VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I troubleshoot internet access issues for an AWS Lambda function that's in an Amazon VPC using AWS Systems Manager?

I granted internet access to my AWS Lambda function that's in an Amazon Virtual Private Cloud (Amazon VPC). Now, the function keeps losing internet access or timing out.

Short descriptionReview the following resources to verify that they allow outbound internet access to your Lambda function:Subnet route tablesSecurity groups rulesNetwork access control list (network ACL) rulesIf any of these resources don't grant internet access to your Lambda function, then reconfigure the resource to grant your function internet access.To manually review these resources, follow the instructions in How do I give internet access to a Lambda function that's connected to an Amazon VPC? To automate the troubleshooting process, you can use the AWSSupport-TroubleshootLambdaInternetAccess AWS Systems Manager runbook.

ResolutionNote: The following troubleshooting procedure shows how to use the AWSSupport-TroubleshootLambdaInternetAccess runbook.1.    Open the AWS Systems Manager console.2.    In the left navigation pane, under Change Management, choose Automation.3.    Choose Execute automation.4.    On the Owned by Amazon tab, in the Automation document search box, enter AWSSupport-TroubleshootLambdaInternetAccess. Then, select the search icon or press Enter on your keyboard.5.    Select the icon on the upper right of the AWSSupport-TroubleshootLambdaInternetAccess card. Make sure that you choose the icon on the upper right of the card, not the name of the automation.6.    Choose Next.7.    (Optional) In the Input parameters section, for AutomationAssumeRole, enter the Amazon Resource Name (ARN) of the role that allows Systems Manager Automation to perform actions. If an IAM role isn't specified, then Systems Manager Automation uses the permissions of the IAM user role that runs the document. For more information about creating the assume role for Systems Manager Automation, see Use IAM to configure roles for Automation.Important: Either the AutomationAssumeRole or user role must have permissions for the following actions:lambda:GetFunctionec2:DescribeRouteTablesec2:DescribeNatGatewaysec2:DescribeSecurityGroupsec2:DescribeNetworkAcls8.    For FunctionName, enter the name of the function that needs its connectivity validated.9.    For destinationIp, enter the destination IP address where you want to initiate outbound internet access.10.    For destinationPort, enter the destination port where you want to initiate outbound internet access.11.    Choose Execute.The runbook's output provides the status of each resource that might be causing the loss of internet connectivity for your Lambda function. The output also provides recommendations for how to resolve the issue as an "Analysis" message.Note: For more information on AWS System Manager automation runbooks, see Creating your own runbooks.
Question: "I created an IAM role, but the role doesn't appear in the dropdown list when I launch an instance. What do I do?"

I created a new AWS Identity and Access Management (IAM) role, but I can't find the role in the dropdown list when launching an instance.

ResolutionThe dropdown list includes instance profiles and not IAM roles, but you can add an IAM role to an instance profile. You must choose the instance profile that has the required IAM role added to it.Follow these steps to create a new IAM role linked to an instance profile. Then, choose the instance profile from the dropdown list when you launch your instance. Create a new IAM role linked to an instance profile using either the IAM console or the AWS Command Line Interface (AWS CLI).Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Using the IAM consoleThis example uses Amazon Elastic Compute Cloud (Amazon EC2) to show that selecting EC2 as your use case creates a trust relationship for Amazon EC2. Your EC2 use case also creates:An instance profile.Gives the instance profile the same name as the IAM role.Adds the IAM role to the same Instance profile.Note: If EC2 isn't selected when the IAM role is created, the instance profile and trust relationships aren't created for Amazon EC2.1.    Open the IAM console.2.    In the navigation pane, choose Roles, and then choose Create role.3.    Choose EC2 as the AWS service, select EC2 as your use case, and then choose Next: Permissions.4.    Choose the Policy name for your use case, choose Next: Tags, and then choose Next: Review.5.    Enter a Role name, and then choose Create role.Using the AWS CLI1.    Create a file namedTest-Role-Trust-Policy.json and paste the following policy in the file:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "Service": "ec2.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}2.    Create an IAM role by running the following command:$ aws iam create-role --role-name Test-Role --assume-role-policy-document file://Test-Role-Trust-Policy.json3.    Create an instance profile by running the following command:$ aws iam create-instance-profile --instance-profile-name Webserver4.    Add an IAM role to the instance profile by running the following command:$ aws iam add-role-to-instance-profile --role-name Test-Role --instance-profile-name WebserverFor an existing IAM role for EC2, you must add the EC2 service principal into its existing trust policy. For more information, seeSpecifying a principal.Note: If the IAM roles and instance profiles have different names, then make sure that you select the correct instance profile. The correct instance profile has the required IAM role added to it when launching an EC2 instance. The IAM role won't be listed in the dropdown list.

