VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How does AWS WAF handle body inspections for HTTP requests?

How does AWS WAF handle body inspections for HTTP requests?ResolutionAWS WAF inspects the first 8 KB (8,192 bytes) of the request body. This is a hard service limit and can't be changed.For example:If the body is 5,000 bytes: All the content in the body can be inspected by AWS WAF.If the body is 8,500 bytes: Contents from bytes 1 through 8,192 bytes are inspected by AWS WAF. All content from 8,193 bytes to 8,500 bytes isn't inspected.This limit is important when configuring rules because AWS WAF can't check the body content after 8,192 bytes. Any attack XSS or SQL injection pattern won't be detected after 8,192 bytes.To protect against attacks on uninspected body portions, use one of the following:AWS Managed Rules Core rule setThe SizeRestrictions_BODY rule within the AWS Managed Rules Core rule set (CRS) checks request bodies that are over 8 KB (8,192 bytes). Request bodies over 8 KB are blocked.Custom body inspection ruleWhen you configure a custom body inspection rule, you can choose the oversize request handling action. This action takes effect when the request body is larger than 8,192 bytes.For example, you configure a custom rule with a request body that contains XSS injection attacks and your request body is 9,000 bytes. You can choose from the following oversize handling actions:Continue: AWS WAF inspects bytes 1 through 8,192 bytes of the body content for XSS attack. The remaining 8,193 through 9000 byte content isn't inspected.Match: AWS WAF marks this request as containing an XSS attack and takes the rule action (either ALLOW or BLOCK). It doesn’t matter whether the request body includes an XSS attack pattern or not.Not match: AWS WAF marks this request as not containing an XSS attack regardless of the request body content.When using the AWS Managed Core rule set, legitimate requests with a body size larger than 8,192 bytes might be blocked by the SizeRestrictions_BODY rule. You can create an allow rule to explicitly allow the request.For example, if a customer has a legitimate request from the URL “/upload”, you can configure the rules as follows:1.    In your web ACL, override the SizeRestrictions action to count from the rule group.2.    Add a label matching rule to your web ACL after the Core rule set. Use the following logic in the rule:Has a label “awswaf:managed:aws:core-rule-set:SizeRestrictions_Body”AND    NOT (URL path contains “/upload”)Action: BLOCKUsing the preceding configuration, requests with the URL " /upload" that have a body size larger than 8,192 bytes are allowed. Any requests that aren't from this URL are blocked.

Related informationOversize handling for request components
Question: How can I assign a static IP address to a Lambda function?

I want to assign a static IP address to an AWS Lambda function.

ResolutionFollow these steps to assign a static IP address to a Lambda function.Step 1: Connect a Lambda function to an Amazon Virtual Private Cloud (Amazon VPC)Configure your Lambda function to connect to an Amazon VPC. The Lambda function is assigned an elastic network interface (ENI) with a private IP address. The Lambda elastic network interface private IP address can't be assumed as the static IP address because it's changed during the elastic network interface lifecycle.For more information, see Configuring a Lambda function to access resources in a VPC.Note: It's a best practice not to place Lambda functions in an Amazon VPC unless the function must access other resources in the Amazon VPC.Step 2: Grant internet access to a Lambda function in an Amazon VPCInternet access from a private subnet requires network address translation (NAT). To give internet access to an Amazon VPC-connected Lambda function, route its outbound traffic to a NAT gateway or NAT instance in a public subnet. Make sure that the NAT gateway or NAT instance has a route to an internet gateway.For more information, see How do I give internet access to a Lambda function that's connected to an Amazon VPC?Step 3: Associate the NAT gateway or instance with an Elastic IP addressAssociate an Elastic IP address with the public NAT gateway or instance. The NAT gateway or instance replaces the source IP address of the instances with the Elastic IP address. This Elastic IP address can be assumed as the static IP address for the Lambda function.Note:It's a best practice to create multiple subnets across different Availability Zones. This practice creates redundancy and allows the Lambda service to maintain high availability for your function.You can't associate an Elastic IP address with a private NAT gateway or instance.You're limited to associating 2 Elastic IP addresses to your public NAT gateway or instance by default. For more information, see Elastic IP addresses quotas.

