VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I set up my load balancer to work with IPv6 addresses?

I want to configure my load balancer so that my clients can connect to it using IPv6 addresses. How can I do this?Short descriptionTo use IPv6 addresses, the virtual private cloud (VPC) where you launch your Application Load Balancer must have subnets with associated IPv6 CIDR blocks. For more information, see IPv6 addresses. To associate IPv6 addresses with your VPC and subnets, see Associate IPv6 CIDR blocks with your VPC and Associate an IPv6 CIDR block with your subnet.

ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Update the IP address type using the AWS Management Console1.    Open the Amazon Elastic Compute Cloud (Amazon EC2) console.2.    On the navigation pane, under LOAD BALANCING, choose Load Balancers.3.    Select the load balancer.4.    Choose Actions, and then choose Edit IP address type.5.    For IP address type, choose either:ipv4 to support only IPv4 addresses-or-dualstack to support both IPv4 and IPv6 addresses6.    Choose Save.Update the IP address type to "dualstack" using the AWS CLIRun this command:aws elbv2 set-ip-address-type --load-balancer-arn <value> --ip-address-type <value>Note: Be sure to replace the placeholders in this command with your corresponding values. The possible values for --ip-address-type include  ipv4 and dualstack.Update the DNS record pointing to your Application Load BalancerUpdate the CNAME or Alias (A and AAAA) record of your domain to point to the Application Load Balancer’s DNS name (with a "dualstack." prefix). This example uses a load balancer DNS name with the "dualstack" prefix:dualstack.name-123456789.region.elb.amazonaws.comClients that communicate with the load balancer using IPv4 addresses resolve the A record. Clients that communicate with the load balancer using IPv6 addresses resolve the AAAA record.

Related informationRouting traffic to an Elastic Load Balancing load balancerIP address types for your Application Load BalancerEditing records
Question: How can I resolve "HTTP 403 Forbidden" errors when invoking my API with cross-account IAM authentication for API Gateway?

I called my Amazon API Gateway API with a cross-account AWS Identity and Access Management (IAM) entity (user or role). I get an "HTTP 403 Forbidden" error.

ResolutionREST APIsFor accessing API Gateway REST APIs, turn on IAM authentication for an API method in the API Gateway console. Then, use IAM policies and resource policies to designate permissions for your API's users.Make sure that the cross-account IAM entity has permissions to invoke the API and is allowed access in the resource policy.In this example, the REST API for account A 111111111 has IAM authentication enabled. User1 tries to invoke from account B 999999999. User1 in account B has the following IAM policy attached:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "execute-api:Invoke",        "execute-api:ManageConnections"      ],      "Resource": "arn:aws:execute-api:us-east-1:111111111:AB12CDEF34/*/*/*"    }  ]}To allow the IAM user for account B in account A to invoke cross-account access, use a resource policy similar to the following:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Principal": {        "AWS": "arn:aws:iam::999999999:user/User1"      },      "Action": "execute-api:Invoke",      "Resource": "arn:aws:execute-api:us-east-1:111111111:AB12CDEF34/stage/*/*"    }  ]}For more information, see How do I activate IAM authentication for API Gateway REST APIs?HTTP APIsFor accessing API Gateway HTTP APIs, you can use the sts:AssumeRole API action to assume a role for the HTTP API account. The assumed role provides temporary security credentials that can be used to invoke the HTTP API in another account.Make sure that the temporary security credentials used to invoke the HTTP API are correct and not expired.For more information, see How can I provide cross-account IAM authorization for API Gateway HTTP APIs?Related informationAPI Gateway resource policy examples
Question: How do I turn on DNSSEC on my domain with Route 53 and register a DS record?

I want to turn on Domain Name System Security Extensions (DNSSEC) for my domain registered with Amazon Route 53 through a registrar.

