VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I troubleshoot 503 (service unavailable) errors from my Application Load Balancer?

I get an HTTP 503 (Service unavailable) error when using an Application Load Balancer (ALB). How can I resolve this error?Short descriptionTo determine if the Application Load Balancer is generating the 503 errors, do one of the following:Access your CloudWatch metrics and locate a metric labeled HTTPCode_ELB_503_Count.Run this CURL command. If the response contains "503 Service Temporarily Unavailable," then the error is coming from the Application Load Balancer.Be sure to replace MY_URL with the URL used to access the Application Load Balancer:$ curl -IkL MY_URLCheck your Application Load Balancer access logs. Confirm that there is an elb_status_code = 503 in the logs.If you see 503 errors in any of these places, the error is generated by your Application Load Balancer. Use the following troubleshooting steps to resolve the error.

ResolutionVerify that the target group has registered targetsVerify using the EC2 ConsoleAccess the Amazon EC2 console.On the navigation pane, under Load Balancing, choose Target Groups.Choose the name of the target group to open its details page.Choose the Targets tab.Check to see if there are targets listed. If they are listed, then they are registered.Verify using the AWS CLINote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.To verify targets using the AWS CLI, use the describe-target-health command.Register targetsIf you don't see any registered targets, register them through the console or through the AWS CLI.Verify that the target group is associated with an Auto Scaling Group (if you're using Auto Scaling)If your Target Group is part of an Auto Scaling Group, then confirm that the two are associated correctly. If they aren't, attach the groups.Verify using the EC2 console:Open the Amazon EC2 console.On the navigation pane, under Auto Scaling, choose Auto Scaling Groups.Choose the Auto Scaling group that you want to verify.Under Load balancing, confirm that the Target Group of the Application Load Balancer is associated with the Auto Scaling Group.Verify using the AWS CLIRun the describe-auto-scaling command. Be sure to replace MY-ASG with the name of your Auto Scaling group. Replace AWS-REGION with your specific AWS Region.$ aws autoscaling describe-auto-scaling-groups --auto-scaling-group-name MY-ASG --region AWS-REGIONIn the command output, confirm that the target group is listed under TargetGroupARNs.Attach the target groupIf the target groups aren't attached to the Auto Scaling group, associate the groups through the console or through the CLI.Check target healthAfter you confirm that your targets are registered, confirm they are in a healthy state. For more information, seeHow do I troubleshoot and fix failing health checks for Application Load Balancers?Related informationDeregisterTargetsAttachLoadBalancerTargetGroups
Question: Why is my DKIM domain failing to verify on Amazon SES?

My DomainKeys Identified Mail (DKIM) domain is failing to verify on Amazon Simple Email Service (Amazon SES). My DNS records for Easy DKIM were created successfully, but my DKIM status is pending or failed after 72 hours. How can I fix this?ResolutionWhen you set up Easy DKIM for a domain on Amazon SES, your generated CNAME records must be added to your domain's DNS records and be publicly accessible.To verify that each CNAME is publicly accessible and shows the correct record value, run a DNS test on each of the CNAME records generated by Amazon SES. On a Linux operating system, run the dig command, similar to the following:dig CNAME +short hirjd4exampled5477y22yd23ettobiho._domainkey.example.comOn a Windows operating system, run the nslookup command, similar to the following:nslookup -q=CNAME hirjd4exampled5477y22yd23ettobiho._domainkey.example.comIf the CNAME is configured correctly on your domain's DNS records, then the command output returns the record value followed by.dkim.amazonses.com:hirjd4exampled5477y22yd23ettobiho.dkim.amazonses.comIf the command output is empty, then verify the following:1.    Check the DNS settings for your domain.2.    Confirm that the CNAME record names and values match the DKIM names and values generated by Amazon SES.3.    Confirm that all the CNAME record names are entered correctly on your domain's DNS settings.4.    When you check the record names, be sure to confirm that the domain isn't duplicated. Some DNS providers automatically append the domain to the record name. For example, if you enter hirjd4exampled5477y22yd23ettobiho._domainkey.example.com, some DNS providers might append example.com to the record name, which changes the record name to hirjd4exampled5477y22yd23ettobiho._domainkey**.example.com.example.com**. This causes your DKIM verification to fail.If you don't see results when you use dig or nslookup against hirjd4exampled5477y22yd23ettobiho._domainkey.example.com, then run the check against hirjd4exampled5477y22yd23ettobiho._domainkey**.example.com.example.com** where the domain name is provided twice.If you get a result when you run a check against hirjd4exampled5477y22yd23ettobiho._domainkey .example.com.example.com, then you must correct the record name with your DNS registrar. Contact your DNS provider for the specific requirements for entering the record name:As one example, you might correct your record name by re-entering it with a period at the end:hirjd4exampled5477y22yd23ettobiho._domainkey.example.com.As another example, you might correct your record name by re-entering it without the domain name:hirjd4exampled5477y22yd23ettobiho._domainkeyNote: Some DNS registrars don't support underscores (_) in the record name. If your DNS registrar doesn't support underscores, you must contact your registrar's support for assistance, because DKIM records with underscores are required.After you verify that your CNAME records are correct, you can retry verification using the Amazon SES console.Note: Amazon SES usually detects changes to your DNS configuration within 72 hours of the change.
Question: How do I set up end-to-end HTTPS connectivity with AWS PrivateLink?

