VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I know which user made a particular change to my AWS infrastructure?

I want to track which users are changing my AWS resources and infrastructure.

ResolutionYou can use AWS CloudTrail to track which users are changing your AWS resources and infrastructure. CloudTrail is turned on by default for your AWS account. For an ongoing record of events in your AWS account, create a trail. Using a trail, CloudTrail creates logs of API calls made on your account and then delivers those logs to an Amazon Simple Storage Service (Amazon S3) bucket that you specify.To view your log files, do the following:Open the CloudTrail console.In the navigation pane, choose Trails.Select the S3 bucket value for the trail you want to view. The Amazon S3 console opens and shows that bucket, at the top level for the log files.Choose the folder for the AWS Region where you want to review log files.Navigate the bucket folder structure to the year, the month, and the day where you want to review logs of activity in that Region.Select the file name, and then choose Download.Unzip the file, and then use your favorite JSON file viewer to see the log.The log file contains the AWS Identity and Access Management (IAM) user, date and time of login, and if the login was successful. For additional information on the content and structure of the CloudTrail log files, see CloudTrail log event reference.For additional instructions on using CloudTrail to analyze your account activity, see Working with CloudTrail.

Related informationWhat is AWS CloudTrail?How can I use CloudTrail to review what API calls and actions have occurred in my AWS account?
Question: Can I use an Amazon S3 bucket as an AWS Database Migration Service (AWS DMS) target?

How can I use an Amazon Simple Storage Service (Amazon S3) bucket as the target for AWS Database Migration Service (AWS DMS) for resources that are in the same account?Short descriptionAfter you create a replication instance, you can use an S3 bucket as your target endpoint for AWS DMS by following these steps:Create an S3 bucketCreate an AWS Identity and Access Management (IAM) policyCreate a roleCreate your target endpointFor more information, see Using Amazon S3 as a target for AWS Database Migration Service.

ResolutionCreate an S3 bucket1.    Open the Amazon S3 console, and then create a bucket.2.    Select the bucket that you created, and then choose Create folder.3.    Enter a folder name, and then choose Save.Create an IAM policy1.    Open the IAM console, and then choose Policies from the navigation pane.2.    Choose Create policy, and then choose JSON.3.    Add an IAM policy similar to the following:{    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Action": [                "s3:PutObject",                "s3:DeleteObject"            ],            "Resource": [                "arn:aws:s3:::bucketname*"            ]        },        {            "Effect": "Allow",            "Action": [                "s3:ListBucket"            ],            "Resource": [                "arn:aws:s3:::bucketname*"            ]        }    ]}Note: Update the policy to refer to your bucket name.4.    Choose Review policy, enter a Name and Description, and then choose Create policy.Create a role1.    Open the IAM console, and then choose Roles from the navigation pane.2.    Choose Create role, choose DMS, and then choose Next: Permissions.3.    In the Create role pane, in the Search field, choose the policy that you created, and then choose Next: tags.4.    Choose Next: Review.5.    Enter a Role name and a Role description.6.    Choose Create role.Create your target endpoint1.    Open the AWS DMS console, and then choose Endpoints from the navigation pane.2.    Choose Create endpoint, and then select Target endpoint.3.    Enter the Endpoint identifier, and then choose S3 as the Target engine.4.    Paste the Role ARN that you copied into the Service Access Role ARN field.5.    Enter a Bucket name and Bucket folder.6.    Under Endpoint-specific settings, add your Extra connection attributes, if you have any.7.    (Optional) Under Test endpoint connection, select your VPC  and Replication instance, and then choose Run test.8.    Choose Create endpoint.

Related informationUsing Amazon S3 as a source for AWS DMSWorking with an AWS DMS replication instanceTroubleshooting migration tasks in AWS Database Migration Service
Question: Why did I get an email from AWS stating that my Amazon SNS subscription was manually disabled?

I received an email from AWS saying that one of my Amazon Simple Notification Service (Amazon SNS) email subscriptions was manually disabled. Why was my Amazon SNS topic subscription deactivated, and how do I resolve the issue?Short descriptionIf messages are published to an SNS topic at a higher rate than the Delivery rate for email messages quota, then Amazon SNS deactivates the subscription.Amazon SNS automatically deactivates subscriptions when TPS quotas are breached to do the following:Prevent spamming the destination inbox with events.Protect the recipient mail server from being flooded with messages.Avoid Internet Service Providers (ISPs) identifying elevated traffic as spam and blocking messages from delivery.Note: Amazon SNS supports an email message delivery rate of 10 transactions per second (TPS) to SNS topics, for each AWS account. For more information, see Amazon SNS endpoints and quotas.