ResolutionTo turn on DNSSEC on your domain registered with Route 53, register your Delegation Signer (DS) record through a registrar that manages your domain name.Important: If your domain is a second-level domain (SLD), see How do I configure DNSSEC for my subdomain registered with Route 53 or another registrar?Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.1.    Confirm that your parent hosted zone is in the SIGNING status.2.    In the AWS CLI, use the get-dnssec command to get the key-signing keys (KSKs) public key and DS record of your parent hosted zone. Example output from the get-dnssec command:$ aws route53 get-dnssec --hosted-zone-id Zxxxxxxxxxxxxxxxxxxxx{  "Status": {    "ServeSignature": "SIGNING"  },  "KeySigningKeys": [    {      "Name": "forKnowledgeCenter",      "KmsArn": "arn:aws:kms:us-east-1:nnnnnnnnnnnn:key/4a7a9720-91b5-49d5-8069-79634593a1b9",      "Flag": 257,      "SigningAlgorithmMnemonic": "ECDSAP256SHA256",      "SigningAlgorithmType": 13,      "DigestAlgorithmMnemonic": "SHA-256",      "DigestAlgorithmType": 2,      "KeyTag": 1101,      "DigestValue": "000E2A1C338464CD62AB72843612660CEF8E1FB2F221555DB4E31F1FBD14DD5F",      "PublicKey": "ELfupc8RXEcoLl8AZiDX6LOInJMc1h7MDnuIEAWzJIG6vOB0QAOfRzFHT15WwGzXPZKqrTkSSTm+CSQlIfCWbg==",      "DSRecord": "1101 13 2 000E2A1C338464CD62AB72843612660CEF8E1FB2F221555DB4E31F1FBD14DD5F",      "DNSKEYRecord": "257 3 13 ELfupc8RXEcoLl8AZiDX6LOInJMc1h7MDnuIEAWzJIG6vOB0QAOfRzFHT15WwGzXPZKqrTkSSTm+CSQlIfCWbg==",      "Status": "ACTIVE",      "CreatedDate": "2020-12-21T13:11:47.974000+00:00",      "LastModifiedDate": "2020-12-21T13:11:47.974000+00:00"    }  ]}Complete the following steps to register the KSK public key and DS record with your parent hosted zone.If your registrar is Route 53, then register the KSK public key and DS record with Route 53 domains.1.    Open the Route 53 console.2.    In the navigation pane, choose Registered domains.3.    Follow the instructions for Turning on DNSSEC signing and establishing a chain of trust.Note:API:AddDnssec is supported only through the AWS Management Console.Choose Key type: 257 - KSKChoose Algorithm: 13 - ECDSAP256SHA256If your registrar isn't Amazon Route 53, then register the KSK public key and DS record with your registrar. The domain registrar forwards the public key and the algorithm to the registry for the top-level domain (TLD). Note that the DS record is a digest of the KSK public key.

Related informationConfiguring DNSSEC signing and validation with Amazon Route 53Troubleshooting DNSSEC signing
Question: How can I increase the SCP character size limit or number of SCPs for an AWS Organization?

I want to increase the character limit for service control policies (SCPs) or attach more SCPs to an entity in an AWS Organization.

Short descriptionThe maximum size for SCPs policy documents is 5,120 bytes. The maximum number of SCPs that can be attached to organizational units (OUs), root, or account is five. For more information, see Quotas for AWS Organizations.

