VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: What permissions do I need to access an Amazon SQS queue?

I want to access an Amazon Simple Queue Service (Amazon SQS) queue. What SQS access policy and AWS Identity and Access Management (IAM) policy permissions are required to access the queue?ResolutionTo access an Amazon SQS queue, you must add permissions to the SQS access policy, the IAM policy, or both. The specific permissions requirements differ depending on whether the SQS queue and IAM role are from the same account.Same accountA statement to allow access is required in either the SQS access policy or the IAM policy.Note: If either the SQS access policy or IAM policy explicitly allows access, but the other policy explicitly denies access, access to the queue is denied.IAM user policySQS access policyResultAllowAllowAllowAllowNeither Allow nor DenyAllowAllowDenyDenyNeither Allow nor DenyAllowAllowNeither Allow nor DenyNeither Allow nor DenyImplicit DenyNeither Allow nor DenyDenyDenyDenyAllowDenyDenyNeither Allow nor DenyDenyDenyDenyDenyDifferent accountA statement to allow access is required in both the SQS access policy and the IAM policy.IAM user policySQS access policyResultAllowAllowAllowAllowNeither Allow nor DenyImplicit DenyAllowDenyDenyNeither Allow nor DenyAllowImplicit DenyNeither Allow nor DenyNeither Allow nor DenyImplicit DenyNeither Allow nor DenyDenyDenyDenyAllowDenyDenyNeither Allow nor DenyDenyDenyDenyDenyExample policy statementsThe following example policies show the permissions that you must set on the IAM policy and SQS queue access policy to allow cross-account access for an SQS queue.The first policy grants permissions for username1 to send messages to the resource arn:aws:sqs:us-east-1:123456789012:queue_1.The second policy allows username1 to send messages to the queue.For more information on these these policies, see IAM policy types: How and when to use them.Example IAM policy statement for username1{   "Version": "2012-10-17",   "Statement": [{      "Effect": "Allow",      "Action": "sqs:SendMessage",      "Resource": "arn:aws:sqs:us-east-1:123456789012:queue_1"   }]}Example SQS resource policy statement for queue_1{   "Version": "2012-10-17",   "Id": "Queue1_Policy",   "Statement": [{      "Sid":"Queue1_AllActions",      "Effect": "Allow",      "Principal": {         "AWS": [            "arn:aws:iam::111122223333:user/username1"         ]      },      "Action": "sqs:SendMessage",      "Resource": "arn:aws:sqs:us-east-1:123456789012:queue_1"   }]}
Question: Why didn't my AD users sync to IAM Identity Center?

My Active Directory (AD) users didn't sync to AWS Identity and Access Management (IAM) Identity Center (successor to AWS Single Sign-On).

ResolutionAfter connecting your AWS Managed AD or self-managed AD to IAM Identity Center, users in the default "Domain Users" group won't sync to IAM Identity Center. This is because IAM Identity Center can't read AD primary groups and their memberships.To resolve this issue, create new groups in your Managed AD, assign users to the groups, and then sync the users to IAM Identity Center. Using new groups instead of the default "Domain Users" group allows group membership in the IAM Identity Center identity store.For more information, see Active Directory “Domain Users” group does not properly sync into IAM Identity Center.

Related informationIAM Identity Center configurable AD syncConnect to a Microsoft AD directoryHow do I get started with using IAM Identity Center and access the AWS access portal?
Question: How do I extend my Linux file system after increasing my EBS volume on my EC2 instance?

