VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I launch an EC2 instance from a custom AMI?

I want to launch an Amazon Elastic Compute Cloud (Amazon EC2) instance from a custom Amazon Machine Image (AMI).

ResolutionTo launch a new EC2 instance from an AMI, do the following:Open the EC2 console.Note: Be sure to select the AWS Region that you want to launch the instance in.From the navigation bar, choose AMIs.Find the AMI that you want to use to launch a new instance. To begin, open the menu next to the search bar, and then choose one of the following:If the AMI that you’re using is one that you created, select Owned by me.If the AMI that you’re using is a public AMI, select Public images.If the AMI that you’re using is a private image that someone else shared with you, select Private images.Note: The search bar automatically provides filtering options as well as automatically matching AMI IDs.Select the AMI, and then choose Launch.Choose an instance type, and then choose Next: Configure Instance Details. Optionally select configuration details, such as associating an IAM role with the instance.Select Next: Add Storage. You can use the default root volume type, or select a new type from the Volume Type dropdown list. Select Add New Volume if you want to add additional storage to your instance.Select Next: Add Tags. You can add custom tags to your instance to help you categorize your resources.Select Next: Configure Security Group. You can associate a security group with your instance to allow or block traffic to the instance.Select Review and Launch. Review the instance details.Select Previous to return to a previous screen to make changes. Select Launch when you are ready to launch the instance.Select an existing key pair or create a new key pair, select the acknowledge agreement box, and then choose Launch Instances.Choose View Instances to check the status of your instance.

Related informationInstances and AMIsAmazon Machine Images (AMI)
Question: How do I install the AWS SCT and database drivers for Windows to convert the database schema for my AWS DMS task?

I need to install the AWS Schema Conversion Tool and database drivers for Windows for my AWS Database Migration Service (AWS DMS) task.

Short descriptionThe AWS SCT automatically converts the source database schema and most custom code to a format that's compatible with the target database. Any data that can't be converted is marked so that you can convert the data manually during your migration.

ResolutionFirst, install the AWS SCT on your local system, and then install the required database driver.Install the AWS SCTNote: The following steps are for Windows OS to install the AWS SCT.Download the zip folder, for example, aws-schema-conversion-tool-1.0.latest.Extract the AWS Schema Conversion Tool .msi file, for example, AWS Schema Conversion Tool-build-number.msi.Open the folder.Run the AWS SCT installer file.Install the database driverNote: The following steps install the database drivers for an environment running MySQL with a Java Database Connectivity (JDBC) driver for Windows.Download the connector from your database engine's documentation. For more information, see Installing the Required Database Drivers.Select JDBC Driver for MySQL, and then choose Download.Download the platform-independent (architecture-independent) ZIP archive or TAR archive.Unzip the file, for example, mysql-connector-java-5.1.42.Create a directory, and then move the files to the new directory, for example, C:\java-5-1-42.Note or copy that file location.Set the driver location globally in the AWS SCTOpen the AWS SCT, and then from Settings, choose Global Settings.Choose Drivers.In the MySql Driver Path, choose Browse.Go to the location of your driver that you noted previously, for example, C:\java-5-1-42.Open the folder and choose the executable jar file, for example, mysql-connector-java-5.1.42-bin.Choose OK.

Related informationWhat Is the AWS Schema Conversion Tool?Installing, verifying, and updating the AWS Schema Conversion ToolUsing the AWS Schema Conversion Tool user interfaceMigration strategy for relational databases
Question: How do I create an Amazon QuickSight Enterprise edition account?