ResolutionReduce the SCP size to stay below the 5,120 byte character limitReview the SCPs and remove duplicate permissions. For example, put all actions with the same Effect and Resource elements in one statement instead of multiple statements.Remove unnecessary elements such as Sid because they count against the total number of characters allowed.Use wildcards for actions with the same suffixes or prefixes. For example, the actions ec2:DescribeInstances, ec2:DescribeTags, ec2:DescribeSubnets can be combined as ec2:Describe*.Use SCP inheritance in the OU hierarchyThe five SCPs limit doesn't include SCPs that are inherited from the parent. You can use the inheritance structure of SCPs for OUs and member accounts and distribute SCPs across multiple OUs. For example, to deny IAM users or roles with your Organization's member accounts from accessing AWS services, set up your Organization structure as follows:Root    <--- 1 full access SCP (1 directly attached)   |OU1     <--- 1 full access, 4 deny SCPs (5 directly attached, 1 inherited) |OU2     <--- 1 full access, 4 deny SCPs (5 directly attached, 6 inherited) |Account <--- 1 full access, 4 deny SCPs (5 directly attached, 11 inherited) |BobPermissions that are filtered by SCPs at each node of an Organization hierarchy are the intersection of directly attached and inherited SCPs. The effective permissions allowed for IAM user Bob in a member account are full access minus services denied by the 12 deny based SCPs. This approach is scalable as the maximum number of nested OUs that you can have within your Organization hierarchy is five. For more information, see Inheritance for service control policies.Important: No permissions are granted by an SCP. The administrator must attach identity-based or resource-based policies to IAM users or roles, or to the resources in your accounts to grant permissions. For more information, see Service control policies (SCPs).

Related informationHow can I use SCPs and tag policies to prevent users in my AWS Organizations member accounts from creating resources?What's the difference between an AWS Organizations service control policy and an IAM policy?
Question: Why do I receive a “No Instances in Tag" message from my Systems Manager maintenance window?

I created a maintenance window that runs an AWS Systems Manager Run Command targeting Amazon Elastic Compute Cloud (Amazon EC2) instance tags. When the command runs, I receive a "No Instances in Tag" message.

Short descriptionWhen you run a maintenance window targeting instances that use Amazon EC2 instance tags, the instance IDs for managed instances resolve when the command runs. The instance ID won't resolve as a target if the instance isn't reporting to Systems Manager as Online. When a maintenance window can't resolve instance ID targets, you receive the "No Instances in Tag" message.The "No Instances in Tag" message also appears when the EC2 resource tag and the tag registered as a maintenance window target are mismatched. Systems Manager uses a string match method to resolve targets to tags. As a result, the tags are case-sensitive and character-sensitive. Any extra spaces entered into either the EC2 resource tag or the maintenance window target tag result in a "No Instance in Tag" message.

ResolutionTo troubleshoot an instance that isn't reporting as Online, see Why is my EC2 instance not displaying as a managed node or showing a "Connection lost" status in Systems Manager?To identify a mismatched tag, use AWS CloudTrail to help isolate the exact value that is passed by the maintenance window.Open the CloudTrail console, and then choose Event history to view events in the Region where you created the maintenance window.Change the search dropdown filter to Event name. For Enter an event name, enter SendCommand to view all Run Command API events. It's a best practice to set the time filter to the time that the maintenance window ran.Choose the hyperlinked Event name to view the API call in JSON format.Navigate to the "targets" section of the API call to view the exact tag values passed from the maintenance window. Then, compare the API call tag value to the EC2 instance tag assigned to your instance.Update the maintenance window targets or the EC2 instance tag so that both values match exactly.

Related informationViewing CloudTrail events in the CloudTrail consoleTroubleshooting Amazon EC2 managed node availabilityWhy do I receive a “No Invocations to Execute" message from my Systems Manager maintenance window?
Question: How do I remove a member account from an organization's consolidated bill in AWS Organizations?

I want to remove a member account from an organization's consolidated bill.

ResolutionIf you're signed in as the management account of an organization, then see Removing a member account from your organization.If you're signed in as a member account of an organization, then see Leaving an organization as a member account.If you're signed in as the management account of an organization and want to remove an invited account that you can't access, then first create and assume an AWS Organizations administrator role for that account. For more information, see Creating the OrganizationAccountAccessRole in an invited member account.The management account can restrict which accounts can leave the organization. If you get an error message such as an "access denied" when removing your account from the organization, contact the owner of the management account. They can remove your account from the organization for you. For more troubleshooting information, see Troubleshooting general issues.You might be prompted to provide additional information for the account that you're removing from the organization. You must complete the following actions before you migrate to a standalone account:Fill out your contact information.Verify the phone number associated with the account.Provide a valid payment method. For more information, see What payment methods does AWS accept?Select an AWS Support plan option. For more information, see Compare AWS Support Plans.When you remove a member account from an organization's consolidated bill, the management account is responsible for all charges incurred by the member account until the time the account is removed from the organization. The member account is liable for all charges incurred after the account is removed from the organization.Note: AWS Support can't remove a member account from an organization on your behalf for any reason.