I need end-to-end HTTPS connectivity between clients in a consumer VPC to applications running behind the Network Load Balancer in a service provider VPC. How can I do this using AWS PrivateLink?ResolutionCreate a self-signed X509 certificate for your application with OpenSSL. Then, install it on the required Amazon Elastic Compute Cloud (Amazon EC2) instances.Note: This certificate is used only between the Elastic Load Balancer and target EC2 instances. It's a best practice to use a trusted Certificate Authority to sign a certificate. It's a best practice to use self-signed certificates only in a test environment or for encryption between an Elastic Load Balancer and Amazon EC2 targets. The load balancer does not validate these certificates. Traffic between the ELB and the targets is authenticated at the packet level.Create a TLS target group for your Network Load Balancer. Then, register the EC2 instances as targets. The load balancer automatically uses the self-signed certificate installed on the targets to encrypt the backend traffic.Request a public certificate for your domain name using AWS Certificate Manager (ACM). This certificate is used between the load balancer and clients.Important: Verify that the domain name that you specify matches the domain name of your website. If this entry doesn't match the domain name that users see when they visit your site (for example, www.example.com), they might receive a certificate error.Create a TLS listener for your Network Load Balancer. During the configuration, select the SSL certificate that you created in step 3.Create an Amazon VPC interface endpoint for the endpoint service connected to the Network Load Balancer.Configure Amazon Route 53 to route traffic to the Amazon VPC interface endpoint. Use the domain name specified in step 3 for the record name.

Related informationWhy can't I connect to an endpoint service from my interface endpoint in an Amazon VPC?
Question: Why is my Amazon EC2 Spot Instance request in a pending status?

My Amazon Elastic Compute Cloud (Amazon EC2) Spot Instance request is still in a pending status. Why is this?ResolutionA Spot Instance moves through two pending statuses before it launches: pending-evaluation and pending-fulfillment.Pending-evaluation statusA Spot request goes into the pending-evaluation state immediately after you create it. While in this state, Amazon EC2 evaluates the parameters of the request. For details on why a Spot request might stay in the pending-evaluation state, see Lifecycle of a Spot request.Pending-fulfillment statusAfter Spot request parameters are met (capacity becomes available, for example), the request goes into the pending-fulfillment state. In this state, Amazon EC2 is working to provision the Spot Instances. A Spot request might stay in the pending-fulfillment state for the following reasons:Internal issues within the AWS infrastructure.You canceled the request before Amazon EC2 launched the Spot Instance.You chose an instance type that supports enhanced networking, but you didn't turn on Elastic Network Adapter (ENA) for your Amazon Machine Image (AMI). For more information, including instructions on how to turn on enhanced networking, see Enhanced networking performance.

Related informationWork with Spot Instances
Question: How can I connect to API Gateway from my on-premises network?