I want to create an Amazon QuickSight Enterprise edition account. How can I do that?ResolutionAmazon QuickSight offers Standard and Enterprise editions. For more information, see Different editions of Amazon QuickSight.Prerequisite: If you use AWS Directory Service for Microsoft Active Directory, create these three groups: administrators, readers, and authors. For more information, see Managing user accounts in Amazon QuickSight Enterprise edition.1.    Open the Amazon QuickSight console, and then choose Sign up for QuickSight.2.    Choose Enterprise.3.    Choose Continue.Note: To sign up as an educator, a student, or an existing AWS user, see Setting up Amazon QuickSight.4.    Choose Use Role Based Federation (SSO) or Use Active Directory.5.    (Optional) If your directory isn't listed, choose Refresh list.6.    Enter your QuickSight account name and Notification email address, and then select your QuickSight capacity region.7.    (Optional) To enable autodiscovery of data from other AWS services, choose the service that you want Amazon QuickSight to visualize. For more information, see Allowing autodiscovery of AWS resources.8.    Select your groups and users.9.    Choose Authorize.10.    Choose Finish.Note: Active Directory users aren't automatically notified when they're added to an Amazon QuickSight group.For more information about how to create an Amazon QuickSight account, see Signing Up for Amazon QuickSight.

Related informationSingle sign-on access to Amazon QuickSight using SAML 2.0Working with data sources in Amazon QuickSightSharing analyses
Question: How can I copy rules from an existing security group to a new security group?

I have a security group in my Amazon Virtual Private Cloud (Amazon VPC). That security group has rules that I want to migrate to another VPC. How can I copy rules from an existing security group to a new security group?ResolutionYou can copy rules from a security group to a new security group created within the same AWS Region.Open the Amazon Elastic Compute Cloud (Amazon EC2) console.In the navigation pane, choose Security Groups.Select the security group that you want to copy.For Actions, choose Copy to new Security Group.The Create Security Group dialog box opens, and is populated with the rules from your existing security group.Specify a Security group name and Description for your new security group.For VPC, choose the ID of the VPC.Choose Create.

Related informationControl traffic to resources using security groups
Question: How do I troubleshoot the Client.UnauthorizedOperation error while provisioning CIDR from the IPAM pool?

I want to troubleshoot the Client.UnauthorizedOperation error I get while provisioning CIDR from the Amazon VPC IP Address Manager (IPAM) pool.

Short descriptionWhen you run the AWS Command Line Interface (AWS CLI) command provision-public-ipv4-pool-cidr from your shared IPAM pool you might get the following error, even though you have administrator access:Client.UnauthorizedOperationYou are not authorized to perform this operation. Encoded authorization failure messageThis error occurs if you didn't use the AWSRAMDefaultPermissionsIpamPool permission set when sharing the pool. Most likely you used the AWSRAMPermissionIpamPoolByoipCidrImport permission set instead. Use this permission only if you've existing BYOIP CIDRs and you want to import them to IPAM.Use the permission AWSRAMDefaultPermissionsIpamPool to allow principals to view CIDRs and allocations and allocate or release CIDRs in the shared pool.Note: The pool is shared from account A to account B. Account B observes this error while provisioning CIDRs. However, you need to resolve the error in account A.For more information on permissions, see Share an IPAM pool using AWS RAM.

ResolutionFollow these steps in account A to resolve the error.List the permisssionsUse the CLI command to list the permissions set with the resource share. This returns the ARNs of the permissions.Note: If you receive errors when running the CLI command, make sure that you're using the most recent version of AWS CLI.aws ram list-resource-share-permissions --resource-share-arn <ARN of the resource share of IPAM Pool>Note: Replace <ARN of the resource share of IPAM pool> with the ARN of the shared IPAM pool.Then, run the following CLI command to view the details of the permissions:aws ram get-permission --permission-arn <ARN of the Permission>Note: Replace <ARN of the Permission> with the ARN of the permission in the resource share.Update the resource shareIf the list shows you chose permission AWSRAMPermissionIpamPoolByoipCidrImport, change the permission as follows:Navigate to the Shared by me: Resource shares page in the AWS RAM console.Select the resource share and then choose Modify.Choose Next.Under Associate a managed permission with each resource type, choose AWSRAMDefaultPermissionsIpamPool.Choose Next, Go to Review and Update.Choose Update resource share.Note: If you've updated your permission to AWSRAMDefaultPermissionsIpamPool but get the Client.UnauthorizedOperation error, contact AWS Support.
Question: Why can't I generate a kubeconfig file for my Amazon EKS cluster?

