VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I migrate a Dedicated Host or Dedicated Instance to another Dedicated Host?

I want to migrate an instance running on dedicated hardware (a Dedicated Host or Dedicated Instance), or I received a maintenance notification and have a scheduled event for an instance running on dedicated hardware. What should I do?Short descriptionTo migrate an instance away from a Dedicated Host, do one of the following:Allocate a new Dedicated Host to your account, and then move your Dedicated Instance to the new Dedicated Host.Edit the placement of the instance so that the instance runs on another one of your existing Dedicated Hosts.Migrate your instance from a Dedicated Host to a Dedicated Instance, and vice versa, from the Amazon Elastic Compute Cloud (Amazon EC2) console by modifying the tenancy of the instance.

ResolutionTo allocate a new Dedicated Host to your accountOpen the Amazon EC2 console, and then choose Dedicated hosts from the navigation pane.Choose Allocate Dedicated Host.Choose an instance type and Availability Zone that matches the instance you want to migrate. For all other options, choose the appropriate settings.Choose Allocate Host.To move an instance from one Dedicated Host to anotherChoose the instance in the Amazon EC2 console.From the Actions menu, choose Manage instance state.Choose Stop, Change state, Stop.From the Actions menu, choose Instance Settings, and then choose Modify instance placement.From the Target host menu, choose the new Dedicated Host that you want the instance to run on.Choose Save.From the Actions menu, choose Manage instance state.Choose Start, Change state, Start.To migrate an instance from a Dedicated Host to a Dedicated InstanceOpen the Amazon EC2 console, and then choose Dedicated Hosts from the navigation pane.Select the Running instances tab, and then select the instance.From the Actions menu, choose Manage instance state.Choose Stop, Change state, Stop.From the Actions menu, choose Instance Settings, and then choose Modify instance placement.Change Tenancy to Dedicated instance.Choose Save.From the Actions menu, choose Manage instance state.Choose Start, Change state, Start.For more information on the two offerings, see Differences between Dedicated Hosts and Dedicated Instances.

Related informationDedicated HostsWhat do I need to know when my Amazon EC2 instance is scheduled for retirement?What happens during an EC2 scheduled maintenance event and what preventative actions can I take?Allocate Dedicated HostsModify instance tenancy and affinity
Question: How do I prevent duplicate Lambda function invocations?

My AWS Lambda function keeps receiving more than one invocation request for a single event. How do I prevent my Lambda function from invoking multiple times from the same event?Short descriptionTo help prevent duplicate Lambda function invocations, do the following based on the invocation type that you're using.Note: For synchronous invocations, the clients and AWS services that invoke a Lambda function are responsible for performing retries. For asynchronous invocations, Lambda automatically retries on error, with delays between retries.

ResolutionFor asynchronous invocationsReview your Lambda function's Amazon CloudWatch Logs to verify the following:If the duplicate invocations have the same request ID or notIf the duplicate invocations returned errors or timed outThen, do one of the following based on your use case:For duplicate invocations that returned errors or timed out and that have the same request IDNote: Duplicate invocations that return errors or timeout and that have the same request ID indicate that the Lambda service retried the function.Configure error handling for asynchronous invocations to reduce the number of times that your Lambda function retries failed asynchronous invocation requests.For more information, see Error handling and automatic retries in AWS Lambda.For duplicate invocations that didn't return errors or timeoutNote: Duplicate invocations that don't return errors or timeout indicate client-side retries.Make sure that your Lambda function's code is idempotent and capable of handling messages multiple times.Make sure that your Lambda function has its concurrency limit set high enough to handle the number of invocation requests it receives.Identify and resolve any errors that your Lambda function returns.Note: To troubleshoot function invocation failures, see How do I troubleshoot Lambda function failures?For synchronous invocationsNote: Synchronous invocation retry behavior varies between AWS services, based on each service's event source mapping. For more information, see Event-driven invocation.Make sure that your Lambda function's code is idempotent and capable of handling messages multiple times.Identify and resolve any errors that your Lambda function returns.Note: To troubleshoot function invocation failures, see How do I troubleshoot Lambda function failures?Related informationViewing events with CloudTrail Event historyBest practices for working with AWS Lambda functionsLambda function scalingWhy is my Lambda function retrying valid Amazon SQS messages and placing them in my dead-letter queue?
Question: How do I share my ACM Private Certificate Authority with another AWS account?