ResolutionIt's a best practice to avoid subscribing email addresses to high-volume SNS topics. Common use cases for SNS topic email subscriptions include monitoring Amazon CloudWatch alarms and sending usage reports to multiple email addresses.For high-volume SNS topics, it's a best practice to subscribe only high-throughput, system-to-system endpoints instead. For example: Amazon Simple Queue Service (Amazon SQS) queues, AWS Lambda functions, and HTTP endpoints. These types of subscription endpoints support a higher TPS quota.

Related informationCommon Amazon SNS scenariosSending an email in Amazon PinpointSubscribing to an Amazon SNS topicPublishing to a topic
Question: How do I purchase an Amazon EC2 Reserved Instance?

I have an Amazon Elastic Compute Cloud (Amazon EC2) instance that I plan to run continuously, with few interruptions, over a long period of time. How do I purchase a Reserved Instance?ResolutionYou can purchase an EC2 Reserved Instance through the Amazon EC2 console. Note that a Reserved Instance purchase can't be canceled, so it's important to purchase the Reserved Instance that's right for your needs.Choosing the right Reserved InstanceTo get the maximum benefit from your Reserved Instance purchase, the Reserved Instance must match the attributes for running On-Demand Instances on your account. For information about the attributes that must match, see Amazon EC2 RI types.Note that Reserved Instances are not physical instances, but rather a billing discount applied to the use of On-Demand Instances in your account.For an overview of the On-Demand Instance hours you're currently using by instance type, use the Amazon EC2 usage reports in Cost Explorer. For more information, see How do I view my Reserved Instance utilization and coverage?Trusted Advisor can also recommend Reserved Instances for you based on your usage.Purchasing a Reserved Instance from the EC2 consoleIn the Amazon EC2 console, you can purchase an EC2 Reserved Instance either from AWS directly or from a third-party seller on the Reserved Instance Marketplace. Follow the instructions at How to purchase Reserved Instances.When you purchase a Reserved Instance that includes an upfront cost, your default payment method is billed immediately, with a separate invoice. The upfront payment must be charged successfully before your Reserved Instance will activate.Note: AWS credits can't be applied to the upfront costs associated with Reserved Instances. If your credits include Amazon EC2 as an applicable service, they're applied to the discounted hourly rate for any Reserved Instances.

Related informationReserved InstancesAmazon EC2 Reserved InstancesBuying Reserved Instances
Question: How am I billed for AWS Support?

I want to sign up for a paid AWS Support plan, and I want to know how I'm charged for it.

ResolutionWhen you sign up for a paid AWS Support plan, your payment method is charged a prorated minimum monthly service charge on your first monthly bill. If applicable, usage charges that exceed the monthly minimum charge are also billed at the end of the month. You can see your monthly charges, including your prorated charges, by expanding the Support section on your Bills page.

Related informationAWS pricingAWS Support plan pricingCompare AWS Support plansAWS Support FAQs
Question: I accidentally denied everyone access to my Amazon S3 bucket. How do I regain access?

I incorrectly configured my bucket policy to deny all users access to my Amazon Simple Storage Service (Amazon S3) bucket.

ResolutionConditions for the bucket policy can't be metIf the conditions for the bucket policy can't be met, then you can still regain access of your Amazon S3 bucket. To regain access to your bucket, sign in to the Amazon S3 console as the AWS account root user. Then, delete the bucket policy.Important: Don't use the root user for everyday tasks. Limit the use of these credentials to only the tasks that require you to sign in as the root user. Root credentials aren't the same as an AWS Identity Access Management (IAM) user or role with full administrator access. You can't attach IAM policies with allow or deny permissions to the root account.Sign in to the AWS Management Console as the account root user.Open the Amazon S3 console.Navigate to the incorrectly configured bucket.Choose the Permissions tab.Choose Bucket Policy.Choose Delete.On the Delete bucket policy page, enter delete into the text field to confirm the deletion of the bucket policy.Choose Delete.Sign out of the AWS Management Console.(Optional) It's a best practice for the account administrator to rotate the root user password.After the root user deletes the bucket policy, an IAM user with bucket access can apply a new bucket policy with the correct permissions. For more information, see Bucket policy examples and Adding a bucket policy by using the Amazon S3 console.Conditions for the bucket policy can be metIf you can't use the root user account, then you can delete the policy if you meet the bucket policy conditions.To regain access to your bucket, complete the following steps:Review the bucket policy to determine the conditions that are set that can be fulfilled.Take the steps to meet the bucket policy conditions.After regaining access, update the bucket policy to remove or modify the restrictive conditions to prevent future lockouts.Test the changes and make sure that the level of access control is correct.If you're unsure of the policy applied to a bucket prior to a lockout, then use AWS CloudTrail to review the event. To search for recent PutBucketPolicy actions in the account using CloudTrail, complete the following steps:Open the CloudTrail console.In the navigation pane, choose Event history.On the Event history page, under Lookup attributes, choose Event name.In the Enter an event name field, choose PutBucketPolicy and press enter.Choose the most recent event and review the details of the event. The event displays the request and response parameters. This includes the bucket name and the full bucket policy.
Question: How can I grant access to the AWS Management Console for on-premises Active Directory users?