I increased the size of my Amazon Elastic Block Store (Amazon EBS) volume, but my file systems aren't using the full volume. How do I fix that?ResolutionWhen a volume is expanded to a larger size, the file system must also be resized to take advantage of the larger volume size. You can resize a file system as soon as it's in the optimizing state.The following procedure extends an 8 GB ext4 file system to get full use of a 16 GB volume. The file system is on an Amazon Elastic Compute Cloud (Amazon EC2) instance running Ubuntu.1.    Create a snapshot of your volume before changing your volume or file system. For more information, see Create Amazon EBS Snapshots.2.    Use the df -h command to show the size and the percentage used by the file system.ubuntu@ip-172-31-32-114:~$ df -hFilesystem      Size  Used Avail Use% Mounted on/dev/xvda1      7.7G  7.7G     0 100% //dev/xvdf       7.9G  7.1G  370M  96% /home/ubuntu/testIn this example, the /dev/xvdf/ file system size is 7.9G and is 96% full.3.    Use the lsblk command to show the size of the xvdf volume.ubuntu@ip-172-31-32-114:~$ lsblkNAME    MAJ:MIN RM  SIZE RO TYPE MOUNTPOINTxvda    202:0    0    8G  0 disk└─xvda1 202:1    0    8G  0 part /xvdf    202:80   0   16G  0 disk /home/ubuntu/testIn this example, the size of the xvdf volume is 16G.4.    Connect to your instance using SSH. For more information, see Connect to your Linux instance.5.    If the volume has a partition containing a file system, that partition must be resized before the file system is expanded.6.    Use the resize2fs command to automatically extend the size of the /dev/xvdf/ file system to the full space on the volume.ubuntu@ip-172-31-32-114:~$ sudo resize2fs /dev/xvdfNote: In this example, the volume is using an ext4 file system. Depending on your file system, you might need to use a different utility. For more information, see Extend a Linux file system after resizing a volume.7.    Rerun the df –h command.ubuntu@ip-172-31-32-114:~$ df -hFilesystem      Size  Used Avail Use% Mounted on/dev/xvda1      7.7G  7.7G     0 100% //dev/xvdf        16G  7.1G  8.0G  48% /home/ubuntu/testThe /dev/xvdf/ file system is now 16G in size and only 48% full.

Related informationView information about an Amazon EBS volumeMake an Amazon EBS volume available for use on LinuxExtend a Windows file system after resizing a volume
Question: How do I use CloudFront to serve HTTPS requests for my Amazon S3 bucket?

I want to configure an Amazon CloudFront distribution to serve HTTPS requests for my Amazon Simple Storage Service (Amazon S3).

ResolutionOpen the CloudFront console.Choose Create Distribution.Under Origin, for Origin domain, choose your S3 bucket's REST API endpoint from the dropdown list. Or, enter your S3 bucket's website endpoint. For more information, see Key differences between a website endpoint and a REST API endpoint.Under Default cache behavior, Viewer, for Viewer Protocol Policy, select HTTP and HTTPS or Redirect HTTP to HTTPS.Note: Choosing HTTPS Only blocks all HTTP requests.If you're not using an Alternate domain name (CNAME) with CloudFront, then choose Create Distribution to complete the process. If you are using a CNAME, then follow these additional steps before you create the distribution:For Alternate Domain Names (CNAMEs), choose Add item, and then enter your alternate domain name.For Custom SSL Certificate, choose the custom SSL certificate from the dropdown list that covers your CNAME to assign it to the distribution.Note: For more information on installing a certificate, see How do I configure my CloudFront distribution to use an SSL/TLS certificate?Choose Create distribution.Note: After you choose Create distribution, 20 or more minutes can elapse for your distribution to be deployed.For information on using your distribution with Amazon S3, see Using an Amazon S3 bucket. When you use the Amazon S3 static website endpoint, connections between CloudFront and Amazon S3 are available only over HTTP. For information on HTTPS connections between CloudFront and Amazon S3, see How do I use CloudFront to serve a static website hosted on Amazon S3?Be sure to update the DNS for your domain to a CNAME record that points to the CloudFront distribution's provided domain. You can find your distribution's domain name in the CloudFront console.If you're using Amazon Route 53 as your DNS provider, then see Configuring Amazon Route 53 to route traffic to a CloudFront distribution. If you're using another DNS provider, then you can create a CNAME record (www.example.com CNAME d111111abcdef8.cloudfront.net) to point to the distribution's domain.Important: DNS standards require that an apex domain (example.com) use an authoritative (A) record that maps to an IP address. You can point your apex domain to your CloudFront distribution only if you're using Route 53. If you're using another DNS provider, then you must use a subdomain (www.example.com).For additional troubleshooting based on your endpoint type, see the following:I'm using an S3 REST API endpoint as the origin of my CloudFront distribution. Why am I getting 403 Access Denied errors?I'm using an S3 website endpoint as the origin of my CloudFront distribution. Why am I getting 403 Access Denied errors?Related informationAmazon CloudFront pricingRequiring HTTPS for communication between CloudFront and your Amazon S3 originWebsite endpointsCreate a CloudFront distribution
Question: How do I copy an Amazon Redshift provisioned cluster to a different AWS account?