I get an AccessDeniedException error when I try to generate a kubeconfig file for an Amazon Elastic Kubernetes Service (Amazon EKS) cluster.

Short descriptionYou must have permission to use the eks:DescribeCluster API action with the cluster to generate a kubeconfig file for an Amazon EKS cluster. To get permission, attach an AWS Identity and Access Management (IAM) policy to an IAM user.

ResolutionTo attach an IAM policy to an IAM user, complete the following steps:1.    Open the IAM console.2.    In the navigation pane, choose Users or Roles.3.    Select the name of the user or role to embed a policy in.4.    On the Permissions tab, choose Add inline policy.5.    Choose the JSON tab.6.    Use a text editor to replace the code with the following IAM policy:{   "Version": "2012-10-17",   "Statement": [       {             "Effect": "Allow",            "Action": [                "eks:DescribeCluster"            ],            "Resource": "*"       }    ]}7.    Choose Review policy.8.    For Name, enter a name for the policy. For example: eks_update-kubeconfig.Note: You can choose any name for the policy.9.    Choose Create policy.An explicit deny message indicates that if multi-factor authentication (MFA) is false, then there is an IAM policy that's denying most actions:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "BlockMostAccessUnlessSignedInWithMFA",      "Effect": "Deny",      "NotAction": [        "iam:CreateVirtualMFADevice",        "iam:EnableMFADevice",        "iam:ListMFADevices",        "iam:ListUsers",        "iam:ListVirtualMFADevices",        "iam:ResyncMFADevice",        "sts:GetSessionToken"      ],      "Resource": "*",      "Condition": {        "BoolIfExists": {          "aws:MultiFactorAuthPresent": "false"        }      }    }  ]}Note: Because you use an MFA device, you must use an MFA token to authenticate access to AWS resources with the AWS Command Line Interface (AWS CLI). Follow the steps in the article How do I use an MFA token to authenticate access to my AWS resources through the AWS CLI? Then, run the sts get-session-token AWS CLI command.For example:$ aws sts get-session-token --serial-number arn-of-the-mfa-device --token-code code-from-tokenNote: Replace arn-of-the-mfa-device with the ARN of your MFA device and code-from-token with your token's code.You can use temporary credentials by exporting the values to environment variables.For example:$ export AWS_ACCESS_KEY_ID=example-access-key-as-in-previous-output$ export AWS_SECRET_ACCESS_KEY=example-secret-access-key-as-in-previous-output$ export AWS_SESSION_TOKEN=example-session-token-as-in-previous-outputRun the update-kubeconfig command and confirm that it updates the config file under ~/.kube/config:aws eks --region region-code update-kubeconfig --name cluster_nameNote: Replace region-code with your AWS Region's code and cluster name with your cluster's name.
Question: Why is my query planning time so high in Amazon Redshift?

My query planning time in Amazon Redshift is much longer than the actual execution time. Why is this happening?Short DescriptionIf there are queries with exclusive locks on a production load, the lock wait time can increase. This causes your query planning time in Amazon Redshift to be much longer than the actual execution time. Check the Workload Execution Breakdown metric to see if there is a sudden increase in query planning time. This increase in time is likely caused by a transaction that's waiting for a lock.

ResolutionTo detect a transaction that's waiting for a lock, perform the following steps:1.    Open a new session for your first lock:begin; lock table1;2.    Open a second session that runs in parallel:select * from table1 limit 1000;The query in this second session submits an AccessSharedLock request. However, the query must wait for the AccessExclusiveLock, because the first session has already claimed it. The ExclusiveLock then blocks all other operations on table1.3.    Check your Workload Execution Breakdown metrics. A sudden spike in query planning time confirms that there is a transaction waiting for a lock.4.    (Optional) If a transaction waiting for a lock exists, then release the lock by manually terminating the session:select pg_terminate_backend(PID);For more information about releasing locks, see How do I detect and release locks in Amazon Redshift?Related InformationAnalyzing Workload PerformanceQuery Planning and Execution Workflow
Question: How do I enable DKIM for Amazon SES?