I created an AWS Certificate Manager (ACM) Private Certificate Authority (ACM PCA) in one AWS account. Can I share it with a different AWS account to issue certificates?Short descriptionYou can create a resource share using AWS Resource Access Manager (AWS RAM) to share an ACM PCA with another AWS account. In addition, you can share an ACM PCA with:Other principals, such as AWS Identify and Access Management (IAM) users and IAM roles.Organizational units (OUs).The entire AWS organization that your account is a member of.Sharing your ACM PCA allows users and roles in other accounts to issue private x509 certificates signed by the shared PCA.

ResolutionCreate an AWS RAM share in the account where your ACM PCA resides.ExampleYou have an existing ACM PCA in Account A. You want to share it with Account B.In Account A, create a resource share in AWS RAM. For detailed instructions, see the Console instructions in Creating a resource share.Note: In Step 2: Associate a permission with each resource type, choose the permission for the type of certificates that you want to issue. For example:To issue end-entity certificates with the default certificate template arn:aws:acm-pca:::template/EndEntityCertificate/V1: choose the default permission AWSRAMDefaultPermissionCertificateAuthority.To issue a subordinate certificate (PathLen0) using the certificate template arn:aws:acm-pca:::template/SubordinateCACertificate_PathLen0/V1: choose AWSRAMSubordinateCACertificatePathLen0IssuanceCertificateAuthority.Accept the shared resource in your shared account (Account B, in this example). If you share with AWS Organizations (with resource sharing within AWS Organization turned on), you can skip to step 6.In the shared account (Account B, in this example), open the AWS RAM console in the same Region as step 1.Under Shared with me, select Resource shares. You see the pending share invitation.Select the name of the shared resource, and then choose Accept resource share. After accepting the share, the share is listed as Active.In the shared account (Account B, in this example), open the ACM PCA console in the Region where the PCA is located. You see the shared PCA in your account. You can begin to issue private x509 certificates using the shared PCA.

Related informationHow to use AWS RAM to share your ACM Private CA cross-accountCreating a resource share in AWS RAM
Question: What do I do if the tax I'm charged for AWS services is incorrect?

I'm charged the incorrect amount or type of tax.

Short descriptionTo determine your account's location for tax purposes, AWS uses the tax registration number (TRN) and the business legal address associated with the account. If you don't provide a TRN or business legal address, then AWS uses the address of the account's default payment method, the account's billing address, and the account's contact address to determine the account's tax jurisdiction.A TRN might also be known as a value-added tax (VAT) number, VAT ID, VAT registration number, or Business Registration Number.If you're charged the incorrect amount or type of tax, update your account's information to make sure that the information is accurate.

ResolutionTo update your account informationTo update your TRN or business legal address, see How do I add or update my tax registration number or business legal address for my AWS account?To update the contact address associated with your account, see Managing an AWS Account.To update the billing address associated with your payment method, see Managing your AWS payment preferences.To add or update your US sales tax exemption, see Manage your tax exemptions.If you receive special status or relief from paying VAT, contact AWS Support and provide any applicable certificates issued by the tax authorities in your country or specific sections of tax legislation that are applicable to your organization.If you're the payer account and have a TRN, the TRN must be applied to each linked account for the tax charges to be calculated correctly.For more information on how AWS calculates tax, see Amazon Web Services Tax Help.Note: AWS Support can't provide tax advice. If you have questions about your tax obligation, consult your tax advisor.

Related informationTax registration numbers
Question: How can I troubleshoot the error "FAILED: SemanticException table is not partitioned but partition spec exists" in Athena?

When I run ALTER TABLE ADD PARTITION in Amazon Athena, I get this error: "FAILED: SemanticException table is not partitioned but partition spec exists".

