VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How can I troubleshoot BGP connection issues over Direct Connect?

My Border Gateway Protocol (BGP) session doesn't establish a connection over the AWS Direct Connect link, or it's in an Idle state.

ResolutionIf your BGP session doesn't come up, then check the following:Check the Direct Connect link statusTo bring up the BGP session, the physical Direct Connect link must be up, and there must be connectivity between the BGP peer IPs. Connectivity between the BGP peer IPs must be on both your side and on the AWS side. If the physical connection is down, or if there's no connectivity between the BGP peers, you might need to troubleshoot the OSI or BGP configuration. To do so, see My virtual interface BGP status for Direct Connect is down in the AWS Management Console. What should I do?Check and verify the configuration on your Direct Connect routerThe following must be configured with the downloaded Direct Connect configuration file from the Direct Connect console:-The local and remote BGP peers.-Local and remote BGP Autonomous System Numbers (ASN).-The BGP MD5 password.Verify that the Direct Connect router or any other device is not blocking ingress or egress from TCP port 179 and other appropriate ephemeral ports.BGP peers can't be more than one hop away from each other because external BGP (EBGP) multi-hop is turned off on the AWS end.Note: For a public virtual interface (VIF), verify that the BGP peer IPs fall in the CIDR range that's approved by AWS. If the BGP peer IPs aren't approved, then the BGP session can't be established. For more information, see AWS Direct Connect FAQs.Debug packet capturesTo perform additional troubleshooting, collect these logs from your router for further analysis.BGP and TCP debugs.BGP logs.Packet captures for traffic between the BGP peer IPs.Check the BGP session if it changes from established to idle stateFor private Direct Connect VIFs, verify the number of routes that you're advertising over the BGP session. If you're advertising more than 100 routes over the BGP session, then the BGP session goes into an idle state. Summarize the routes so that the number of advertised routes is less than 100, or advertise a default route over the BGP session to AWS.If you have more than 100 networks in your on-premises network, then you can advertise a default route over the BGP session to AWS.You can summarize the routes so that the number of advertised routes is less than 100.

Related informationTroubleshooting AWS Direct Connect
Question: How do I troubleshoot Lambda reserved concurrency issues?

I’ve configured reserved concurrency for my AWS Lambda function but the function isn't working. How do I fix this issue?ResolutionThe following are possible causes for the failure of your Lambda function after you set up reserved concurrency fails:There isn’t sufficient concurrency left to reserve.Reserved concurrency settings are leading to throttling behavior, or a 429 status code.Follow these steps to troubleshoot issues with reserved concurrency:1.    Confirm that you've configured reserved concurrency for your Lambda function. Check the setting using the Lambda console or by calling the GetFunction API.Note: A Lambda function configured to have zero reserved concurrency is throttled because it can't process any events. Make sure that you increase the value to a number greater than zero.2.    Check if the Lambda function is set up so that the function can’t scale, resulting in a 429 status code.For more information, see How do I troubleshoot Lambda function throttling with "Rate exceeded" and 429 "TooManyRequestsException" errors?3.    Review the Amazon CloudWatch metrics for ConcurrentExecutions with the Maximum statistic for your Lambda function. Check whether the ConcurrentExecutions metric is reaching the configured Reserved Concurrency value.For more information about concurrency metrics, see Working with Lambda function metrics and review the Using concurrency metrics section.4.    Increase the reserved concurrency for your Lambda function to a concurrency value that keeps the function from being throttled. Change the setting using the Lambda console, or by calling the PutFunctionConcurrency API.5.    If you still can’t resolve the issue, open a case with AWS Support. Provide the following information in the case:The Lambda function ARN.The workflow on the Lambda function setup with all included services.Details about whether the issue is intermittent or continuous.The exact timestamp of the issue with the time zone or timestamp in UTC.Note: AWS Support representatives don’t have access to customer Amazon CloudWatch logs due to security and privacy reasons.