I want to enable DomainKeys Identified Mail (DKIM) for the messages that I send using Amazon Simple Email Service (Amazon SES). How can I do that?Short descriptionDKIM is a method that allows receiving mail servers to validate the authenticity of the received email. Using DKIM, senders digitally sign email using a private key. The receiving mail servers then validate email by matching the digital signature with the public key that's published in the sender domain's DNS records.Important: Before you enable DKIM, you must complete the verification process for an Amazon SES identity.

ResolutionUse Amazon SES Easy DKIM, or Bring Your Own DKIM (BYODKIM) to sign your Amazon SES email with a 1024-bit DKIM key.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Set up Easy DKIMEasy DKIM allows you to configure DKIM authentication for email sent using a certain Amazon SES verified identity (domain or email address). For instructions, see Setting up Easy DKIM for a domain or Setting up Easy DKIM for an email address.After Amazon SES verifies your DNS records, the DKIM Verification Status shown in the Amazon SES console changes to verified. To troubleshoot a failed verification status, see Why is my DKIM domain failing to verify on Amazon SES?Provide your own public-private key pair (BYODKIM)You can use your own DKIM authentication token for email sent using an Amazon SES verified domain. To configure BYODKIM, first install and configure the AWS CLI. Then, using Amazon SES API v2, proceed with the steps to configure an Amazon SES verified domain with BYODKIM.After you complete the steps to set up BYODKIM, it can take up to 72 hours for the DKIM status to change to SUCCESS.If the DKIM status is FAILED, then review your public-private key pair and the TXT record. Check for the following:Look for any errors in the updated key.Confirm that there aren't any line breaks in the key.Confirm that your domain isn't listed twice.Confirm that the key is 1024 bits.Note: If you need a key that's larger than 1024 bits, then consider setting up manual DKIM signing in Amazon SES.After you correct any errors or confirm that there are no errors, retry the BYODKIM configuration process.Manually add a DKIM signatureYou can also manually add DKIM signatures to your messages, and then use Amazon SES to send the messages. For more information, see Manual DKIM signing in Amazon SES.Note: When you sign your messages, it's a best practice to use a bit length of at least 1024 bits.
Question: How do I troubleshoot InstanceLimitExceeded errors when starting or launching an EC2 instance?

I’m can't start or launch my Amazon Elastic Compute Cloud (Amazon EC2) instance. I receive the following error: "InstanceLimitExceeded: Your quota allows for 0 more running instance(s).”ResolutionThe InstanceLimitExceeded error indicates that you reached the limit on the number of running On-Demand Instances that you can launch in an AWS Region.You can request an instance limit increase on a per-Region basis. For more information, see Amazon EC2 service quotas.

Related informationOn-Demand Instance limitsHow do I request an EC2 vCPU limit increase for my On-Demand Instance?Why can't I start or launch my EC2 instance?
Question: Why is the SysMemoryUtilization so high on my Amazon OpenSearch Service cluster?

I noticed that the SysMemoryUtilization on my Amazon OpenSearch Service cluster is above 90%. Why is my system memory utilization usage so high?ResolutionSystem memory utilization that is above 90% doesn't indicate any heap usage issues or an overloaded OpenSearch Service cluster. A system memory utilization above 90% is considered normal, especially for nodes running OpenSearch Service. Therefore, you don't need to scale up the size of your cluster.Most of the memory used by OpenSearch Service is for in-memory data structures. OpenSearch Service uses off-heap buffers for efficient and fast access to files. The Java virtual machine (JVM) also requires some memory.To determine whether your cluster needs to be scaled up, use an Amazon CloudWatch alarm on these metrics:JVM memory pressureCPU utilizationFree storage spaceFor more information about setting CloudWatch alarms, see Recommended CloudWatch alarms.
Question: How can I calculate the maximum IOPS and throughput for an Amazon EBS volume?

