VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How can I allow all accounts in an AWS Organization to use an AWS KMS key in my account?

I want to restrict AWS Key Management Service (AWS KMS) key access to only the principals belonging to my AWS Organization.

Short descriptionThe aws:PrincipalOrgID global condition key can be used with the Principal element in a resource-based policy with AWS KMS. Instead of listing all the AWS account IDs in an Organization, you can specify the Organization ID in the Condition element.

ResolutionCreate an AWS KMS key policy to allow all accounts in an AWS Organization to perform AWS KMS actions using the AWS global condition context key aws:PrincipalOrgID.Important: It is a best practice to grant least privilege permissions with AWS Identity and Access Management (IAM) policies.Specify your AWS Organization ID in the condition element of the statement to make sure that only the principals from the accounts in your Organization can access the AWS KMS key. To get the Organization ID, follow these steps:Open the AWS Organizations console.Choose Settings.In Organization details, copy the Organization ID.The following AWS KMS key policy statement allows identities of any AWS account belonging to the AWS Organization with ID o-xxxxxxxxxxx to use the KMS key:{  "Sid": "Allow use of the KMS key for organization",  "Effect": "Allow",  "Principal": {    "AWS": "*"  },  "Action": [    "kms:Decrypt",    "kms:DescribeKey",    "kms:Encrypt",    "kms:ReEncrypt*",    "kms:GetKeyPolicy"  ],  "Resource": "*",  "Condition": {    "StringEquals": {      "aws:PrincipalOrgID": "o-xxxxxxxxxxx"    }  }}Note: The aws:PrincipalOrgID global condition context key can't be used to restrict access to an AWS service principal. AWS services that invoke an API call are made from an internal AWS account that is not part of the AWS Organization.

Related informationHow do I get started with AWS Organizations?How do I remove a member account from an organization's consolidated bill in AWS Organizations?
Question: Why is my Amazon EC2 instance using IAM user credentials instead of role credentials?

I attached an AWS Identity and Access Management (IAM) role to an Amazon Elastic Compute Cloud (Amazon EC2) instance. However, the Amazon EC2 instance makes API calls with an IAM user instead of an IAM role.

Short descriptionThe AWS Command Line Interface (AWS CLI) uses a set of credential providers to look for AWS credentials in a sequence. The credentials used depends on the order and precedence of the credential providers. For more information, see Configuration settings and precedence.

ResolutionFollow the instructions to find the IAM user ID and location of where the IAM user credentials are stored. Then, use the AWS CLI to manage IAM credentials and discard the higher precedence setting.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Find the IAM user ID and get the IAM user credential location1.    Run the following get-caller-identity command to verify which IAM credentials are used to make API calls:aws sts get-caller-identityYou receive an output similar to the following:{    "Account": "123456789012",     "UserId": "AIDACKCEVSQ6C2EXAMPLE",     "Arn": "arn:aws:iam::123456789012:user/ExampleIAMuser"}In this example output, the IAM credentials used are of the ExampleIAMuser.2.    Use the --debug option to check the location of the user credentials similar to the following:aws s3 ls --debug2020-03-28 02:04:29,478 - MainThread - botocore.credentials - INFO - Found credentials in shared credentials file: ~/.aws/credentialsIn this example output, the IAM user credentials are stored in the .aws/credentials file. Because these credentials have a higher precedence than role credentials, IAM user credentials are used to make API calls.Use the AWS CLI to manage IAM credentials and discard the higher precedence settingUse the following best practices:Be sure that you don't use the --profile option with the AWS CLI.Unset or remove all environment variables.For the configure command, delete the credentials file in the .aws/credentials folder. Then, delete the .aws  folder to set the instance profile default credentials.For profiles set up in the .aws/config file, delete the profile. Then, delete the .aws folder.After you remove the configuration settings precedence the IAM credentials, run the get-caller-identity command to verify the IAM role credentials similar to the following:aws sts get-caller-identity{    "UserId": "AROACKCEVSQ6C2EXAMPLE:i-01773d4a8ed647342",    "Account": "123456789012",    "Arn": "arn:aws:sts::123456789012:assumed-role/ExampleInstanceRole/i-01773d4a8ed647342"}In this example output, the IAM credentials used are of the IAM role ExampleInstanceRole.
Question: Why is my Storage Gateway gateway showing as offline?