I want to connect to Amazon API Gateway from my on-premises network. How can I do this?Short descriptionAPI Gateway API types include REST APIs (edge-optimized and Regional API endpoints), HTTP APIs, WebSocket APIs, and private REST APIs. REST APIs, HTTP APIs, and WebSocket APIs can be connected from on-premises networks directly. Private REST APIs can only be accessed from within an Amazon Virtual Private Cloud (Amazon VPC) using an interface VPC endpoint.

ResolutionBefore you begin, verify that your on-premises network:has connectivity to the internet.firewall allows bidirectional traffic to and from the API Gateway endpoint.Connect an on-premises network to a REST API, HTTP API, or WebSocket APIUse invoke to connect your on-premises network to API Gateway depending on the API type.For REST APIs, see Invoking a REST API in Amazon API Gateway.For HTTP APIs, see Publishing HTTP APIs for customers to invoke.For WebSocket APIs, see Use wscat to connect to a WebSocket API and send messages to it.Connect an on-premises network to a private REST APIPrivate REST APIs can be accessed from within an Amazon VPC using an interface VPC endpoint. Use the following access methods depending on your configuration.Note:The security group for the interface endpoint must allow inbound traffic from your on-premises source CIDR range on TCP port 443.The private API resource policy must be updated to allow private API traffic from the source VPC or VPC endpoint.AWS Direct ConnectYou can use Direct Connect to connect your on-premises network to Amazon VPC and access your private API using pubic DNS names. For more information, see Accessing your private API using Direct Connect.Amazon Route 53 aliasFollow the steps to associate an Amazon VPC endpoint with a private REST API.API Gateway then generates a new Route 53 ALIAS DNS record. You can use this record to invoke your private API in the following URL format:https://{rest-api-id}-{vpce-id}.execute-api.{region}.amazonaws.com/{stage}For more information, see Accessing your private API using a Route 53 alias.Private DNS namesIf you are using private DNS, you can access your private API from your on-premises network using the private DNS names. You must set up a Route 53 Resolver inbound endpoint, and then forward to it all DNS queries of the private DNS from your on-premises network. For more information, see Invoking your private API using private DNS names.Public DNS namesYou can access your private API from your on-premises network using endpoint-specific DNS hostnames. The public DNS hostnames contain the VPC endpoint ID or API ID for your private API in the following URL format:https://{public-dns-hostname}.execute-api.{region}.vpce.amazonaws.com/{stage}For more information, see Invoking your private API using endpoint-specific public DNS hostnames.

Related informationHow do I access a private API Gateway API when the VPC endpoint uses an on-premises DNS?
Question: How can I resolve issues exporting Amazon Aurora snapshots to Amazon S3?

I get an error when I try to export a snapshot from my Amazon Aurora MySQL-Compatible Edition instance to Amazon Simple Storage Service (Amazon S3).

Short descriptionThe Aurora DB cluster snapshot data export to Amazon S3 can fail for the following reasons:The AWS Identity Access Management (IAM) role and policy are incorrectly configured.The IAM role doesn't exist.The AWS Key Management Service (AWS KMS) key check failed.The export task is stuck in the STARTING status.

ResolutionInitial troubleshooting steps1.    Check that the IAM role that's associated with your DB instance has the required policy assigned:"s3:PutObject*",                "s3:ListBucket",                "s3:GetObject*",                "s3:DeleteObject*",                "s3:GetBucketLocation"2.    Check that you've configured the required privileges for using AWS KMS:"kms:Encrypt",        "kms:Decrypt",        "kms:ReEncrypt*",        "kms:GenerateDataKey*",        "kms:CreateGrant",        "kms:DescribeKey",        "kms:RetireGrant"3.    When exporting your snapshot, you might receive an error message similar to the following:The principal export.rds.amazonaws.com isn't allowed to assume the IAM role arn:aws:iam::160966736689:role/rds-s3-export-role or the IAM role arn:aws:iam::123456789:role/rds-s3-export-role doesn't exist.This error occurs when your DB instance tries to assume the IAM role, but fails. Make sure that the trust relationship in the IAM policy specifies export.rds.amazonaws.com instead of rds.amazonaws.com. See the following example:{  "Version": "2012-10-17",  "Statement": [  {    "Effect": "Allow",    "Principal": {    "Service": "export.rds.amazonaws.com"    },    "Action": "sts:AssumeRole",    "Condition": {}  }  ]}Export task is stuck in "STARTING" statusWhen you export an Aurora MySQL-Compatible DB snapshot to Amazon S3, the export task can take longer than usual. The time it takes to export a snapshot depends on the database size and type. The export task restores and scales the entire database before it extracts the data to Amazon S3. During this stage, your export task displays the Starting status. When the task begins to export the data to Amazon S3, the status changes to In progress. If the export task is successful, then the status indicates that the task is Complete. If there are issues with your export task process, the status indicates that the task Failed.For more information, review the limitations when exporting the Aurora MySQL to Amazon S3. For further troubleshooting steps, see the Aurora export documentation.