Related informationReserved concurrencyManaging AWS Lambda function concurrencyTypes of metricsAccessing CloudWatch logs for AWS LambdaTroubleshoot invocation issues in Lambda
Question: How do I set up a third-party SAML identity provider with an Amazon Cognito user pool?

I want to use a third-party Security Assertion Markup Language 2.0 (SAML 2.0) identity provider (IdP) with an Amazon Cognito user pool. How do I set that up?ResolutionFor set-up instructions, choose the third-party SAML 2.0 IdP that you want to configure with a user pool:Auth0Microsoft Active Directory Federation Services (AD FS)OktaOneLoginIf your preferred IdP isn't listed, follow these general instructions for configuring a SAML 2.0 IdP with a user pool:Using the AWS Management ConsoleUsing the AWS Command Line Interface (AWS CLI) or AWS APIRelated informationIntegrating third-party SAML identity providers with Amazon Cognito user poolsAdding user pool sign-in through a third partyConfiguring attribute mapping for your user poolHow to view a SAML response in your browser for troubleshooting
Question: How do I use wildcards with a Principal element and explicit deny in an Amazon S3 bucket policy?

I want to use wildcards with a Principal element and an explicit deny in an Amazon Simple Storage Service (Amazon S3) bucket policy. How can I do that?Short descriptionTo prevent certain AWS Identity and Access Management (IAM) entities from accessing your Amazon S3 buckets, designate specific permissions in a bucket policy. The bucket policy must use a NotPrincipal element and an explicit deny. For more information, see using NotPrincipal with Deny.However, because wildcards aren't supported with the NotPrincipal element, you must use Principal as the target entity in each statement block. Each statement block must also include the condition for each allow block.

ResolutionInstead of using NotPrincipal, use Principal as the target entity in each statement block, which includes the condition for each allow block.Before beginning, you must have the following resources:An S3 bucketAn IAM roleAn Amazon Elastic Compute Cloud (Amazon EC2) instance with an IAM role, or you can switch to an IAM roleThe unique ID for the IAM entity, or you can perform an IAM API call to get the unique IDIn this example, wildcards are used in aws:userid to include all names that are passed by the calling process. For example, the wildcards are used for an application, service, or instance ID when calls are made to obtain temporary credentials. For more information, see Information available in all requests. The AWS account root user is included to prevent lockout.Note: Be sure that you replace the example names with your own role IDs and bucket names.StringNotLike in the deny block:"Condition": {        "StringNotLike": {          "aws:userid": [            "AROAID2GEXAMPLEROLEID:*",            "444455556666"          ]        }      }Here is the complete policy:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "AWS": [          "arn:aws:iam::444455556666:role/s3-access-role"        ]      },      "Action": [        "s3:ListBucket"      ],      "Resource": "arn:aws:s3:::awsexamplebucket1"    },    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "AWS": [          "arn:aws:iam::444455556666:role/s3-access-role"        ]      },      "Action": [        "s3:DeleteObject",        "s3:GetObject",        "s3:PutObject"      ],      "Resource": "arn:aws:s3:::awsexamplebucket1/*"    },    {      "Sid": "",      "Effect": "Deny",      "Principal": "*",      "Action": [        "s3:ListBucket",        "s3:DeleteObject",        "s3:GetObject",        "s3:PutObject"      ],      "Resource": [        "arn:aws:s3:::awsexamplebucket1/*",        "arn:aws:s3:::awsexamplebucket1"      ],      "Condition": {        "StringNotLike": {          "aws:userid": [            "AROAID2GEXAMPLEROLEID:*",            "444455556666"          ]        }      }    }  ]}Related informationHow to restrict Amazon S3 bucket access to a specific IAM roleAWS JSON policy elements: NotPrincipal
Question: What's the difference between Amazon Cognito user pools and identity pools?

I'm starting to use Amazon Cognito, and I'm not sure whether I should use user pools or identity pools for my business applications. What's the difference?Short descriptionUser pools are for authentication (identity verification). With a user pool, your app users can sign in through the user pool or federate through a third-party identity provider (IdP).Identity pools are for authorization (access control). You can use identity pools to create unique identities for users and give them access to other AWS services.

