATE LOGIN [SQLAD\user1] FROM WINDOWSWITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]GO2.    On read replica, create login ‘[SQLAD\user1]’ using the same command. Unlike a SQL login, Windows-authenticated SQL logins don't require a SID to be mapped.CREATE LOGIN [SQLAD\user1] FROM WINDOWSWITH DEFAULT_DATABASE=[master], DEFAULT_LANGUAGE=[us_english]GOOn Amazon RDS, it's not possible to use Microsoft-provided store procedures "sp_help_revlogin" and "sp_hexadecimal" to generate logins. This is because Amazon RDS doesn't provide elevated privileges on a master database.
Question: Why can't I find my imported certificate for my load balancer or CloudFront distribution?

I requested or imported a certificate using AWS Certificate Manager (ACM). I'm configuring a load balancer or Amazon CloudFront distribution, but I can't find the certificate.

Short descriptionIf you don't have a certificate issued for your domain name, you can request a public certificate using ACM. To use a third-party certificate with a load balancer, import the certificate into ACM or upload a certificate to AWS Identity and Access Management (IAM).Important:It's a best practice to use IAM as a certificate manager when you must support HTTPS connections in a Region that isn't supported by ACM. For more information, see Managing server certificates in IAM.ACM certificates can be used only with services integrated with ACM.You won't find the imported certificate or ACM certificate if:The certificate imported into ACM is using an algorithm that's not supported by the load balancer or the CloudFront distribution.The ACM certificate wasn't requested in the same AWS Region as your load balancer or CloudFront distribution.

ResolutionThe certificate imported into ACM is using an algorithm that's not supported by the load balancer or the CloudFront distribution.Although ACM allows certificates with a key algorithm of 4096-bit RSA and EC, these certificates can't be associated with all load balancers through integration with ACM. The following imported key algorithms can be used with a Classic Load Balancer and Application Load Balancer:AlgorithmClassic ACM (Preferred)Application ACM (Preferred)IAM1024-bit RSA (RSA_1024)YesYesYes2048-bit RSA (RSA_2048)YesYesYesRSA_4096NoYesYesRSA (up to 16384 bits)NoNoYesElliptic Curve (ECDSA)NoYesYesNote: Network Load Balancers don't allow certificates with RSA keys larger than 2048-bit or EC keys.To install an SSL certificate, follow these instructions for your load balancer type:Configure an HTTPS listener for your Classic Load BalancerCreate an HTTP listener for your Application Load BalancerCreate a listener for your Network Load BalancerIf the imported certificate isn't supported by ACM, follow the instructions to import an SSL certificate to IAM. Then, associate the imported certificate with the load balancer. For more information, see Uploading a server certificate (AWS API).For CloudFront distributions, the certificate’s key algorithms must be 1024-bit RSA or 2048-bit RSA. For more information, see Size of the public key.To install the SSL certificate on CloudFront distribution, see Using HTTPS with CloudFront.The ACM certificate wasn't requested in the same AWS Region as your load balancer or CloudFront distributionACM certificates must be requested or imported in the same AWS Region as your load balancer.To use the ACM certificates with Amazon CloudFront, the certificates must be imported or requested in the US East (N. Virginia) Region. For more information, see AWS Region that you request a certificate in (for AWS Certificate Manager).

Related informationHow can I add certificates for multiple domains to a load balancer using AWS Certificate Manager?ACM certificate characteristics
Question: How can I use AWS Artifact to download the FedRAMP Customer Package?

I need to download the FedRAMP Customer Package to share with our customers or partners using AWS Artifact.

ResolutionTo access and validate security and compliance reports including the AWS FedRAMP Security Packages, see the AWS Artifact FAQs and review the Compliance Reports section.To download the AWS Customer FedRAMP Security Package:Open the AWS Artifact console.Choose View reports.Choose the FedRAMP Customer Package, and then choose Download report.For more information, see Downloading reports in AWS Artifact.

Related informationHow can I download and share AWS Artifact documents with regulators and auditors, or with others in my company?When does AWS release new SOC reports, and how can I download the latest report using AWS Artifact?
Question: How can I resolve the AWS KMS decrypt error "InvalidCiphertextException"?

I tried to decrypt environment variables using AWS Lambda encryption helpers and received the error "InvalidCiphertextException". All AWS Identity and Access Management (IAM) and AWS Key Management Service (AWS KMS) permissions are correct.

Short descriptionThe AWS KMS API action error InvalidCiphertextException indicates the decrypt request failed because Lambda has updated how to encrypt environment variables. Lambda passes the function name as the encryption context making the encrypt call to AWS KMS. For decrypt functions created before this change, you must update the code for decryption and pass the Lambda function name as encryption context.

ResolutionTo get the code with the decrypt call to AWS KMS for a specific SDK with the encryption context, follow these steps:Open the Lambda console, and then choose Functions.In Function name, choose the Lambda function.In Environment variable, choose Edit, and then choose Add environment variable.Enter a Key and Value, and then expand Encryption configuration.Choose Enable helpers for encryption in transit, and then choose Encrypt.Expand Decrypt secret snippet, copy and paste the snippet similar to the following:DECRYPTED = boto3.client('kms').decrypt(    CiphertextBlob=b64decode(ENCRYPTED),    EncryptionContext={'LambdaFunctionName': os.environ['AWS_LAMBDA_FUNCTION_NAME']})['Plaintext'].decode('utf-8')Use this code snippet to Decrypt new environment variables encrypted with encryption helpers.Be sure to re-encrypt old environment variables so that they work with the new environment variables.For more information, see Using AWS Lambda environment variables.

Related informationHow can I verify that authenticated encryption with associated data encryption is used when calling AWS KMS APIs?