ResolutionThis error happens if you didn't define any partitions in the CREATE TABLE statement. To resolve this error, take one of the following actions:Re-create the table and use PARTIONED BY to define the partition key.Edit the table schema.Re-create the tableCreate the table again and use PARTITIONED BY to define the partition key. For an example, see Create the table. After you define the partition, you can use ALTER TABLE ADD PARTITION to add more partitions.For example, if you're using the following data definition language (DDL) to create the table with three partitions for year, month, and day:CREATE EXTERNAL TABLE test (requestBeginTime string,adId string,...)PARTITIONED BY (year string,month string,day string)ROW FORMAT serde 'org.apache.hive.hcatalog.data.JsonSerDe'LOCATION 's3://.../' ;Then, add the partitions similar to the following ones:ALTER TABLE impressions ADDPARTITION (year = '2016', month = '05', day='04') LOCATION 's3://mystorage/path/to/data\_14\_May\_2016/';Edit the table schemaTo edit the table schema in AWS Glue, complete the following steps:Open the AWS Glue console.Choose the table name in the list, and then choose Edit schema.Choose Add column.Enter the column name, type, and number. Then, check the Partition key box.Choose Add.For more information, see Viewing and editing table details.
Question: How can I use an SSH tunnel and MySQL Workbench to connect to a private Amazon RDS MySQL DB instance that uses a public EC2 instance?

I have a private Amazon Relational Database Service (Amazon RDS) MySQL DB instance and a public Amazon Elastic Compute Cloud (Amazon EC2) instance, and I want to connect to them by using an SSH tunnel and MySQL Workbench. How can I do this?Short descriptionBefore you connect over an SSH tunnel using MySQL Workbench, confirm that the  security group inbound rules, network access control lists (network ACLs), and  route tables are configured to allow a connection between your EC2 instance and your RDS DB instance. Also confirm that the EC2 instance can be connected to over the internet using its public IP address from your local machine. For more information, see Scenarios for accessing a DB Instance in a VPC.

ResolutionOpen MySQL Workbench.Select MySQL New Connection and enter a connection name.Choose the Connection Method, and select Standard TCP/IP over SSH.For SSH Hostname, enter the public IP address of your EC2 instance.For SSH Username, enter the default SSH user name to connect to your EC2 instance.Choose SSH Key File, and select the .pem file used to connect from your file system.For MySQL Hostname, enter the database endpoint name.For MySQL Server Port, enter the port number that you use to connect to your database.For Username, enter the user name that you use to connect to your database.For Password, enter the MySQL user password.Choose Test Connection. After the test is successful, choose OK to save the connection.After the connection is configured, you can connect to your private RDS DB instance using an SSH tunnel.

Related informationHow do I resolve problems when connecting to my Amazon RDS DB instance?Connect to your Linux instance using an SSH client
Question: How do I troubleshoot intermittent timeout errors in Amazon DynamoDB?

When I use AWS SDK to interact with Amazon DynamoDB, I see intermittent connection timeout or request timeout errors, such as the following:Unable to execute HTTP request: Connect to dynamodb.xx-xxxx-x.amazonaws.com:443 [dynamodb.us-east-1.amazonaws.com/x.xxx.xxx.x] failed: connect timed outcom.amazonaws.SdkClientException: Unable to execute HTTP request. Request did not complete before the request timeout configuration