ResolutionUser pool use casesUse a user pool when you need to:Design sign-up and sign-in webpages for your app.Access and manage user data.Track user device, location, and IP address, and adapt to sign-in requests of different risk levels.Use a custom authentication flow for your app.Identity pool use casesUse an identity pool when you need to:Give your users access to AWS resources, such as an Amazon Simple Storage Service (Amazon S3) bucket or an Amazon DynamoDB table.Generate temporary AWS credentials for unauthenticated users.For more example use cases, see Common Amazon Cognito Scenarios.

Related informationFeatures of Amazon CognitoIdentity pools concepts (federated identities)Identity pools (federated identities) authentication flow
Question: Can I apply the AWS credits that I received to the bill for a previous month?

I added AWS credits to my account. Can I use these credits to pay bills from a previous month?ResolutionAfter an AWS bill is finalized at the end of a billing cycle, the bill can’t be updated. This includes applying additional credits to your usage. Outstanding invoices on your account can be paid only with the payment method associated with your account.If a credit or promotional code isn't applying to your current billing cycle, see Why isn't my credit or promotional code applying to my AWS bill?If you have questions about specific credits on your account, contact AWS Support.

Related informationRedeem your AWS promotional credit
Question: How can I integrate Amazon S3 with my Aurora PostgreSQL-Compatible DB cluster?

I want to turn on the Amazon Simple Storage Solution (Amazon S3) integration feature in my Amazon Aurora PostgreSQL-Compatible Edition DB cluster.

Short descriptionYou can import data that is stored in an Amazon S3 bucket into a table on an Aurora PostgreSQL-Compatible DB cluster. First, install the Aurora PostgreSQL-Compatible aws_s3 extension. This extension provides the functions that you need to import data from an S3 bucket. The data can be in a comma-separate value (CSV) file, a text file (txt), or a compressed (gzip) file. Your database must be running PostgreSQL version 10.7 or higher to import from Amazon S3 into Aurora PostgreSQL-Compatible.To integrate your Aurora DB cluster with an S3 bucket:Install the aws_s3 extensionSet up access to an S3 bucketAdd the option to the Aurora clusterUse a psql query to import or export the data from the database

ResolutionInstall the aws_s3 extensionTo install the aws_s3 extension that allows you to connect to the database, run this command:postgres=> CREATE EXTENSION aws_s3 CASCADE;To verify that aws_s3 is installed, use the psql \dx meta-command. Or you can use this query from any DB client tool:select * from pg_available_extensions where installed_version is not null;Set up access to an S3 bucketTo give your Aurora PostgreSQL-Compatible cluster access to Amazon S3, create an AWS Identity and Access Management (IAM) policy. This policy provides the bucket and object permissions that allow your DB cluster to access the S3 bucket.In the IAM policy that you create, include these required actions. These actions allow the transfer of files from the S3 bucket to your DB cluster:s3:GetObjects3:ListBuckets3:PutObjects3:AbordMultipartUploadFor more information, see Setting up access to an Amazon S3 bucket.Add the option to the Aurora clusterAdd an IAM role to your cluster using either the Amazon Relational Database Service (Amazon RDS) console or the AWS Command Line Interface (AWS CLI).Using the consoleLog in to the Amazon RDS console.From the navigation pane, choose the PostgreSQL cluster that you want to modifyChose the Connectivity & security tab.From the Manage IAM roles section, under Add IAM roles to this instance, choose the role that you want to add.Under Feature, choose s3Export, and then choose Add role.Import or export data from the databaseImport data to your PostgreSQL cluster from the S3 bucket or export data to your S3 bucket from your PostgreSQL cluster.For more information, see Export and import data from Amazon S3 to Amazon Aurora PostgreSQL.After you complete these steps, import data to an Aurora PostgreSQL-Compatible cluster from Amazon S3 using aws_s3.table_import_from_s3. You can export data from Aurora PostgreSQL-Compatible cluster to Amazon S3 using the aws_s3.query_export_to_s3 function.
Question: How do I pass values between nested stacks within the same parent stack in AWS CloudFormation?