Related informationConnect to the internet using an internet gatewayInternet and service access for VPC-connected functions
Question: Why are my daily SMS usage reports from Amazon SNS not appearing in my Amazon S3 bucket?

I subscribed to daily SMS usage reports from Amazon Simple Notification Service (Amazon SNS). However, the reports aren't appearing in the Amazon Simple Storage Service (Amazon S3) bucket that I created to receive the reports. How do I troubleshoot the issue?ResolutionImportant: It takes 24 hours for an SMS usage report to be available in the Amazon S3 bucket that you created to receive the reports. If more than 24 hours has passed and the report still hasn't populated in your Amazon S3 bucket, then follow the troubleshooting steps in this article.Verify that your S3 bucket policy has the required permissionsReview your S3 bucket policy to confirm that it allows Amazon SNS to perform the following actions:s3:PutObjects3:GetBucketLocations3:ListBucketTo review and edit your S3 bucket policy, follow the instructions in Adding a bucket policy using the Amazon S3 console. For an example bucket policy that includes the required permissions, see Subscribing to daily usage reports.Verify that you've subscribed the correct S3 bucket to receive daily SMS usage reportsFollow the instructions in the To subscribe to daily usage reports section of Subscribing to daily usage reports. Make sure that the S3 bucket that you subscribed is the same bucket that you verified has the required permissions to receive the reports.Test the setupSend two or more SMS messages using Amazon SNS. If your S3 bucket is configured correctly, then Amazon SNS puts a CSV file with usage data in the following location after 24 hours:<my-s3-bucket>/SMSUsageReports/<region>/YYYY/MM/DD/00x.csv.gzNote: Each file can contain up to 50,000 records. If the records for a day exceed this quota, then Amazon SNS adds multiple files. For an example daily usage report, see Viewing daily SMS usage reports.
Question: How do I resolve "Invalid mapping expression specified" errors from API Gateway?

I used an AWS CloudFormation template—or OpenAPI definition—to create an Amazon API Gateway API with a proxy resource. When I try to add URL path parameters to the API, I get an "Invalid mapping expression specified" error message. How do I resolve the error?Short descriptionAPI Gateway returns an Invalid mapping expression specified error when the proxy path parameter {proxy+} doesn't have a defined a URL path parameter mapping.To resolve the error, do the following:For an AWS CloudFormation template, define the RequestParameters property of the AWS::ApiGateway::Method section.For an OpenAPI definition, define the parameters section under the x-amazon-apigateway-any-method object.

ResolutionFor CloudFormation templates1.    Update the CloudFormation template so that the RequestParameters value is set to true.Example CloudFormation template RequestParameters.....  ProxyMethod:    Type: 'AWS::ApiGateway::Method'    Properties:      .      .      RequestParameters:               method.request.path.proxy: true             Integration:        RequestParameters:          integration.request.path.proxy: 'method.request.path.proxy'               IntegrationHttpMethod: ANY        .        ....2.    Update your API by using the CloudFormation template to update the AWS CloudFormation stack.Note: For more information on how to update API Gateway resources, see Amazon API Gateway resource type reference.For OpenAPI definitions1.    Update your API definition so that the parameters under the x-amazon-apigateway-any-method section have the following values:      "x-amazon-apigateway-any-method": {                "parameters": [          {            "name": "proxy",            "in": "path",            "required": true,            "type": "string"          }        ]........}2.    Update your API by importing your updated API definition file into API Gateway.Note: For more information, see Describing parameters on the OpenAPI website.Test the setup1.    In the API Gateway console, choose the name of your API.2.    Add URL path parameters as needed for your use case. If your proxy path parameter includes a correctly defined a URL path parameter mapping, then no error appears.Related informationx-amazon-apigateway-integration.requestParameters objectSet up a proxy integration with a proxy resourceSetting up data transformations for REST APIs
Question: How do I configure a white label name server using Route 53?