ResolutionWhen you make an API call to DynamoDB, the following happens:Your application resolves the DynamoDB endpoint using your local DNS server.After getting the IP address of the DynamoDB endpoint, the application connects to the endpoint and makes the API call.The endpoint routes this call to one of the backend nodes.During this process, the API call might intermittently result in connection timeout or request timeout errors. In most cases, the timeout error results from a client-side error that occurs before the API call reaches DynamoDB due to network issues or incorrect SDK configurations on the client side.To troubleshoot these errors, do the following:Tune the SDK HTTP client parameters according to your use case and application SLA. In addition to tuning connectionTimeout, requestTimeout, and maxRetries, you can also tune clientExecutionTimeout and socketTimeout. The ClientExecutionTimeout parameter indicates the maximum allowed total time spent to perform an end-to-end operation and receive the desired response, including any retries that might occur. Be sure that you set this value to be greater than the individual requestTimeout value. The socketTimeout parameter indicates the maximum amount of time that the HTTP client waits to receive a response from an already established TCP connection. For more information, see Tuning AWS Java SDK HTTP request settings for latency-aware Amazon DynamoDB applications.Be sure to send constant traffic or reuse connections. When you're not making requests, consider having the client send dummy traffic to a DynamoDB table. Or, you can reuse client connections or use connection pooling. These techniques keep internal caches warm, which helps to reduce the latency and avoid timeout errors on client side. For example, see Reusing connections with Keep-Alive in Node.js.View your Amazon Virtual Private Cloud (Amazon VPC) flow logs to check if there was incoming traffic to DynamoDB during the timeframe when you got the error. You can also use AWS X-Ray to monitor the latency of your application.
Question: How do I create a new FSx for ONTAP file system in a shared VPC?

I want to create an Amazon FSx for NetApp ONTAP file system in a shared Amazon Virtual Private Cloud (Amazon VPC) so that it can be accessed by another account. How do I do this?ResolutionPrerequisitesTo create and share your FSx for ONTAP file system, the following prerequisites must be met:You must have two AWS accounts that are within the same organization. For more information, see Inviting an AWS account to join your organization.Sharing must be turned on in AWS Organizations for the main account of the organization. For more information, see Enable resource sharing within AWS Organizations.You must have a shared VPC with a subnet shared to the account. This subnet can be in the main account or in the account that joined your organization.Example:Account A is the main account of the organization, and Account B has joined the organization.Account A turned on sharing in the AWS Resource Access Manager (AWS RAM).Account A creates one VPC with two subnets, and shared these two subnets to Account B.Account A creates a FSx for ONTAP file system.Account B creates an Amazon Elastic Compute Cloud (Amazon EC2) instance using the shared VPC.Account B mounts the FSx for ONTAP file system of Account A in the shared VPC.Create shared subnetsOpen the AWS RAM console.Select Create a resource share.In Step 1: Specify resource share details, enter a resource share name. For example, Shared_VPC_TEST.For Select resource type, select Subnet, and then choose the subnets to be shared from the list or resources.Select Next.In Step 2: Associate a permission with each resource type, select Next. ( AWSRAMDefaultPermissionSubnet is the only permission available.)In Step 3: Choose principals to grant access, enter the 12-digit account ID that you’re sharing the resource with, and then choose Add.Select Next.In Step 4: Review and create, make sure that all details are correct, and then select Create resource share.For detailed steps on creating a resource share, see Create a resource share.Note: You can't share subnets that are in a default VPC.Create your FSx for ONTAP file system in a shared VPC and access it from the shared accountCreate an FSx for ONTAP file system in the shared VPC that contains the shared subnet. For detailed instructions on creating a file system, see Step 1: Create an Amazon FSx for NetApp ONTAP file system.From the account that the resource is shared, launch an EC2 instance in the shared VPC, and then mount the FSx for ONTAP file system on the instance. For detailed instructions on how to mount the file system, see Mounting volumes.

Related informationAWS Resource Access ManagerAWS account management
Question: How do I troubleshoot timeout issues with a Lambda function that's in an Amazon VPC?

My AWS Lambda function returns timeout errors when I configure the function to access resources in an Amazon Virtual Private Cloud (Amazon VPC). How do I troubleshoot the issue?ResolutionConfirm that there's a valid network path to the endpoint that your function is trying to reach. To review your network settings, follow the instructions in How do I give internet access to my Lambda function in a VPC?Important: If you're using a custom Dynamic Host Configuration Protocol (DHCP) options set, confirm that your custom DNS server is working as expected.When you review your network settings, make sure that the following settings are configured correctly:Route tablesSubnetsSecurity groupsNetwork access control lists (network ACLs)Domain Name System (DNS) hostnames and DNS resolutionNote: Security groups require outbound rules for Lambda only. Network ACLs require both inbound and outbound rules for Lambda.If you're using an AWS SDK, then see if the SDK throws any relevant errors that can help you determine what's causing the timeouts.