The AWS Storage Gateway console is showing that my gateway is offline. Why is my gateway offline? How can I bring my gateway back online?ResolutionYour gateway might be showing as offline for one or more of the following reasons:The gateway can't reach the Storage Gateway service endpoints.The gateway had an unexpected shutdown.The gateway has an associated cache disk that is disconnected, has been modified, or has failed.To bring your gateway back online, identify and resolve the issue that caused your gateway to go offline:Check the associated firewall or proxyIf you configured your gateway to use a proxy, or you placed your gateway behind a firewall, then review the access rules of the proxy or firewall. The proxy or firewall must allow traffic to and from the network ports and service endpoints required by Storage Gateway.Check for an SSL or deep-packet inspection being done on your gateway's trafficIf there's an ongoing SSL or deep-packet inspection on the network traffic between your gateway and AWS, then your gateway might not be able to communicate with the required service endpoints. To bring your gateway back online, you must disable the inspection.For a file gateway, check the IOWaitPercent metric after a reboot or software updateAfter a reboot or software update, check to see if your file gateway's IOWaitPercent metric is at 10 or greater. This might mean that your file gateway is slow to respond as it rebuilds the index cache to RAM.Check for a power outage or hardware failure on the hypervisor hostA power outage or hardware failure on the hypervisor host of your gateway can cause your gateway to shut down unexpectedly and become unreachable. After you restore the power and network connectivity, your gateway will become reachable again.After your gateway is back online, be sure to take steps to recover your data.Check for issues with an associated cache diskYour gateway can go offline if at least one of the cache disks associated with your gateway was removed, changed, or resized, or if it is corrupted.If a working cache disk was removed from the hypervisor host, then you can:Shut down the gateway.Re-add the disk.Restart the gateway.Note: Be sure to add the disk to the same disk node.If a cache disk is corrupted, was replaced, or was resized, then you must:Shut down the gateway.Reset the cache disk.Reconfigure the disk for cache storage.Restart the gateway.For more information on troubleshooting a corrupted cache disk for a tape gateway, see You need to recover a virtual tape from a malfunctioning cache disk.

Related informationBest practices for recovering your data
Question: The administrator of an AWS account has left the company. How do I access this AWS account?

I need access to the AWS root user account, but I don’t have the credentials to sign in to the account because of one of the following reasons:The AWS account root user is no longer the account administrator, and they aren't reachable.I'm unable to reset the password due to an invalid email address.

ResolutionTo access an account as a root user, you must have the email address and password associated with the account.To access the account as an AWS Identity and Access Management (IAM) user, you must have the user name and password for that IAM user.If your multi-factor authentication (MFA) device is lost or broken, see How do I remove a lost or broken MFA device from my AWS account?The simplest way to get the credentials for the account is to ask the former administrator of the account.If that's not possible, try the following:If the email address is associated with a corporate domain, it's a best practice that you contact your email administrator. Ask your email administrator if they can give you access to the email address, or pass along a password reset email for the account.Note: The password reset email is sent from account-update@amazon.com if the account was created before August 28, 2017, or from password-reset-noreply@aws.amazon.com if the account was created after August 28, 2017.If you have root access to the account but don't know the password for a particular IAM user, sign in as the root user. Then, change the password.Important: AWS Support can't change the root user or IAM credentials on an account for any reason.

Related informationI can't sign in because my credentials don't workHow do I recover a lost or forgotten AWS password?How do I change the email address associated with my AWS account?How do I transfer my AWS account to another person or business?
Question: What happens when my Amazon EC2 Reserved Instance expires?

What happens to my instances when an Amazon Elastic Compute Cloud (Amazon EC2) Reserved Instance (RI) expires?ResolutionInstances are never shut down or terminated because an Amazon EC2 Reserved Instance (RI) expires.However, when an RI expires, you might notice a change in the pricing of one or more of your instances. This is because any instances that were covered by the RI pricing benefit are now billed at the on-demand price.You can set reservation expiration alerts to remind you when your RIs are about to expire. These alerts don't automatically renew or purchase RIs for you. To renew your Amazon EC2 RI automatically, you can queue an RI purchase for the date and time that your existing RI expires. For more information, see Can I schedule my EC2 Reserved Instance to renew automatically?If you want to continue receiving the pricing benefit, you must purchase an identical RI.Open the Amazon EC2 console.Choose Reserved Instances from the navigation bar.Select the expired RI from the list. Note: If you don't see the RI, check that your console is set to the correct AWS Region.Open Actions and then select Purchase More Like These.Select your preferred RI, and then choose Add to cart.Choose View cart.Confirm that you've added the correct RI to your cart, and then choose Purchase.

Related informationWhy is my Reserved Instance showing as "Retired" in the console?
Question: How do I get started with AWS Organizations?

I want to use AWS Organizations to administer and pay bills for other AWS accounts.