I want to configure a white label name server for multiple domains using Amazon Route 53. How can I do this?ResolutionYou can use white label name servers (also known as vanity name servers or private name servers) to use the same name server for multiple domains. For example, if you owned both example.com and example.net, you could set up one name server to serve requests for both domains.For instructions on how to set up a white label name server, see Configuring white label name servers.

Related informationWorking with public hosted zones
Question: How do I update the mailing address associated with my AWS account?

My mailing address changed, and I want to update my address information in my AWS account.

ResolutionYou can change the AWS account root user mailing address associated with an AWS account only after you sign in as that user.You can update the AWS account mailing address using an AWS Identity and Access Management (IAM) user if:The IAM user activated on the AWS account has administrator access permission.The IAM user has access to the AWS Billing console.Important: If your AWS account and Amazon.com retail account share the same email address and password, then updating the mailing address for one of the accounts changes information for the other account.To update your mailing address information, do the following:Log in the AWS Billing and Cost Management console for the AWS account that you want to update.If you're already logged in to the console and don't see your account information: select your account ID at the upper-right corner of the screen, and then select Account from the dropdown list.Choose Edit next to Contact Information.Update your contact information associated with your account, including your mailing address, telephone number, and website address.Choose Update.The address in PDF invoices that are downloadable from the AWS Billing Dashboard is related to your payment method. To update the billing address, see How do I change billing information on the PDF version of the AWS invoice that I receive by email?Related informationManaging an AWS accountHow do I update my telephone number associated with my AWS account?How do I change the email address that's associated with my AWS account?
Question: How do I allow a domain user to access the SQL Server instance on an EC2 instance?

I want to access the SQL Server instance on an Amazon Elastic Compute Cloud (Amazon EC2) instance as a domain user. How can I do this?Short descriptionBy default, only the built-in local administrator account can access a SQL Server instance launched from an Amazon Web Services (AWS) Windows AMI. You can use SQL Server Management Studio (SSMS) to add domain users so that they can access and manage SQL Server.

ResolutionTo give a domain user access to the SQL Server instance, follow these steps:Connect to your instance using Remote Desktop Protocol (RDP) as a local administrator.Open SSMS. For Authentication, choose Windows Authentication to log in with the built-in local administrator.Choose Connect.In Object Explorer, expand Security.Open the context (right-click) menu for Logins, and then select New Login.For Login name, select Windows authentication. Enter DomainName\username, replacing DomainName with your domain NetBIOS name, and username with your Active Directory user name.On the Server Roles page, select the server roles that you want to grant to the Active Directory user.Select the General page, and then choose Ok.Log out from the instance, and then log in again as a domain user.Open SSMS. For Authentication, choose Windows authentication to log in with your domain user account.Choose Connect.Note: Performing these steps allows the user to access the SQL Server tables.

Related informationTutorial: Get started with Amazon EC2 Windows instancesTroubleshoot EC2 Windows instances
Question: How do I get a report that shows the usage of individual member accounts in my organization in AWS Organizations?

I want to see a breakdown of usage by individual member accounts in my organization.

ResolutionYou can filter the cost data associated with each member account in an organization using Cost Explorer. After you configure a report in Cost Explorer, you can save the data as a .csv file. For more information about setting up and using Cost Explorer, see Analyzing your costs with Cost Explorer.You can also have a daily AWS Cost and Usage report delivered to an Amazon Simple Storage Service (Amazon S3) bucket of your choice. For more information, see What are AWS Cost and Usage Reports?Note: Only someone signed in to the management account in an organization can activate and download billing reports.

Related informationViewing your billFiltering the data that you want to viewWhat is AWS Organizations?
Question: How can I access OpenSearch Dashboards from outside of a VPC using Amazon Cognito authentication?

My Amazon OpenSearch Service cluster is in a virtual private cloud (VPC). I want to access the OpenSearch Dashboards endpoint from outside this VPC.