I want to pass or share a value between two nested stacks within the same parent stack in AWS CloudFormation.

Short descriptionThe resolution assumes the following:You have two nested stacks, NestedStackA and NestedStackB, that are part of the same parent stack.You want to use a value from NestedStackA in NestedStackB.Resolution1.FSPIn your AWS CloudFormation template, pass the value that you want to share as an output in your source stack ( NestedStackA). See the following JSON and YAML examples.JSON:"Outputs": {    "SharedValueOutput": {        "Value": "yourValue",        "Description": "You can refer to any resource from the template."    }}YAML:Outputs:  SharedValueOutput:    Value: yourValue             Description: You can refer to any resource from the template.2.FSPCreate a parameter in the destination stack ( NestedStackB). See the following JSON and YAML examples.JSON:"Parameters": {    "SharedValueParameter": {        "Type": "String",        "Description": "The shared value will be passed to this parameter by the parent stack."    }}YAML:Parameters:   SharedValueParameter:     Type: String    Description: The shared value will be passed to this parameter by parent stack.3.FSPPass the output value from NestedStackA as the parameter value for NestedStackB. To access this value in the parent stack, use the Fn::GetAtt function. Use the logical name of NestedStackA and the name of the output value in Outputs.NestedStackOutputName format. See the following JSON and YAML examples.JSON:{  "AWSTemplateFormatVersion": "2010-09-09",  "Resources": {    "NestedStackA": {      "Type": "AWS::CloudFormation::Stack",      "Properties": {        "TemplateURL": "<S3 URL for the template>"      }    },    "NestedStackB": {      "Type": "AWS::CloudFormation::Stack",      "Properties": {        "TemplateURL": "<S3 URL for the template>",        "Parameters": {          "SharedValueParameter": {            "Fn::GetAtt": [              "NestedStackA",              "Outputs.SharedValueOutput"            ]          }        }      }    }  }}YAML:AWSTemplateFormatVersion: 2010-09-09Resources:  NestedStackA:    Type: 'AWS::CloudFormation::Stack'    Properties:      TemplateURL: <S3 URL for the template>  NestedStackB:    Type: 'AWS::CloudFormation::Stack'    Properties:      TemplateURL: <S3 URL for the template>      Parameters:        SharedValueParameter:           Fn::GetAtt:           - NestedStackA          - Outputs.SharedValueOutput

Related informationWorking with nested stacksAWS::CloudFormation::StackAWS CloudFormation template snippets
Question: How do I troubleshoot errors related to CloudWatch streaming for an Elastic Beanstalk environment?

I want to troubleshoot errors related to Amazon CloudWatch streaming for an AWS Elastic Beanstalk environment.

Short descriptionStreaming your logs to CloudWatch can help safeguard your data. For example, if your Elastic Beanstalk environment experiences a terminated Elastic Compute Cloud (Amazon EC2) instance, then you can still recover your logs from CloudWatch. You can also use log rotation to protect against data loss.If your environment's instance logs aren't streaming to CloudWatch even after activating log streaming, then you must look into the following common issues:Your IAM instance profile role lacks the required IAM permissions.You launched your environment in an AWS Region that doesn't support CloudWatch Logs.One of your custom log files doesn't exist in the path you specified.Resolution1.    Verify that your Elastic Beanstalk environment instance profile role has the following permissions:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": [        "logs:CreateLogStream",        "logs:PutLogEvents",        "logs:DescribeLogGroups",        "logs:DescribeLogStreams"      ],      "Resource": [        "*"      ]    }  ]}2.    If you are streaming custom logs, then use a configuration file to directly install the CloudWatch Logs agent and to configure the files. Also, you must verify the format and indentation of that configuration file. For more information on streaming custom logs to CloudWatch, refer the sample configuration file.3.    Check the CloudWatch agent status and agent logs to find out the causes of log streaming issues.To check the old CloudWatch agent (awslogsd) status and logs:agent status: systemctl status awslogsd.serviceagent log location: /var/log/awslogs.logTo check the latest CloudWatch agent (amazon-cloudwatch-agent) status and logs:agent status: systemctl status amazon-cloudwatch-agent.serviceagent logs location: /opt/aws/amazon-cloudwatch-agent/logs/amazon-cloudwatch-agent.logFor more information on customizing log files in Elastic Beanstalk, see How can I customize my log files in Elastic Beanstalk?Related informationUsing Elastic Beanstalk with Amazon CloudWatch Logslogs-streamtocloudwatch-linux.config
Question: Why am I being charged for Amazon EBS when all my instances are stopped?