ResolutionFirst, activate AWS Organizations for your account. Then, add other AWS accounts to your organization.Activate AWS Organizations for your accountOpen the AWS Organizations console.Choose Create organization.In Create organization page, Choose Create organization.When you create an organization, you can choose whether the organization supports all features (recommended) or only consolidated billing features. When you create an organization, all features are enabled by default. If you create an organization with consolidated billing features only, you can enable all features later.Add accounts to your organizationYou can create a new member account or invite an existing AWS account to be a member account in your organization.Apply service control policies (SCPs)Apply service control policies to any account in your organization to manage the level of access and permissions for each account.

Related informationWhat is AWS Organizations?
Question: How do I send email from my multifunction device with WorkMail?

I want to set up my multifunction device to send email through Amazon WorkMail. How can I do that?Short descriptionWorkMail supports Simple Mail Transfer Protocol (SMTP) for sending email. You can configure your multifunction device to send outbound email using the SMTP endpoint of the AWS Region where your WorkMail organization is located.To set up a multifunction device, you need the following:A WorkMail user email address and password.The fully qualified domain name (FQDN) of the WorkMail SMTP endpoint.Transport Layer Security (TLS) encryption for the WorkMail SMTP endpoint connections.Note: TLS might be referred to as SSL, its predecessor protocol. WorkMail supports only TLS-encrypted connections on port 465, and not STARTTLS. Check your device documentation to determine whether it supports STARTTLS, TLS/SSL, or both.Supported attachments.  Note: See Unsupported attachment types.You don't need an additional budget because there's no additional cost to use an SMTP gateway to send email.

ResolutionCreate or enable a WorkMail user, get the SMTP endpoint for your Region, and then configure your multifunction device.Open the WorkMail console, and then follow the instructions for Creating users.(Optional) Follow the instructions for Enabling existing users.Choose the SMTP TLS (port 465) endpoint for the Region where you have Amazon WorkMail installed.For example, https://smtp.us-west-2.amazonaws.com is the endpoint for the Amazon WorkMail SMTP server in the US West (Oregon) Region.Configure your multifunction device to connect to the Amazon Simple Email Service (Amazon SES) SMTP endpoint.Note: Device configurations vary across different manufacturers and models. Refer to your device documentation for instructions.For more information about configuring an outgoing SMTP server in your device or client software, see Setting Up IMAP for Amazon WorkMail.

Related informationAmazon WorkMail FAQs
Question: How do I monitor the performance of my website using CloudWatch Synthetics?

I want to monitor the performance of my website and check the customer experience. How can I use Amazon CloudWatch Synthetics to monitor my website?Short descriptionYou can use CloudWatch Synthetics to create a canary for your website. Canaries are configurable scripts that run on a schedule to monitor your endpoints and APIs. You can configure canaries to perform the same actions that your customers do on your website. This means that you can monitor your customer experience, and proactively find issues before your customer does.Canaries have several uses. You can check the availability and latency of your endpoints, load time data, and you can take screenshots of your user interface. You can also use canaries to publish metrics for failures and for 2XX, 4XX and 5XX errors, and to enable continuous monitoring.Some common uses for Synthetics canaries include:Monitor for page load errorsProvide load latency for application UICheck out flows in your webpagesCheck for broken or dead links

ResolutionMonitor the health of your application of website using SyntheticsUse these steps to create a canary using the CloudWatch Synthetics console:Open the Amazon CloudWatch console.In the navigation pane, choose Synthetic Canaries.Choose Create Canary, and then choose Use Blueprint. Blueprints allow you to create canaries for common tasks, such as loading a webpage.To monitor the availability of your website, choose Heartbeat Monitoring Blueprint. This blueprint periodically loads a single URL to check the availability and latency of your website. It also captures a screenshot of the UI.Enter a name for your canary.Enter the application endpoint URL. This can be an HTTPS or HTTP endpoint. Be sure that you own or have permission to monitor the website, because that website might experience increased traffic.Choose the Run frequency and Retention settings based on your use case.Choose the default Amazon Simple Storage Service (Amazon S3) bucket and AWS Identity and Access Management (IAM) role for your canary. Or, choose the specific S3 bucket and IAM role that you want to use. For more information, see Required roles and permissions for users who manage CloudWatch canaries.Choose CloudWatch alarm, and set notifications for your canary. You can choose to be notified if there are any availability issues in your endpoint. You can also configure the canary to monitor resources inside a Virtual Private Cloud (VPC) by launching it in a VPC. For more information, see Running a canary in a VPC.After you have configured the canary settings, choose Create canary. This also creates the IAM roles, S3 buckets, CloudWatch alarms, the canary's AWS Lambda function, and CloudWatch log groups.After your canary is created, navigate to the Canary detail page to view the canary run results, logs, screenshots, and the HAR generated for the run.

Related informationCanary blueprintsRequired roles and permissions for canariesRunning a canary in a VPC
Question: How do I stream log data from CloudWatch Logs to a cross-Region and cross-account Kinesis data stream?