I want to copy an Amazon Redshift provisioned cluster from one AWS account to another. How can I do that?Short descriptionBefore you begin, consider the following requirements:New clusters will have a different Domain Name System (DNS) endpoint. This means that you must update all clients, application codes, and Amazon Kinesis Data Firehose delivery streams to refer to the new endpoint.Amazon Simple Storage Service (Amazon S3) log settings aren't migrated. You must activate database audit logging on the new cluster.Historic information that is stored in STL and SVL tables aren't retained in the new cluster.

ResolutionTo copy an Amazon Redshift provisioned cluster to another AWS account, follow these steps:1.    Create a manual snapshot of the cluster that you want to migrate.2.    Share a cluster snapshot with another AWS account.3.    In the destination AWS account, restore the cluster from a snapshot.

Related informationAmazon Redshift snapshotsHow do I move my Amazon Redshift cluster from one VPC to another VPC?Managing snapshots using the AWS CLI and Amazon Redshift APIDNS attributes for your VPC
Question: How do I view web interfaces that are hosted on Amazon EMR clusters?

I want to access the application user interfaces (UIs) that are on my Amazon EMR cluster.

ResolutionApplications that you install on an Amazon EMR cluster, such as Apache Spark and Apache Hadoop, publish web UIs on the master node. You have several options for accessing these user interfaces, depending on your level of technical expertise. For more information about the options, see View web interfaces hosted on Amazon EMR clusters.
Question: Can I switch my ACM certificate’s validation method?

I want to change the validation method for my AWS Certificate Manager (ACM) certificate. How do I do that?Short descriptionAfter submitting a certificate request with ACM, it's not possible to change the validation method.

ResolutionIf you want to switch the ACM certificate validation method, you must request a new certificate for the same domain using your preferred validation method. After your new certificate is issued, associate it to the resources used with the previous certificate.For more information on requesting a new certificate, see Request a public certificate.Note: DNS validation has several advantages over email validation, especially if Amazon Route 53 is the DNS provider for your domain. For more information, see Using DNS to validate domain ownership.To identify which resources the previous ACM certificate was associated with, see Describe ACM Certificates.For replacing your ACM certificate on your load balancer or Amazon CloudFront distribution, see:Update an HTTPS listener for your Application Load BalancerReplace the SSL certificate for your Classic Load BalancerUpdate a TLS listener for your Network Load BalancerRotating SSL/TLS certificates

Related informationWhy am I not receiving validation emails when using ACM to issue or renew a certificate?Why is my AWS Certificate Manager (ACM) certificate DNS validation status still pending validation?
Question: How do I pass parameters from a scheduled trigger in EventBridge to an AWS Batch job?

I want to pass parameters from a scheduled trigger in Amazon EventBridge to an AWS Batch job.

Short descriptionIn AWS Batch, your parameters are placeholders for the variables that you define in the command section of your AWS Batch job definition. These placeholders allow you to:Use the same job definition for multiple jobs that use the same format.Programmatically change values in the command at submission time.It's a best practice to define your parameter as a key-value pair. For example:"Parameters" : {"test" : "abc"}If you register a job definition or submit a job, then use parameter substitution placeholders in the command field of the job's container properties. For example:"Command" : [ "echo” "Ref::test" ]When you submit the preceding job, the Ref::test argument in the container's command is replaced with the default value (abc).You can define a different parameter value for the same parameter key when you submit a job. For example:"Parameters" : {"test" : "hello"}When you submit the preceding job, the Ref::test argument in the container’s command is replaced with the custom value (hello) that you defined during job submission.