Related informationModifying a roleEditing the trust relationship for an existing roleIAM roles for Amazon EC2
Question: How do I back up an instance store volume on my Amazon EC2 instance to Amazon EBS?

I want to back up the instance store volume on my Amazon Elastic Compute Cloud (Amazon EC2) instance. How do I create an Amazon Elastic Block Store (Amazon EBS) volume to back up the instance store volume?Short descriptionKeep backups of all data stored in your AWS infrastructure so that you can roll back changes and protect your data from application failures and infrastructure events.You can back up data stored on an instance store volume in one of the following ways:Create a new EBS volume, and then copy the data on your instance store volume to the EBS volume.Back up the individual files stored on an EBS volume.

ResolutionCreate a new EBS volume and migrate your dataCreate an EBS volume. Be sure to select a size large enough to hold the data that you’re migrating.Attach the EBS volume to your instance.Make the volume available to your operating system, and then create a compatible file system on the volume. For Linux instances, see Making an Amazon EBS volume available for use on Linux. For Windows instances, see Making an Amazon EBS volume available for use on Windows.Copy the data using the disk management or migration tool that you prefer for your operating system, such as rsync for Linux or robocopy for Windows. For more information on rsync, see rsync(1) on the Linux man page. For more information on robocopy, see robocopy in the Microsoft documentation.Note: Keep both volumes available until you’re sure that the copy operation is successful and completed. You might need to perform additional configuration before the new EBS volumes are usable with your instance.Back up individual files stored on an EBS volumeYou can back up individual files instead of, or in addition to, backing up the volume itself. For an example solution using Amazon Simple Storage Service (Amazon S3), see Getting the most out of the Amazon S3 CLI.

Related informationCreating an instance store-backed Linux AMI
Question: How can I resolve errors when deleting custom domain names with API Gateway?

I tried to delete a custom domain name for Amazon API Gateway. However, I received an error when calling the DeleteDomainName API action.

ResolutionFollow these instructions for the error message received with your scenario.An error occurred (AccessDeniedException) when calling the DeleteDomainName APIAWS Identity and Access Management (IAM) identity-based policies determine if the API Gateway resources can be deleted.Check to confirm that the API caller has the necessary permission to delete a custom domain. The IAM policy attached to the client trying to delete the custom domain should have permissions similar to the following:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "apigateway:Delete"        ],      "Resource": "arn:aws:apigateway:*::/*"    }  ]}For more information, see Policy best practices.An error occurred (TooManyRequestsException) when calling the DeleteDomainName APIThe API Gateway quota for the DeleteDomainName API request is 1 request every 30 seconds per account. This limit can't be increased. If you tried to delete a custom domain using the AWS CLI or SDK with a built-in retry mechanism, the request might fail. This is because the quota has been reached of 1 request every 30 seconds.To resolve this, use exponential backoff and jitter in the error retry so that there are progressively longer delays between retry attempts.

Related informationExponential backoff and jitter
Question: How can I resolve timestamp exceptions when I query a table in Amazon Athena?

When I query a column of TIMESTAMP data in my Amazon Athena table, I get an exception.

Short descriptionWhen you query an Athena table with TIMESTAMP data, your query might fail with either of the following exceptions:SYNTAX_ERROR: line '>' cannot be applied to timestamp, varchar(19): You might get this exception if you used a logical operator, such as '>', between TIMESTAMP and STRING values in your query.cast(col as timestamp) with INVALID_CAST_ARGUMENT: You might get this exception if you use casting on a column with the data type that's not supported by Athena.