I've stopped all my Amazon Elastic Compute Cloud (Amazon EC2) instances, but I'm still receiving charges for Amazon Elastic Block Store (Amazon EBS) storage. How can I stop Amazon EBS charges accruing on my account for instances that I'm not using?ResolutionYou are charged for Amazon EBS storage for the amount of storage provisioned to your account, measured in "gigabyte-months." Amazon EC2 instances accrue charges only while they're running. However, EBS volumes attached to instances continue to retain information and accrue charges, even when the instance is stopped. For more information about how Amazon EBS is billed, see Amazon EBS pricing.Amazon EBS snapshots are billed at a lower rate than active EBS volumes are. You can minimize your Amazon EBS charges but retain the information stored in Amazon EBS for later use by creating a snapshot of the volume as a backup and then deleting the active volume. Later, when you need the information stored in the snapshot, you can replace the EBS volume using the snapshot for use with your infrastructure.To stop Amazon EBS-related charges, delete EBS volumes and Amazon EBS snapshots that you don't need.

Related informationI've deleted snapshots of my EBS volume, and then I deleted the volume. Why aren't my data storage costs lower?
Question: How do I move users between WorkSpaces bundles?

I want to move users between Amazon WorkSpaces bundles. How can I do this?ResolutionYou can move an existing WorkSpaces bundle to a destination bundle by using the migrate WorkSpaces functionality. User volume data is retained in the WorkSpaces migration process.Note: Migration of WorkSpaces across AWS Regions isn't supported. For more information about the limitations of WorkSpaces migration, see Migration limits.

Related informationMigrate a WorkSpaceAmazon WorkSpaces migrate
Question: How can I protect my Amazon EC2 instance with AWS WAF?

I want to protect my Amazon Elastic Compute Cloud (Amazon EC2) instance from common web exploits and bots that can compromise security or consume excessive resources.

Short descriptionAWS WAF can’t be directly associated with an Amazon EC2 instance. Instead, register your Amazon EC2 instances as a target for your Application Load Balancer (ALB) and then associate AWS WAF with the ALB. To protect your Amazon EC2 instance with AWS WAF, do the following:Create a target group and add your Amazon EC2 instance as its target.Configure a load balancer and a listener.Associate your web ACL with the ALB in AWS WAF.

ResolutionCreate a target group and add the Amazon EC2 instance as its targetOpen the Amazon EC2 console.In the navigation pane, under Load Balancing, choose Target Groups.Choose Create target group.In the Basic Configuration section, set the following parameters:For Choose a target type, select Instance to specify targets by instance ID.For Target group name, enter a name for the target group.Modify the Port and Protocol as needed.For VPC, select a virtual private cloud (VPC) where your EC2 instance is located.For Protocol version, select HTTP1 when the request protocol is HTTP/1.1, select HTTP2 when the request protocol is HTTP/2, or select gRPC when the request protocol is gRPC.Choose Next.For Register targets, select one or more instances, enter one or more ports, and then choose Include as pending below.Choose Create target group.Configure a load balancer and listenerFor instructions, see Configure a load balancer and a listener.Associate your web ACL with the ALB in AWS WAFOpen the AWS WAF console.In the navigation pane, choose Web ACLs.For Region, select the Region where you created your web ACL.Note: Select Global if your web ACL is set up for Amazon CloudFront.Select your web ACL.Choose Add AWS resources.Choose the ALB you created to associate this web ACL with.Choose Add.