ResolutionUse one of these methods to access OpenSearch Dashboards from outside of a VPC using Amazon Cognito authentication:Use an SSH tunnelFor more information, see How can I use an SSH tunnel to access OpenSearch Dashboards from outside of a VPC with Amazon Cognito authentication?Advantages: Provides a secure connection over the SSH protocol. All connections use the SSH port.Disadvantages: Requires client-side configuration and a proxy server.Use an NGINX proxyFor more information, see How can I use an NGINX proxy to access OpenSearch Dashboards from outside a VPC that's using Amazon Cognito authentication?Advantages: Setup is easier because only server-side configuration is required. Uses standard HTTP (port 80) and HTTPS (port 443).Disadvantages: Requires a proxy server. The security level of the connection depends on how the proxy server is configured.(Optional) If fine-grained access control (FGAC) is turned on, add an Amazon Cognito authenticated roleIf fine-grained access control (FGAC) is turned on for your OpenSearch Service cluster, you might encounter a missing role error. To resolve the missing role error, perform the following steps:1.    Sign in the Amazon OpenSearch Service console.2.    From the navigation pane, under Managed clusters, choose Domains.3.    Choose Actions, and then choose Edit security configurations.4.    Choose Set IAM ARN as your master user.6.    In the IAM ARN field, add the Amazon Cognito authenticated ARN role.7.    Choose Submit.For more information about fine-grained access control, see Tutorial: IAM master user and Amazon Cognito.Use VPNFor more information, see What is AWS Site-to-Site VPN?Advantages: Secure connection between your on-premises equipment and your VPCs. Uses standard TCP and UDP for TLS VPN.Disadvantages: Requires VPN setup and client-side configuration.Note: To allow or restrict access to resources, you must modify the VPC network configuration and the security groups associated with the OpenSearch Service domain. For more information, see Testing VPC domains.

Related informationHow do I troubleshoot Amazon Cognito authentication issues with OpenSearch Dashboards?Configuring Amazon Cognito authentication for OpenSearch DashboardsI get a "User: anonymous is not authorized" error when I try to access my OpenSearch Service cluster
Question: How can I troubleshoot and resolve high CPU utilization on my DocumentDB instances?

I am experiencing high CPU utilization on my Amazon DocumentDB (with MongoDB compatibility) instances. How can I resolve high CPU utilization?Short DescriptionCPU Utilization on your Amazon DocumentDB instances can increase for the following reasons:User-initiated heavy workloadsNon-efficient queriesOverburdening the writer or specific DB instance in the cluster, instead of balancing the load within the cluster.Use the following resources to troubleshoot CPU performance issues:To determine why a DB instance is running slowly, see How Do I Determine Why a System Suddenly Runs Slowly?To identify and terminate long running queries on a DB instance, see How Do I Find and Terminate Long Running or Blocked Queries?To check if a query is progressing, see How Do I Know When a Query Is Making Progress?To determine why a query takes a long time to run, see How Can I See a Query Plan and Optimize a Query?ResolutionSplit workload using replicaSetIf you have a DocumentDB cluster with multiple DB instances, check if the writer CPU is high and if the readers are sitting idle. This means the writer is overloaded.To resolve this, split the workload using replicaSet or use multiple connection pools to route read queries to the reader DB instances.Specify the readPreference for your connectionWhen you connect as a replica set, you can specify the readPreference for the connection. If you specify a read preference of secondaryPreferred, the client routes read queries to your replicas, and write queries to your primary DB instance. The following example shows the connection string in Python:## Create a MongoDB client, open a connection to Amazon DocumentDB as a##   replica set and specify the read preference as secondary preferredNote: Reads from a read-replica are eventually consistent.Add one or more reader instances to the clusterIf you have a DocumentDB cluster with a single DB instance (writer only), add one or multiple reader DB instances to the cluster. Then, use readPreference=secondaryPreferred to handle the load efficiently.Use Profiler to identify slow queriesIf the load is spread evenly across all replicas, use profiler to identify slow queries over time.Scale up the instance class of your DB instancesYou can also scale up the instance class of the DB instances in the DocumentDB cluster to handle the workload.Note: Scaling up the instance class increases the cost. Refer to DocumentDB pricing for more information.Related InformationPerformance and Resource UtilizationBest practices for DocumentDB
Question: How do I direct traffic to specific resources or AWS Regions based on the query's geographic location?