ResolutionException: SYNTAX_ERROR: line '>' cannot be applied to timestamp, varchar(19)The TIMESTAMP data in your table might be in the wrong format. Athena requires the Java TIMESTAMP format. Use Presto's date and time function or casting to convert the STRING to TIMESTAMP in the query filter condition. For more information, see Date and time functions and operators in the Presto documentation.1.    Create a table testdataset1 by running a query similar to the following:CREATE TABLE testdataset1 AS SELECT testid1, testname1, date_parse(testtimestamp1,'%m/%d/%Y %h:%i:%s %p') AS testtimestamp1 FROM (    VALUES        (1, 'a','7/14/2020 8:22:39 AM'),        (2, 'b','8/01/2015 10:22:39 PM'),        (3, 'c','8/13/2017 4:22:39 AM')) AS t(testid1, testname1, testtimestamp1)2.    Apply the timestamp filter by using the cast function on the literal value (example: 2020-07-14 00:00:00):SELECT * FROM testdataset WHERE testtimestamp1 < cast('2020-07-14 00:00:00' as timestamp)Exception: cast(col as timestamp) with INVALID_CAST_ARGUMENTUse Presto's date and time functions to read the column as DATE or TIMESTAMP in your query.1.    Create a table testdataset2 by running a query similar to the following:CREATE TABLE testdataset2 AS SELECT * FROM (VALUES        (1, 'a','7/14/2020 8:22:39 AM'),        (2, 'b','8/01/2015 10:22:39 PM'),        (3, 'c','8/13/2017 4:22:39 AM')) AS t(testid2, testname2, testtimestamp2)2.    Convert the STRING TIMESTAMP column testtimestamp2 to JAVA TIMESTAMP format using Presto's date_parse function:SELECT testid2,testname2,date_parse(testtimestamp2,'%m/%d/%Y %h:%i:%s %p') AS testtimestamp2 FROM testdataset2Related informationWhy is the TIMESTAMP result empty when I query a table in Amazon Athena?
Question: How can I troubleshoot when I'm unable to mount my Storage Gateway NFS file share on my NFS client?

I want to troubleshoot the errors that I get when I mount my AWS Storage Gateway Network File System (NFS) file share on my NFS client.Resolution1.    Confirm that your NFS client is among the supported NFS clients for a file gateway.2.    Use the Storage Gateway console to check if your file share is in the unavailable state. If the file share is in the unavailable state, then check whether the file gateway can reach the Amazon Simple Storage Service (Amazon S3) endpoint. To do this, access the Storage console using the SSH client with the following command:ssh -i "keyfile.pem" admin@ec2-54-203-49-11.region.compute.amazonaws.comSelect the command prompt option, and then enter the following command:ncport -d s3.region. amazonaws.com -p 443You receive a connected response if the Storage Gateway has connectivity to S3 endpoints.Note: It's a best practice to make sure that your IAM role has permission to access the S3 bucket.3.    Confirm that the NFS client is installed on your client. On a Windows Server client, navigate to the Server Manager. Choose Add roles and features, and then choose Next until you reach the Featurespage. Select Client for NFS, choose Next, and then choose Install.On a Linux client, you can run the following command:yum -y install nfs-utilsTo check that the NFS service is running, run this command:service nfs statusIf the NFS service isn't running, then run this command to start the service:service nfs start4.    Review your network configuration to confirm that the required ports are open between the client and the Storage Gateway host or appliance. NFS version 3 clients require ports 111 and 20048. NFS version 4 clients require port 2049. To check if the required ports are open, run the telnet command from your client to the Storage Gateway host:Important: Replace 192.0.2.0 with the IP address of your file gateway.telnet 192.0.2.0 2049telnet 192.0.2.0 20048telnet 192.0.2.0 1115.    Confirm that your client is in the list of allowed clients on your NFS file share. By default, 0.0.0.0/0 is listed as an allowed client on an NFS file share, so that any client can mount the file share. However, there might be custom restrictions on the allowed clients.