ResolutionSet up your AWS Batch environment1.    Create a compute environment.2.    Create a job queue, and then associate your job queue with the compute environment that you created in step 1.3.    Create a job definition with an image (For example: nginx).Create an EventsBridge ruleImportant: You must use camel case for JSON text in your EventBridge rules.1.    Open the EventBridge console.2.    Select Create rule.3.    Enter a Name for your rule. You can optionally enter a Description.4.    In Define pattern, select Event pattern or Schedule, based on your use case.5.    In Select event bus, select the default option of AWS default event bus.6.    In Select targets, choose Batch job queue from the Target dropdown list.7.    For Job queue, enter the ARN of the job queue that you created earlier.8.    For Job definition, enter the name of the job definition that you created earlier.9.    For Job name, enter a name for your job.10.    Expand the Configure input section, and select Constant (JSON text).11.    In the text box that appears, enter the following:{"Parameters": {"name":"test"}, "ContainerOverrides": { "Command": ["echo","Ref::name"] } }The rule submits an AWS Batch job when EventBridge invokes the rule. If the job is successful, your CloudWatch logs print "test" at the following locations:Log Group: /aws/batch/jobLog Stream: yourJobDefinitionName/default/your-ecs-task-ID12.    Select Create.

Related informationCreating Amazon EventBridge rules that react to eventsCreating an Amazon EventBridge rule that runs on a schedule
Question: How can I resolve root certificate file errors when using foreign data wrappers and SSL verify-full on Amazon RDS/Aurora PostgreSQL?

I'm using Foreign Data Wrappers (FDW) and sslmode that is set to verify-full on Amazon Relational Database Service (Amazon RDS) running PostgreSQL. When I try to create an FDW server for my DB instance, I receive the following error: "root certificate file "/home/rdsdb/.postgresql/root.crt" does not exist". How can I resolve this error?Short descriptionTo enable certificate verification in PostgreSQL, sslmode must be set to verify-full. If the sslmode is set to verify-full when you create an FDW server from one Amazon RDS instance to another, you receive the root certificate file error. This error is generated on the DB instance where the CREATE SERVER command is run. You can't access the filesystem on an Amazon RDS instance directly or install the CA certificates, but the required root certificate is already installed on the DB instance. To find the location of the certificate, run the following command:postgres=> show ssl_cert_file;ssl_cert_file-----------------------------------------/rdsdbdata/rds-metadata/server-cert.pem(1 row)To resolve this error, point the FDW connection to the /rdsdbdata/rds-metadata/server-cert.pem file when creating the server.

ResolutionTo point the FDW connection to the root certificate file, run a command similar to the following:CREATE SERVER my_foreign_db foreign data wrapper postgres_fdw options (host 'my_db.xyz.eu-west-1.rds.amazonaws.com', port '5432', dbname 'my_db', sslmode 'verify-full', sslrootcert '/rdsdbdata/rds-metadata/server-cert.pem');To confirm that the connection is working, create a user mapping and foreign table:Note: PostgreSQL logs passwords in cleartext in the log files. To prevent this, review How can I stop Amazon RDS for PostgreSQL from logging my passwords in clear-text in the log files?CREATE USER MAPPING FOR dbuser SERVER my_foreign_db OPTIONS (user 'dbuser', password 'dbpasswd');CREATE FOREIGN TABLE foreign_table ( id integer not null, name character(84)) SERVER my_foreign_db OPTIONS (schema_name 'public', table_name 'my_table');A connection isn't made until the table is accessed. To confirm that the connection is working, query the table:SELECT * from foreign_table ;If the FDW connection is successful, the data from the foreign table is returned.

Related informationCommon management tasks for PostgreSQL on Amazon RDSPostgreSQL Documentation for postgres_fdw
Question: How do I set up Time to Live (TTL) in DynamoDB?