I need to send log data from Amazon CloudWatch Logs to another AWS account’s Amazon Kinesis data stream in a different AWS Region. How can I do this?ResolutionIf you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Important: To deliver CloudWatch log events to Kinesis data streams in different AWS accounts and Regions, set up cross-account log data sharing with subscriptions while specifying the AWS Region as follows.In this example, CloudWatch Logs in the us-east-1 Region are delivered to another AWS user's Kinesis data stream in us-west-2.1.    Create a destination data stream in Kinesis in the data recipient account with an AWS Identity and Access Management (IAM) role and trust policy.Specify the --region when you use the create-stream command to create the data stream. For example, this command creates the data stream YourStreamName in us-west-2:>aws kinesis create-stream --stream-name "YourStreamName" --shard-count 1 --region us-west-2Specify the --region when you use the describe-stream command to check the StreamDescription.StreamStatus property. For example, this command checks the stream YourStreamName in us-west-2:>aws kinesis describe-stream --stream-name "YourStreamName" --region us-west-2When you use the put-destination command to create the CloudWatch Logs destination, set the --region for the --role-arn to the same AWS Region as the source CloudWatch logs. For example, this command creates the log destination in the recipient account (222222222222) in us-east-1:>aws logs put-destination \    --destination-name "testDestination" \    --target-arn "arn:aws:kinesis:us-west-2:222222222222:stream/YourStreamName" \      --role-arn "arn:aws:iam::222222222222:role/YourIAMRoleName" --region us-east-12.    Create a subscription filter in your account.3.    (Optional) Check that your data stream is working by validating the flow of log events.

Related informationRoles terms and concepts (IAM)
Question: How do I prevent the resources in my CloudFormation stack from getting deleted or updated?

I want to prevent the resources in my AWS CloudFormation stack from getting deleted or updated. How do I do this?ResolutionTo prevent deletion or updates to resources in a CloudFormation stack, you can:Set the DeletionPolicy attribute to prevent the deletion of an individual resource at the stack level.Use AWS Identity and Access Management (IAM) policies to restrict the ability of users to delete or update a stack and its resources.Assign a stack policy to prevent updates to stack resources.Turn on termination protection to prevent users from deleting the stack from the AWS CloudFormation console or AWS Command Line Interface (AWS CLI).

Related informationUpdate behaviors of stack resourcesModifying a stack templateTroubleshooting CloudFormation
Question: What is Amazon Web Services India Private Limited (AWS India)?

I’m interested in the services offered by AWS India.

ResolutionAmazon Web Services India Private Limited (AWS India) is a local legal Indian entity that acts as a seller for AWS services in India. Customers who provide an Indian address during the account creation process are automatically redirected to create an AWS India account instead.AWS India customers receive benefits of interest to customers in India. This includes the following:The ability to pay in Indian Rupees (INR)Elimination of most foreign transactions and fees charged by banks and credit cardsIf applicable, reduced tax withholding rates

Related informationManaging an account in India
Question: How can I upgrade my EC2 Windows Server instance OS to a newer version?

I want to upgrade my Amazon Elastic Compute Cloud (Amazon EC2) Windows Server instance to a newer Windows version. How can I do that?ResolutionFor Windows Server 2012 R2 or later, you can choose between a server migration or an in-place upgrade.For Windows Server 2008 R2, you can choose between a server migration or an automated upgrade.To minimize downtime, plan your upgrade before you start. It's a best practice to maintain backups of your instances and data. Before you upgrade, consider  creating an AMI or  creating snapshots of your Amazon EBS volumes.Server migration for EC2 Windows Server 2008 R2 or laterWith a migration, you copy the data and configuration to a new server that's already running the desired version of Windows. This process can result in fewer upgrade errors or issues, but can take longer than an in-place upgrade.For instructions, see Migrating roles and features in Windows Server on the Microsoft website.In-place upgrade for EC2 Windows Server 2012 R2 or laterAn in-place upgrade lets you keep your existing configuration and data. This process can be faster, but errors can occur due to software incompatibilities.First, verify that all requirements are met to confirm that you are ready to upgrade. For in-place upgrade instructions, see Perform an in-place upgrade.If you run into upgrade issues, see Troubleshooting an upgrade.Automated upgrade for EC2 Windows Server 2008 R2 and SQL Server 2008 R2You can use Systems Manager Automation documents to perform an automated upgrade. Two upgrade paths are available:Windows Server 2008 R2, 2012 R2, or 2016 to Windows Server 2012 R2, 2016, or 2019SQL Server 2008 R2 on Windows Server 2012 R2 to SQL Server 2016For prerequisites and instructions, see Performing an automated upgrade.

Related informationUpgrading an Amazon EC2 Windows instance to a newer version of Windows Server