Related informationHow do I troubleshoot issues with VPC route tables?How does DNS work, and how do I troubleshoot partial DNS failures?
Question: How do I create source or target endpoints using AWS DMS?

How do I specify a source and a target database endpoint for my AWS Database Migration Service (AWS DMS) task?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Before you can run an AWS DMS task, you must create a replication instance, a source endpoint, and a target endpoint. You can create source and target endpoints:Using the AWS DMS console when you create a replication instance.Using the AWS DMS console after you create a replication instance.Using the AWS CLI.Create endpoints when creating a replication instanceOpen the AWS DMS console.From the navigation pane, choose Replication instances.Choose Create replication instance, and enter your replication instance information.On the Connect source and target database endpoints page, specify your source and target endpoints. For more information, see Creating source and target endpoints.Create source and target endpoints after creating a replication instanceOpen the AWS DMS console.From the navigation pane, choose Endpoints, and then choose Create endpoint.Select Source endpoint and enter the source endpoint information.Choose Create endpoint.From the Endpoints pane, choose Create endpoint.Select Target endpoint and enter the target endpoint information.Choose Create endpoint.Note: When you create a password for your PostgreSQL endpoint, you can't use the following special characters: +, %, or ;. For MySQL endpoint passwords, you can't use ;.Create endpoints using the AWS CLIAfter you install and configure the latest version of the AWS CLI, run the create-endpoint command.

Related informationSources for data migrationTargets for data migrationWorking with an AWS DMS replication instanceMigration strategy for relational databases
Question: I have a primary connection Direct Connect gateway with a backup VPN connection. Why is traffic prioritizing the backup connection?

I have an AWS Direct Connect gateway with my primary connection set to on-premises. I also have a backup VPN connection for failover with my AWS Direct Connect connection. The traffic from my on-premises connection to AWS is prioritizing the backup connection (VPN connection) and not the primary connection (Direct Connect connection). Why is this happening, and how can I fix it?Short descriptionCustomer gateways prefer the most specific route to Amazon Virtual Private Cloud (Amazon VPC). If the VPN connection has the most specific route, then it's preferred over the Direct Connect connection.

ResolutionAWS Site-to-Site VPN supports two types of deployment: static and dynamic. Based on your use case, see the related resolution.Static VPN:Configure your customer gateway with less specific routes for the VPN connection than the Direct Connect connection.Dynamic VPN:Confirm that you're advertising the same routes over the VPN connection and Direct Connect connection.If the customer gateway receives the same routes over the VPN and Direct Connect connections, it always prefers Direct Connect.However, if your customer gateway has a more specific route over the VPN than the Direct Connect connection, then VPN is preferred. For example, Direct Connect has a maximum of 20 allowed prefixes. If you add summarized routes to cover all the prefixes, then the CIDRs advertised over VPN become more specific than the CIDRs advertised over Direct Connect. As a result, the customer gateway prioritizes the VPN over the Direct Connect connection.To resolve this issue, follow these steps:Add the same route associated with Direct Connect to the Site-to-Site VPN routing table. This results in the Site-to-Site VPN advertising the specific routes and the route that you added.In the customer gateway, filter out the specific routes advertised by the Site-to-Site VPN. The customer gateway then has the same routes over both connections and prefers the Direct Connect connection.Traffic from AWS to the customer gatewayIf traffic is coming from an AWS connection to your customer gateway, the more specific route is preferred. If the routes are the same, then AWS prefers a Direct Connect connection over a VPN connection for the same on-premises subnet.To set your AWS connection to prefer VPN over Direct Connect:For a static VPN, add a more specific route in the static VPN route table.For a Border Gateway Protocol (BGP) VPN, advertise a less specific route over the Direct Connect connection. As the most specific route is preferred, the VPN connection is then preferred.

Related informationRoute tables and VPN route priorityRoute priority