Related informationTroubleshooting: file share issues
Question: How can I troubleshoot common errors when activating Performance Insights on my Amazon Aurora DB instance?

I have an Amazon Aurora DB instance, and I would like to use Performance Insights for my instance. How can I troubleshoot common errors I receive when I activate this feature?Short descriptionBefore you activate Performance Insights for Amazon Aurora, make sure that you are running a supported Aurora version and DB instance class. To use this feature, you must be running the following Amazon Aurora MySQL-Compatible Edition versions:2.04.2 and higher 2.x versions (compatible with MySQL 5.7)1.17.3 and higher 1.x versions (compatible with MySQL 5.6)Performance Insights are compatible with all versions of Amazon Aurora PostgreSQL-Compatible Edition.Note: For Aurora DB clusters that allow for parallel queries, the minimum Amazon Aurora MySQL-Compatible Edition versions are 2.09.0 and 1.23.0. For more information, see Amazon Aurora DB engine support Performance Insights.To use Performance Insights, activate it on your DB instance. Then, follow the troubleshooting steps in this article to resolve common errors that occur when using this feature.

ResolutionI can't see Performance Schema detailed wait events in my Performance Insights dashboardIf you have manually turned on the performance_schema parameter on your parameter group, reset the parameter. Then, modify your instance to turn Performance Insights on and then off.Performance Insights automatically manages the parameters in the following table. You can't configure this table using a custom parameter group. Turning on Performance Insights with performance_schema=1 on the cluster can lead to missing data points.performance_schema: 1 (the source parameter is set to engine-default)performance-schema-consumer-events-waits-current : ONperformance-schema-instrument: wait/% = ONperformance_schema_consumer_global_instrumentation : ONperformance_schema_consumer_thread_instrumentation = ONI can't see my entire query in my Performance Insights dashboardYou might not be able to see query in full on the Performance Insights dashboard for Amazon Aurora. This might be because the feature currently has a limitation of 500 characters for Aurora PostgreSQL-Compatible, and 1024 characters for Aurora MySQL-Compatible. For more information, see Text size limits for Amazon Relational Database Service (Amazon RDS) engines.Note: Turning Performance Insights on or off doesn't cause any downtime, reboot, or failover.

Related informationAmazon Aurora DB engine support for Performance InsightsEnabling and disabling Performance Insights
Question: How can I redirect one domain to another in Route 53?

I want to redirect my client from one domain to another domain in Amazon Route 53.

Short descriptionAmazon Route 53 works with other services, such as Amazon Simple Storage Service (Amazon S3), Amazon CloudFront, or Application Load Balancer, for domain redirection. Be sure to consider the pricing for solutions that use multiple services.Note: There are differences between mapping and redirecting one domain to another domain. Amazon Route 53 can map a domain name to another domain name using a CNAME record or Route 53 alias record.Domain mapping: When you map a domain using a CNAME record, the domain name stays the same when you enter the URL in a browser. For example, if you use a CNAME record to map "www.example.com" to "www.example.net", then the URL remains http://www.example.com.Domain redirection: Domains redirected to another domain change to the redirected URL. For example, if you redirect domain "www.example.com" to "www.example.net", then the URL changes to the redirected URL ("www.example.net") when you enter the original domain in a browser.

ResolutionDomain redirection using Amazon S3 and Amazon CloudFrontFor more information, see How do I redirect an apex domain to its subdomain or any other domain using S3 and Route 53?Note: Amazon S3 static web hosting supports only the HTTP protocol. You must use a CloudFront distribution for redirection from HTTP to HTTPS. For more information, see How do I use CloudFront to serve HTTPS requests for my Amazon S3 bucket?Domain redirection using Application Load BalancerApplication Load Balancer supports redirection of domain names and redirection from HTTP to HTTPS. For more information, see How can I redirect one domain to another domain using an Application Load Balancer?Note: It's a best practice to configure redirection using the Application Load Balancer instead of Amazon S3 for domains that point to an Application Load Balancer.Domain redirection using an Amazon CloudFront FunctionFor more information, see Use an edge function that redirects requests to the new domain section of How do I redirect a domain in CloudFront?
Question: Why do I get an "HTTP 504 Gateway Timeout" error from an outbound VPC connection to AWS services in Amazon Managed Grafana?