I want to grant access to the AWS Management Console using my Active Directory domain credentials.

Short descriptionManage Amazon Web Services (AWS) resources with AWS Identity and Access Management (IAM) role-based access to the AWS Management Console. Use either AD Connector or AWS Directory Service for Microsoft Active Directory. The IAM role defines the services, resources, and level of access that your Active Directory users have.

ResolutionChoose either AD Connector or AWS Managed Microsoft ADCreate a VPN connection and configure an AD Connector between your on-premises domain with the following minimum port requirements:TCP/UDP 53 for DNSTCP/UDP 88 for Kerberos authenticationTCP/UDP 389 for LDAP authenticationFor more information, see AD Connector prerequisites.- or -Use an existing trust relationship between your on-premises domain and AWS Managed Microsoft AD with the following minimum port requirements:TCP/UDP 53 for DNSTCP/UDP 88 for Kerberos authenticationTCP/UDP 389 for LDAP authenticationTCP 445 for SMBFor more information, see Create a trust relationship between your AWS Managed Microsoft AD and your self-managed Active Directory domain.Set up authenticationCreate an access URL for the directory.Activate AWS Management Console access for your AD Connector or AWS Managed Microsoft AD.Create an IAM role that grants access to the AWS Management Console for services that you want your Active Directory users to have access to.Note: Be sure that the IAM role has a trust relationship with AWS Directory Service.Assign Active Directory users or groups to the IAM role.Verify that users can access the AWS Management Console. Open the directory access URL in a private browsing session and sign in with a user account that's assigned to the IAM role. Then, check the AWS service consoles to confirm that you're permitted or denied access to services as specified by the IAM role.

Related informationCreating a role to delegate permissions to an IAM user
Question: How can I perform write operations to my Amazon RDS for MariaDB or MySQL DB instance read replica?

I want to perform both read and write operations in my Amazon Relational Database Service (Amazon RDS) for MariaDB or MySQL DB instance read replica. How can I do this?Short descriptionAmazon RDS DB instance read replicas are read-only by design. In some scenarios, you might need to configure a DB instance read replica so that the replica is modifiable.

ResolutionIf you're using Amazon RDS for MySQL or MariaDB, configure a DB instance read replica to be read/write. You can do this by setting the read_only parameter to false for the DB parameter group that is associated with your DB instance. The read_only parameter can't be modified when using other Amazon RDS engines, such as Amazon Aurora.Note: Automations, such as backups, restore, and failover, are not impacted when you enable writes on the replica. But, if you perform writes without understanding the impact of the writes, this can cause inconsistency or replication failures.To configure your Amazon RDS DB instance read replica to be read/write, follow these steps:Create a DB parameter group for your MySQL or MariaDB instance.Modify the parameter group.Associate your RDS DB instance with the DB parameter group.Note: If you create a DB instance without specifying a DB parameter group, a default DB parameter group is created. This means that default parameter groups can't be modified. If you already have a custom parameter group that is associated with the instance, you don't need to create a new parameter group. For more information about DB parameter groups, see Working with parameter groups.Create a DB parameter groupOpen the Amazon RDS console.In the navigation pane, from Parameter groups, choose Create parameter group.For Parameter group family, choose the parameter group family.For Type, choose DB Parameter Group.For Group name, enter the name of the new DB parameter group.For Description, enter a description for the new DB parameter group.Choose Create.Modify the parameter groupOpen the Amazon RDS console.In the navigation pane, from Parameter groups, select the parameter group that you want to modify.Choose Parameter group actions, and then choose Edit.Edit the following parameter: read_only = 0Choose Save changes.Associate your RDS DB instance with the DB parameter groupOpen the Amazon RDS console.In the navigation pane, from Databases, select the DB instance that you want to associate with the modified DB parameter group.Choose Modify.Note: The instance status is Modifying, and the parameter group is Applying.From Database options, choose the parameter group that you want to associate with the DB instance.After the instance status is Available and the parameter group is Pending-reboot, reboot the instance without failover.Note: The parameter group name changes immediately, but changes to the parameter aren't applied until you reboot the instance without failover.