Related informationViewing cluster status and recommendations
Question: How do I allow outbound dialing to specific countries in my Amazon Connect instance?

I want to allow outbound calls from my Amazon Connect instance to specific countries.

ResolutionTo make outbound calls to new and existing destinations (countries) in your Amazon Connect instance, you must add countries to the allow list. Adding countries to the allow list makes sure that you can call those destinations in your Contact Control Panel (CCP) for your Amazon Connect instance.Important: Amazon Web Services (AWS) can't activate all calling destinations because there are destinations that are high-cost and high-risk for fraudulent activity. For a list of available outbound call destination countries, see Amazon Connect pricing.Identify the list of countries to add to the allow listFirst, collect the following information to create your country allow list:Find your Amazon Connect instance ID/ARN.List the names of the countries to activate outbound dialing to. For the countries available to call by default and their prefixes, see Countries you can call by default.Get the corresponding country names, country code, and ISO code (two-letter code combination) that you're requesting for outbound dialing. For example, to activate outbound dialing to Austria for your Amazon Connect instance, use Austria (country name), +43 (country code), and AT (ISO code).Note: For a list of country codes, see the Country Code website.Then, create a support case to request outbound calls to your country allow list.
Question: How do I restrict direct traffic to an ALB and allow traffic through only CloudFront using AWS WAF?

I want to restrict users from directly accessing an Application Load Balancer (ALB) and allow access through only Amazon CloudFront using AWS WAF. How do I do this using AWS WAF?ResolutionTo restrict direct traffic to an ALB and allow traffic through only CloudFront using AWS WAF, do the following:Configure CloudFront to add a custom HTTP header with a secret value in the requests that CloudFront sends to the ALB.Create a rule in your AWS WAF web ACL associated with the ALB to block requests that don't contain the custom HTTP header secret value.Configure CloudFront to add a custom HTTP header with a secret value in the requests that it sends to the ALBOpen the Amazon CloudFront console.From the navigation pane, choose Distributions.Select the ID of your distribution.Choose Origins.Select your ALB origin, and then choose Edit.Note: If you don't have an ALB origin, see Creating a distribution or Updating a distribution.For Add custom header, add the Header name and Value. An example Header name is Custom-header and Value is Random-12345.Important: Consider the Header name and Value as secure credentials, like a user name and password.Choose Save changes.Create a rule in your AWS WAF web ACL associated with the ALB to block the requests that don't contain the custom HTTP header secret valueNote: If you don't have an existing web ACL associated with your ALB, then follow the steps in Create an AWS WAF web ACL. If you have an existing web ACL associated to your ALB, then proceed to Create a rule.Create an AWS WAF web ACLOpen the AWS WAF console.In the navigation pane, under AWS WAF, choose Web ACLs.For Region, select the AWS Region where your ALB is located.Choose Create web ACL, and then enter a Name.For Associated AWS resources, associate your ALB, then choose Next.For Default web ACL action for requests that don't match any rules, choose Allow, and then choose Next.For Request sampling options, choose Enable sampled requests, and then choose Next.Review the web ACL configuration. If it matches your specifications, choose Create web ACL.Create a ruleOpen the AWS WAF console.In the navigation pane, under AWS WAF, choose Web ACLs.For Region, select the AWS Region where your ALB is located.Select the web ACL you have associated your ALB to.Choose Rules, then choose Add Rules, Add my own rules and rule groups.For Name, enter a rule name, and then choose Regular Rule.For If a request, choose doesn't match the statement (NOT).On Statement 1:For Inspect, choose Single Header.For Header field name, enter the name of the Header name created in CloudFront. For example, Custom-header.For Match type, choose Exactly matches string.For String to match, enter the Value created in CloudFront. For example, Random-12345.For Text transformation, choose None.For Action, choose Block.Choose Save rule.For Set rule priority, if you have multiple rules, then set this rule to the highest priority.Choose Save.