Related informationHow do I remove a member account from an organization in AWS Organizations when I can't sign in to the member account?Consolidated billing for AWS OrganizationsCreating and managing an organization
Question: How do I resolve the "Attribute 'Key' does not exist" error when I use the Fn::GetAtt function on my resource provider resource in CloudFormation?

When I use the Fn::GetAtt function on my resource provider in AWS CloudFormation, I receive the following error:"Attribute 'Key' does not exist"Short descriptionCloudFormation returns the "Attribute 'Key' does not exist" error because it isn't receiving the required property. The ReadHandler of your resource must return a property that's specified from the readOnlyProperties list in the organization-service-resource.json resource provider schema file.For other errors that are related to using a resource provider, see the following articles:How do I resolve the "Resource specification is invalid" error when I run the cfn generate command using the CloudFormation CLI in CloudFormation?How do I resolve the "Model validation failed (#: extraneous key [Key] is not permitted)" error in CloudFormation?How do I resolve the "Resource timed out waiting for creation of physical resource" error when I create a resource using my resource provider type in CloudFormation?How do I resolve the "java.lang.ClassNotFoundException: com.example.package.resource.HandlerWrapper" error in CloudFormation?Resolution1.    In your organization-service-resource.json file, confirm that the readOnlyProperties definition uses the following format, where Output is a property that's defined in the properties section. For example:"readOnlyProperties": [    "/properties/Output"],Note: The organization-service-resource.json format is located in the root directory of your project.2.    In your ReadHandler, set the property in the model object. For example:final ResourceModel model = request.getDesiredResourceState();model.setOutput("abcdxyz");return ProgressEvent.<ResourceModel, CallbackContext>builder()    .resourceModel(model)    .status(OperationStatus.SUCCESS)    .build();Related informationAWS CloudFormation CLI (from the GitHub website)
Question: How do I log failed attempts to log in to my Amazon RDS for MySQL DB instance?

I want to track failed or dropped connections to my Amazon Relational Database Service (Amazon RDS) for MySQL DB instance for security purposes.

ResolutionWhen a connection to a DB instance that runs MySQL fails or is dropped, the attempted connection is logged in error.log. By default, the log_warnings DB parameter in the custom DB parameter group associated with the DB instance is turned on. This parameter tracks failed attempts to connect to a DB instance that is running MySQL. If the value of log_warnings is greater than one, then the server logs the dropped connections and access denied errors when new connections are attempted.If a user attempts to log in to your DB instance with the wrong credentials, then the failed attempts are captured to the error.log. See the following example of failed log in attempts in the logs:2016-08-23 15:03:37 1183 [Warning] Access denied for user 'tester'@'124.41.31.5' (using password: NO)Note: For DB instances running MySQL 5.7.2 and later, use log_error_verbosity instead of log_warnings. For more information, see the MySQL documentation for log_error_verbosity.It's a best practice to turn on general_log for short-term troubleshooting, and to then turn it off again after you finish troubleshooting. When turned on, general_log records every query that runs, resulting in significant overhead on production DB instances with heavy workloads.

Related informationMonitoring Amazon RDS log filesServer system variables in MySQL documentation
Question: What is an interface VPC endpoint and how can I create one for my VPC?

I want to create an interface endpoint for my Amazon Virtual Private Cloud (Amazon VPC).