I want to set up Time to Live (TTL) on my Amazon DynamoDB table.

ResolutionAmazon DynamoDB TTL allows you to define a per-item timestamp to determine when an item is no longer needed. After the expiration of the TTL timestamp, DynamoDB deletes the item from your table within 48 hours without consuming any write throughput. The time taken to delete the items might vary depending on the size and activity level of your table.To set up TTL, see Enabling Time to Live. When you create a TTL attribute in a table, keep the following in mind:TTL attributes must use the Number data type. Other data types, such as String, aren't supported.TTL attributes must use the epoch time format. For example, the epoch timestamp for October 28, 2019 13:12:03 UTC is 1572268323. You can use a free online converter, such as EpochConverter, to get the correct value.Note: Be sure that the timestamp is in seconds, not milliseconds (for example, use 1572268323 instead of 1572268323000).

Related informationTime to LiveTables, items, and attributes
Question: How do I use the Reserved Instance coverage report in Cost Explorer?

I want to use the Cost Explorer reports to understand the coverage of my Reserved Instances (RIs).

ResolutionYou can use the RI coverage reports in Cost Explorer to do the following:View the utilization of individual RIs in the chart. You can view your RI utilization in either hours or normalized units. For more information on viewing RI utilization in either hours or normalized units, see Reserved Instance reports.View the number of instance hours or normalized units covered by your RIs in the chart. You can use this information to track your required instance hours or units and how many of those are covered by RIs.View the number of hours or normalized units covered by RIs against the On-Demand table. You can use this information to understand how much you spent on On-Demand Instances and how much you could have saved had you purchased more reservations.Select a single RI or a group of RIs in the table to view their respective coverage in the table.Define a threshold for the coverage you want from RIs, called the coverage target, to see where you can reserve more RIs.To define the coverage target, enter the preferred value for Coverage target, and select Show target line on chart. You can see the target coverage on the chart as a dotted line and the average coverage in the table as a status bar.Instances with a red status bar have no RI coverage.Instances with a yellow status bar are under your set coverage target.Instances with a green status bar have met your coverage target.Instances with a gray bar aren't using your reservations.

Related informationRI coverage reports
Question: How do I change my Lightsail plan?

I want to change my current Amazon Lightsail plan to a different plan.

ResolutionYour Lightsail plan is based on the Lightsail bundle that you're using.Upgrading the planTo upgrade your Lightsail plan to a larger instance, take a snapshot, and then create a larger instance from the snapshot.Downgrading the planMoving the Lightsail plan to a smaller instance isn't supported. In Lightsail instances, the data is stored in fixed-sized SSD disks. The data in SSD isn't stored uniformly. There are no methods to downsize an SSD volume because that process can cause data loss and data corruption. This means that it's not possible to automatically move from a larger Lightsail plan to a smaller one.To migrate to a smaller instance size, you must manually copy the site contents to a smaller instance by doing the following:Create a new, smaller Lightsail instance.Back up and restore the data from the old instance to the new instance. For detailed instructions on how to make a backup and restore your applications on Bitnami stacks, see Create and restore application backups. If this method doesn't fit your application, then contact your application's support team to understand how to move the data to a smaller instance.Note: Keep the following in mind when changing your Lightsail plan:Make sure that you're taking a complete backup of the existing Lightsail instance as a snapshot.Download the backup and then upload it to a new instance using SFTP/FTP or data stores such as S3 or Lightsail object storage.If you have a static IP address, be sure to detach it from your old instance. Then, attach it to your new instance.If there's an SSL certificate installed in the old instance, check to see if the certificate files are outside the /opt/bitnami directory. If they are, then you must manually copy the certificate to the new instance.The credentials files in the Bitnami instance also must be copied from the old instance to the new one. These are credential files such as /home/bitnami/bitnami_credentials and /home/bitnami/bitnami_application_password.

Related informationExtending the storage space of your Windows Server instance in Amazon Lightsail