Related informationAdding custom headers to origin requestsAWS WAF Rules
Question: What do I do if I can't find the device specific VPN configuration file for my vendor?

I created an AWS Site-to-Site VPN connection and need to download the configuration information to configure my customer gateway device, but I can't find the specific configuration file for my device.

Short descriptionThe following example configuration files are available for some devices tested by AWS. If the configuration file isn't available for your device to download, use the generic configuration file.The generic configuration file includes all the information that's required to set up your customer gateway configuration including:Pre-shared keyAWS VPN Endpoint IP addressIKE and IPsec settingsAdvanced settings (fragmentation, TCP MSS, and so on)Tunnel interface configurationNote: The tunnel interface configuration details aren't required for customer gateways that use a policy-based configuration.

ResolutionFollow the instructions to download the generic configuration file. Then, use the configuration file to configure your customer gateway device. For more information, see Your customer gateway device.

Related informationHow AWS Site-to-Site VPN worksHow do I configure my Site-to-Site VPN connection to prefer tunnel A over tunnel B?How do I create a certificate-based VPN using AWS Site-to-Site VPN?How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?
Question: How can I get environment properties to show up in my Elastic Beanstalk environment when I log in to an Amazon EC2 instance for Amazon Linux?

I set environment properties for my AWS Elastic Beanstalk environment. I don't see these properties when I log in to an Amazon Elastic Compute Cloud (Amazon EC2) instance in my Elastic Beanstalk environment and then run the command to list the environment variables in the shell.

Short descriptionEnvironment properties aren't automatically exported to the shell (except for in stacks running PHP), even though they are present in the instance. Instead, environment properties are made available to the application through the stack that it runs in, based on the platform that you're using. To view and set environment properties, you can use the Elastic Beanstalk console or the eb setenv command in the Elastic Beanstalk Command Line Interface (EB CLI).The Resolution section shows you how to set the source for environment properties in several platforms. For information on additional platform-specific options, see Environment properties and other software settings. For information on how to access environment properties outside your code, see Platform script tools.

ResolutionImportant: The following resolutions apply only to Amazon Linux Amazon Machine Images (AMIs). For Amazon Linux 2 instances, see How do I use environment variables from an Elastic Beanstalk instance shell?PythonEnvironment properties are written to the /opt/python/current/env file, which is sourced into the virtualenv stack where the application runs. For more information, see Using the Elastic Beanstalk Python platform.To set the source, log in to the instance, and then run the following command:~$ source /opt/python/current/envRubyEnvironment properties are first written to a JSON file (/opt/elasticbeanstalk/deploy/configuration/containerconfiguration) that contains all the stack configuration information. If the predeployment hook at /opt/elasticbeanstalk/hooks/configdeploy/pre/10_setup_envvars.sh is triggered, then the opt/elasticbeanstalk/support/envvars file is populated with all the environment properties. The opt/elasticbeanstalk/support/envvars file is then sourced by the stack to make the environment variables available to the application. For more information, see Using the Elastic Beanstalk Ruby platform.To set the source, log in to the instance, and then run the following command:source /opt/elasticbeanstalk/support/envvarsJavaEnvironment properties that you set at launch don't become shell environment variables. For more information, see Configuring your Java SE environment.WindowsEnvironment properties are passed from C:\Program Files\Amazon\ElasticBeanstalk\config\containerconfiguration to the Microsoft Internet Information Services (IIS) server.