ResolutionAn interface VPC endpoint allows you to privately connect your Amazon VPC to supported AWS services. Interface VPC endpoints also connect to endpoint services hosted by other AWS customers and partners and AWS Marketplace partner services.Follow the instructions on creating a VPC endpoint to create an interface endpoint to the relevant service for your use case. An endpoint network interface will then be created in the selected subnet with a private IP address that serves as an entry point for traffic to the service.You can associate security groups with the network interfaces for your interface endpoint to restrict traffic from resources in your Amazon VPC.

Related informationAWS PrivateLink concepts
Question: How do I use the AWS Cost and Usage Report?

How do I use the AWS Cost and Usage Report?ResolutionThe AWS Cost and Usage Reports provides a detailed dataset about your AWS billing. The report is delivered to an Amazon Simple Storage Service (Amazon S3) bucket of your choice.First, create a Cost and Usage Report. Later, you can view the Cost and Usage report in one of two ways:View your report  from the S3 bucket.Ingest the report into Amazon Athena, Amazon QuickSight, or Amazon Redshift.The AWS Cost and Usage Report contains dozens of data points for each billing item on your AWS bill.Note: The pricing, product, reservation, and resourceTags columns are generated only if you have applicable usage during the reporting period. If you ingest the report into another tool, be sure that your ingestion logic can tolerate missing columns.To migrate from a Detailed Billing Report (DBR) to a Cost and Usage Reports, see Migrating from Detailed Billing Reports to Cost and Usage Reports.
Question: How do I troubleshoot HTTP 504 errors from an API Gateway REST API with a Lambda backend?

I receive an HTTP 504 error status code when I invoke a REST API using Amazon API Gateway with an AWS Lambda backend. How do I troubleshoot this error?ResolutionWhen your REST API requests return an HTTP 504 error status code, you must run various checks.Check for IntegrationLatency spikesCheck if there's an IntegrationLatency spike in API Gateway by reviewing the integration latency duration time. To see the IntegrationLatency duration time, configure the access logging variable $context.integration.latency for HTTP API logging.For more information, see Set up Amazon CloudWatch API logging using the API Gateway console.An IntegrationLatency spike in API Gateway indicates that the request spent most of its time in Lambda. Check the Lambda function's Duration performance metric to confirm this.For more information, see Working with Lambda function metrics.Review requests with CloudWatch Logs InsightsUse Amazon CloudWatch Logs Insights to review requests that resulted in 504 errors. To review the requests, on the CloudWatch console, in the navigation pane, choose Logs, Log Insights. Select your API Gateway log group. Then, set the relative time with one of the following queries:parse @message '(*) *' as reqId, message| filter message like /Method completed with status: \d\d\d/| parse message 'Method completed with status: *' as status| filter status = 504| sort @timestamp desc| limit 20-or-fields @timestamp, @message| filter message like /Method completed with status: 504/| sort @timestamp desc| limit 20Instrument X-Ray tracesIf 504 errors keep happening continuously, determine where the Lambda function is spending its time. Instrument AWS X-Ray traces for Lambda functions based on the Lambda function runtime.For Python:from aws_xray_sdk.core import xray_recorderfrom aws_xray_sdk.core import patch_allpatch_all()For Node.js:const AWSXRay = require('aws-xray-sdk-core')const AWS = AWSXRay.captureAWS(require('aws-sdk'))Note: You need to build a new deployment package after instrumenting X-Ray traces on a Lambda function.Implement API retriesWhen a 504 error occurs and the request isn't found in Lambda, implement API retries on the client. The error might have resulted from a temporary network failure in API Gateway.Check the Lambda function configurationMake sure that your Lambda function has only API Gateway event-specific processing logic. This way, the Lambda function takes less time to run and can keep up with incoming events.REST APIs have a default maximum integration timeout of 29 seconds. Therefore, make sure that the Lambda function's running duration is under 29 seconds.If you have a use case where the application is time sensitive, see Set up asynchronous invocation of the backend Lambda function.

Related informationAPI Gateway dimensions and metricsSetting up CloudWatch logging for a REST API in API GatewayView API Gateway log events in the CloudWatch consoleTracing user requests to REST APIs using X-RayUsing Lambda with X-Ray