I have resources in multiple AWS Regions, and I want users to be routed to the resource that's geographically closest to them.

ResolutionTo route client requests to:The resource endpoint geographically closest to the source of the request.Based on the client’s location.Or, based on the client’s resolver location.You can use an Amazon Route 53 hosted zone with a geolocation routing policy:(Optional) If you haven't done so already, create a Route 53 hosted zone.In the Route 53 console, open the Hosted zones pane, select your hosted zone, and choose Go to Record Sets.Choose Create Record Set, and fill in the fields with the following:For Name, enter www.For Type, choose A-IPV4 Address.For Alias, choose Yes and select a resource endpoint.For Routing Policy, choose Geolocation. Then, for Location, choose the geographic region that you want to direct to the endpoint you selected.For Set ID, enter a unique friendly name that's meaningful to you for the record set.Repeat step 3 for any other geographic regions and endpoints you want to use.Note: To choose an endpoint for traffic to be routed to from regions other than the ones you specifically selected:Create a new record set by using these steps.Choose Default under Location.

Related informationValues specific for geolocation recordsChoosing a routing policy
Question: How can I reset my WordPress login password in my Lightsail instance?

I want to change or reset the login password of my WordPress website in an Amazon Lightsail instance.

Short descriptionYou can change your WordPress admin password through one of two methods, depending on how your Bitnami stack is installed.Note: The following resolution applies only to your WordPress admin password, and doesn't address OS or database password recovery. For information on how to change your database password, see Modify the database password on the Bitnami website.

ResolutionThe file paths that are used in the following steps depend on your Bitnami stack. Follow the resolution that's appropriate for your setup:The Bitnami stack uses native Linux system packagesThe Bitnami stack is a self-contained installationFor more information on Bitnami stack installation, see Understand upcoming changes to Bitnami Stacks on the Bitnami website.To identify your Bitnami installation type, run the following command:test ! -f "/opt/bitnami/common/bin/openssl" && echo "Approach A: Using system packages." || echo "Approach B: Self-contained installation."Run the following command in your instance to retrieve the admin login credentials of Lightsail WordPress websites:cat /home/bitnami/bitnami_credentialsThe user name for the login is always user. To reset the password of this user, follow the resolution steps that apply to your Bitnami stack.The Bitnami stack uses native Linux system packages1.    Run the following command to see the list of login users in the database. You must enter the MySQL root password. This password is located in the/home/bitnami/bitnami_application_password file:mysql -u root -p bitnami_wordpress -e "SELECT * FROM wp_users;"Note: The password isn't displayed as you enter it so that it isn't visible to other users. If you receive an Access Denied error when using the preceding command, then reset the password. For more information, see Modify the default MariaDB administrator password and Modify the MySQL administrator password on the Bitnami site.2.    Note the ID of the user that you want to reset the password for. Then, run the following command. Be sure to replace NEWPASSWORD with your desired password and ADMIN-ID with the user ID obtained in step 1:mysql -u root -p bitnami_wordpress -e "UPDATE wp_users SET user_pass=MD5('NEWPASSWORD') WHERE ID='ADMIN-ID';"Note: The preceding command asks you for the MySQL password that you obtained from the /home/bitnami/bitnami_application_password file. The password isn't displayed as you enter it so that it isn't visible to other users.The Bitnami stack is a self-contained installationThe Bitnami stack provides the bnconfig. This script resets the WordPress admin login password. Run the following command to use the script and reset the password. Be sure to replace NEWPASSWORD with your desired password:/opt/bitnami/apps/wordpress/bnconfig --userpassword "NEWPASSWORD"Note: The bnconfig script can only reset the password of the user that's named user. To reset the password of any other users, follow the steps in the previous section The Bitnami stack uses native Linux system packages.