I have an Amazon Elastic Block Store (Amazon EBS) volume, and I want to calculate the maximum available IOPS and throughput for my volume.

Short descriptionAmazon EBS has a number of different volume types, and each type has different characteristics. An EBS volume can experience a high latency if it's hitting its IOPS or throughput limit. To troubleshoot issues on an EBS volume, you must be able to calculate the maximum available IOPS and throughput limit for your EBS volume.The IOPS and throughput available for an EBS volume can vary for a number of reasons, such as volume type, volume size, provisioned IOPS, and so on. You can use a simple interactive bash script to find the maximum available IOPS and throughput for your EBS volume. Then, you can analyze the performance of your EBS volume based on these limits.

ResolutionTo run the volume_Limit_calculator script, do the following:1.    Download the script to your Linux instance, and make the script executable:# chmod +x volume_Limit_calculator.sh2.    Run the script:# ./volume_Limit_calculator.shNote: The script above doesn't calculate IOPS and throughput for io2 block express volumes.

Related informationAmazon EBS volume typesHow do I optimize the performance of my Amazon EBS volumes?
Question: How do I troubleshoot errors when I import data into my Amazon SageMaker Studio using SageMaker Data Wrangler?

I'm getting errors when I try to import data from Amazon Simple Storage Service (Amazon S3) or Amazon Athena using Amazon SageMaker Data Wrangler.

ResolutionLifecycle permission errorWhen you try to import data from Amazon Athena into Data Wrangler, you might get the following error:S3LifecyclePermissionError: You don't have permission to read expiration rules from the bucket that you specified.This error occurs because the SageMaker execution role associated with the user profile doesn't have the required permissions to access the Amazon S3 Lifecycle configurations for managing data retention and expiration.To resolve this error, add the following AWS Identity and Access Management (IAM) policy to the SageMaker execution role (Example: AmazonSageMaker-ExecutionRole-xxxxxxxxxxxxxxx):{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "LifecycleConfig",      "Effect": "Allow",      "Action": [        "s3:GetLifecycleConfiguration",        "s3:PutLifecycleConfiguration"      ],      "Resource": "*"    }  ]}For Resource, you can include only those Region-specific buckets that must be accessed. GetBucketLifecycleConfiguration returns the lifecycle configuration information set on the bucket, while PutBucketLifecycleConfiguration creates a new Lifecycle configuration for the bucket.Access denied errorYou might get the following error when you run a processing job with unencrypted output settings.com.amazonaws.services.s3.model.AmazonS3Exception: Access DeniedYou might get this error because of the following reasons:The SageMaker execution role doesn't have the required permissions to perform S3 operations.Either the S3 bucket policy or Amazon Virtual Private Cloud (Amazon VPC) endpoint policy has explicitly denied permissions for PutObject. This might be the case if you enforced only encrypted connections to the S3 bucket by providing a specific AWS Key Management Service (AWS KMS) key.To resolve this error, do the following:Check if the SageMaker execution role has minimum permissions for S3 bucket operations:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "s3:GetObject",        "s3:PutObject",        "s3:ListBucket",        "s3:CreateBucket",      ],      "Resource": [        "arn:aws:s3:::sagemaker-us-east-1-1111222233334444",        "arn:aws:s3:::sagemaker-us-east-1-1111222233334444/*"      ]    }  ]}Be sure that S3 bucket policy or VPC endpoint policy doesn't explicitly deny the required permissions for S3 operations.Consider passing the AWS KMS key to the processing job that allows to decrypt objects in the S3 bucket from where the data is imported.Consider using a different S3 bucket for importing your data that's encrypted at rest using the Amazon S3 server-side encryption.