I want to add an AWS service as a data source in my Amazon Managed Grafana workspace. However, I receive an "HTTP 504 Gateway Timeout" error from a virtual private cloud (VPC) outbound connection.

Short descriptionWhen Amazon Managed Grafana doesn't get a response from the upstream server in time to complete your request, you receive an HTTP 504 Gateway Timeout error. This commonly occurs when a workspace has an outbound VPC connection that uses public subnets. Because public subnets have a direct route to an internet gateway, this allows internet access to resources with a public IPv4 or IPv6 address. However, Amazon Managed Grafana gives private IPv4 addresses to its elastic network interfaces.To resolve this error, use either of the following methods:Method 1: Configure an Amazon Managed Grafana outbound VPC connection to a private subnet.Method 2: Create a VPC endpoint for the corresponding service in the workspace's VPC.

ResolutionMethod 1: Configure an Amazon Managed Grafana outbound VPC connection to a private subnetCreate subnets in at least two different Availability Zones in your AWS Region. The subnets must support IPv4.Create a public NAT gateway. From the list of subnets, choose an existing public subnet.Create a custom route table.Associate the private subnets that you created in step 1 with the newly created route table.Add a route to the route table with a destination of 0.0.0.0/0 and target of nat-gateway-id.(Optional) Create a security group. Make sure that it allows connectivity to the data source through inbound and outbound rules. For example, if you want to connect to Amazon CloudWatch, then create an outbound HTTPS rule with a destination of 0.0.0.0/0.Open the Amazon Managed Grafana console.In the navigation pane, choose All workspaces.Select the name of the workspace that you want to add a VPC outbound connection to.In the Network access control tab, next to Outbound VPC connection, choose Edit to create your VPC connection.Choose the VPC that you want to connect to.Under Mappings, select the subnets that you created in step 1 in their relevant Availability Zones.Under Security Groups, select at least one security group for this connection.Choose Save changes.Method 2: Create a VPC endpoint for the corresponding service in the workspace's VPCCreate an interface VPC endpoint that connects to the AWS service.For VPC, select the VPC that's associated with the outbound connection for Amazon Managed Grafana.For Subnets, select the subnets that are associated with the outbound connection for Amazon Managed Grafana.To configure an outbound VPC connection for your workspace, complete steps 7-14 in Method 1.

Related informationHow VPC connectivity worksWhy do I get a 502 Bad Gateway Error when I am trying to connect to a data source after I configured the VPC in my Amazon Managed Grafana workspace?
Question: How can I delete my VPC that is shared with another AWS account?

Why can't I delete my Amazon Virtual Private Cloud (Amazon VPC) that's shared with another AWS account?Short descriptionWhen deleting a VPC that's shared with another AWS account, it's a best practice to review any dependencies and active components within the shared resources before deleting the VPC. The most common errors that occur when deleting shared VPCs are:"Unable to delete, the VPC contains one or more in-use network interfaces.""Network interface associated - Delete the network interface, or associate with a different security group."ResolutionTo verify shared subnets and active resources, do the following:Open the AWS Resource Access Manager (AWS RAM) console on the participant account.Under Shared with me, select Resource shares.Verify that the Resource shares ID matches the shared resources in the parent VPC.Review the resource type and verify that the resource is in the Available state.After identifying the resources, select Leave resource share. This un-shares the resources from the parent VPC.Delete the shared VPC.Un-sharing subnets doesn't have a direct impact on the active resources. However, you must terminate all active resources within the shared or un-shared VPC to delete the parent VPC. To verify active resources, do the following:Open the Amazon Elastic Compute Cloud (Amazon EC2) console.Under Network and Security, choose Network interfaces.Review the list of active elastic network interfaces and then delete the active resources associated with them.Delete the VPC.Note: It might take 30 to 60 seconds for the elastic network interface to be removed from the account after you terminate the resources.

Related informationVPC sharing: A new approach to multiple accounts and VPC managementI tried to delete my Amazon VPC, and I received a dependency error. How can I delete my Amazon VPC?