Related informationOverview of Amazon RDS read replicasHow do I modify the values of an Amazon RDS DB parameter group?
Question: My Lambda rotation function called a second function to rotate a Secrets Manager secret but it failed. Why did the second Lambda function fail?

My AWS Lambda function failed to rotate an AWS Secrets Manager secret for another function.

Short descriptionIf a rotation function calls a second Lambda function to rotate the secret, the rotation fails with a message similar to the following:Pending secret version EXAMPLE1-90ab-cdef-fedc-ba987EXAMPLE for Secret MySecret was not created by Lambda MyRotationFunction. Remove the AWSPENDING staging label and restart rotation.

ResolutionTo resolve this issue, make sure that the code to rotate your secret is contained in a single Lambda function that's set as the rotation function for the secret.

Related informationTroubleshoot AWS Secrets Manager rotation
Question: Why do I still see charges for Amazon S3 after I deleted all the files from my Amazon S3 buckets?

I deleted all the files from my Amazon Simple Storage Service (Amazon S3) buckets, but I still have charges for S3 on my bill.

ResolutionHere are some things you can check to minimize your S3 charges:Disable logging for any S3 buckets before deleting them. Otherwise, logs might be immediately written to your bucket after you delete your bucket's objects.Delete any file versions (backups of S3 objects) in versioning-enabled buckets.Delete empty S3 buckets that you don't need. Some programs (including the AWS Management Console) initiate LIST requests to pull the names of your buckets. These requests are charged at standard rates.Cancel any incomplete multipart upload requests.

Related informationWorking with Amazon S3 bucketsWorking with Amazon S3 objects
Question: Why did my publicly trusted ACM certificate fail managed renewal?

My AWS Certificate Manager (ACM) certificate failed to renew. Why didn't my ACM certificate renew?Short descriptionACM provides managed renewal for your AWS issued SSL/TLS certificates. This means that ACM either renews your certificates automatically if you are using DNS validation, or sends you an email notification when expiration is approaching. ACM tries to validate each domain name included in the certificate. After all domain names associated with the certificate are validated, the ACM certificate is renewed. For more information, see Troubleshooting managed certificate renewal.Managed renewal can fail for email and DNS validated certificates if:The certificate was imported into ACM. Imported certificates aren't renewed automatically.The ACM certificate that's being renewed is not in use—the ACM certificate isn't associated with any of the services integrated with ACM.Renewal for domains validated by email require manual action. ACM begins sending email renewal notices 45 days before expiration using the domain's WHOIS mailbox addresses and to five common administrator addresses. The notifications contain a link that the domain owner can select for renewal. After all listed domains are validated, ACM issues a renewed certificate with the same ARN.Managed renewal for domains validated by DNS can fail if ACM was unable to find the appropriate CNAME record in the DNS database.

ResolutionEmail and DNS validated certificatesBe sure that the ACM certificate is in use with one of the services integrated with ACM.Email validated certificatesFor email-validated certificates, ACM must be able to send to the WHOIS mailbox addresses and the five common administrator addresses for each domain listed in your certificate. After all listed domains are validated, ACM issues a renewed certificate with the same ARN. For more information, see Email validation.DNS validated certificatesUpdate your DNS configuration to include the CNAME records provided by ACM. ACM looks for the CNAME record in the DNS configuration for the domain names included in the DNS-validated certificates.After the certificate is renewed, the Amazon Resource Name (ARN) of the renewed ACM certificate remains the same. Renewed ACM certificates are automatically updated to the integrated, in-use AWS resources.For more information, see Troubleshooting managed certificate renewal.

Related informationACM best practicesHow does the ACM managed renewal process work with email-validated certificates?Check a certificate's renewal status
Question: Why is it taking a long time to replicate Amazon S3 objects using Cross-Region Replication between my buckets?

I'm using Cross-Region Replication between two Amazon Simple Storage Service (Amazon S3) buckets in different AWS Regions. Why is object replication taking longer than I expect?ResolutionCross-Region Replication is an asynchronous process, and the objects are eventually replicated. Most objects replicate within 15 minutes, but sometimes replication can take a couple hours or more. There are several factors that can affect the replication time, including:The size of the objects to replicate.The number of objects to replicate. For example, if Amazon S3 is replicating more than 3,500 objects per second, then there might be some latency while the destination bucket scales up for the request rate.You can check the replication status on the source object. If the object replication status is PENDING, then Amazon S3 hasn't completed the replication.Note: To monitor replication metrics such as the maximum replication time to the destination bucket, you can enable S3 Replication Time Control (S3 RTC).