VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How can I change the encryption key used by my Amazon RDS DB instances and DB snapshots?

I want to update the encryption key used by my Amazon Relational Database Service (Amazon RDS) DB instances and DB snapshots so that they use a new encryption key.

ResolutionYou can't change the encryption key used by an Amazon RDS DB instance. However, you can create a copy of the RDS DB instance, and then choose a new encryption key for that copy.Note: Data in unlogged tables might not be restored using snapshots. For more information, review Best practices for working with PostgreSQL.To create a copy of an RDS DB instance with a new encryption key, do the following:Open the Amazon RDS console.In the navigation pane, choose Databases.Choose the DB instance for which you want to create a manual snapshot.Create a manual snapshot for your DB instance.In the navigation pane, choose Snapshots.Select the manual snapshot that you created.Choose Actions, and then choose Copy Snapshot.Under Encryption, select Enable Encryption.For AWS KMS Key, choose the new encryption key that you want to use.Choose Copy snapshot.Restore the copied snapshot.The new RDS DB instance uses your new encryption key.Confirm that your new database has all necessary data and your application is using the new database. When you no longer need the old RDS DB instance, you can delete the instance.

Related informationEncrypting Amazon RDS resourcesBacking up and restoring an Amazon RDS DB instance
Question: How do I remove non-valid characters from my Amazon Redshift data?

There are non-valid characters in my Amazon Redshift data. How do I remove them?Short descriptionIf your data contains non-printable ASCII characters, such as null, bell, or escape characters, you might have trouble retrieving the data or unloading the data to Amazon Simple Storage Service (Amazon S3). For example, a string that contains a null terminator, such as "abc\0def," is truncated at the null terminator, resulting in incomplete data.

ResolutionUse the TRANSLATE function to remove the non-valid character. In the following example, the data contains "abc\u0000def". The TRANSLATE function removes the null character "\u0000" and replaces it with an empty value, which removes it from the string:admin@testrs=# select a,translate(a,chr(0),'') from invalidstring;   a    | translate --------+----------- abc    | abcdef abcdef | abcdef(2 rows)To remove specified non-valid characters from all rows in a table, run the UPDATE command with the TRANSLATE function, as shown in this example:admin@testrs=# select * from invalidstring;   a    -------- abc abcdef(2 rows)admin@testrs=# update invalidstring set a=translate(a,chr(0),'') where a ilike '%'||chr(0)||'%';UPDATE 1 admin@testrs=# select * from invalidstring;   a    -------- abcdef abcdef(2 rows)

Related informationCHR Function
Question: How can I increase the binlog retention in my Aurora MySQL-CompatibleDB cluster?

I have an Amazon Aurora MySQL-Compatible Edition DB cluster. I want to increase the binlog retention to increase the performance of binlog extraction. How can I do this?Short descriptionYou can increase the availability of your Aurora MySQL-Compatible DB cluster's binlogs by increasing the binlog retention period of the DB cluster.Note: Turning on binlog on your Aurora MySQL-Compatible DB cluster has the following performance effects:Causes additional write overhead (turn it on only when necessary)Increases engine start-up time at reboot because of the binlog recovery processAs a best practice, turn on binary logging in your Aurora MySQL-Compatible DB cluster in the following circumstances:For Aurora cross-Region read replicaFor Aurora manual replication to an external MySQL-compatible databaseNote: Aurora MySQL-Compatible doesn't use binlogs for intra-cluster replication. Aurora MySQL-Compatible global databases don't use binlogs.

ResolutionTurn on binary logging in Aurora MySQL-Compatible DB cluster1.    Open the Amazon Relational Database Service (Amazon RDS) console.2.    In the navigation pane, choose Parameter groups.Note: If you're using the default Aurora DB cluster parameter group, then create a new DB cluster parameter group. For Type, choose DB Cluster Parameter Group.3.    Choose the DB custom cluster parameter group. Then, choose Parameter group actions.4.    Choose Edit.5.    Change the value for the binlog_format parameter. For example: ROW, Statement, or MIXED.6.    Choose Save changes.For more information, see How do I turn on binary logging for my Aurora MySQL-Compatible cluster?Increase the binlog retention in Aurora MySQL-Compatible DB clusterMake sure that the binlog files on your replication source are retained until the changes are applied to the replica.Note: Make sure that you choose a time frame to retain the binlog files before they are deleted. The retention time frame must be long enough to make sure that changes are applied to your replica before they are deleted.To increase the binlog retention of the DB cluster, use the mysql_rds_set_configuration procedure. You can run the following command and sample parameters on the writer instance to retain the binlog files for 7 days:CALL mysql.rds_set_configuration('binlog retention hours', 168);Note: For Aurora MySQL 5.7-compatible, the maximum value for binlog retention hours is 168 (7 days). If you enter a higher value, then 168 is used by default.For other Aurora MySQL compatible versions, the maximum value for binlog retention hours is 2160 (90 days). If you enter a higher value, then 2160 is used by default.

Related informationRetain binary logs on the replication source until they are no longer needed
Question: How do I troubleshoot SSH or RDP connectivity to my EC2 instances launched in a Wavelength Zone?

I can't connect to my Amazon Elastic Compute Cloud (Amazon EC2) instance launched in a Wavelength Zone using SSH or Windows remote desktop protocol (RDP). I can still ping my instance.

Short descriptionThere are restrictions on connecting to an EC2 instance launched in a Wavelength Zone using the public IP address provided by the 5G service provider.In a Wavelength Zone, the carrier gateway turns on the following controls for internet flows by default. You can't remove these controls.TCP is allowed for outbound and response. This means that TCP traffic is allowed only in one direction, from the EC2 instance to the internet.UDP is denied. This includes both inbound and outbound UDP traffic.ICMP is allowed. This means that the carrier gateway allows ICMP inbound and outbound traffic.Pinging an EC2 instance in a Wavelength Zone works with these controls. However, connecting to the instance using SSH or RDP from the internet fails.

ResolutionUnlike public IPs, private IP connectivity works exactly the same way as it does for any other EC2 instance in the Region. To connect to your EC2 instance in a Wavelength Zone, do the following:Launch the bastion host in the same VPC as the Wavelength Zone in the Region.Connect through a bastion host using your instance's private IP address.Note: Public IP connectivity restrictions apply only when connecting to your instances in a Wavelength Zone from internet. Connectivity to instances in a Wavelength Zone works as expected if the following conditions are true:Your security group and Network ACL are set up correctly.The SSH or RDP client is located in the carrier network.UDP traffic also works from within the carrier network.

Related informationQuotas and considerations for Wavelength ZonesHow AWS Wavelength works
Question: How do I provision an Amazon SageMaker Project?

I want to provision an Amazon SageMaker Project, but I don't know how.

ResolutionSageMaker Projects use templates that AWS Service Catalog imports to your AWS account. Creating a domain activates the import when one of the following actions happens:You turn on Amazon SageMaker Project templates and Amazon SageMaker JumpStart for the account.The EnableSagemakerServicecatalogPortfolio API is called for an existing SageMaker Studio domain.You can provision a SageMaker Project directly from a SageMaker Studio domain. You can also create a SageMaker Project through an API or AWS Command Line Interface (AWS CLI). However, you must provide the ProductId and ProvisioningArtifactId.Before you begin, turn on project templates for your SageMaker Studio domain. Also, provide AWS Identity and Access Management (IAM) access to your SageMaker Studio users.Check the Service Catalog status from the Domain Settings tab in the Amazon SageMaker console. You can also invoke the GetSagemakerServicecatalogPortfolioStatus API, or run the following AWS CLI command:$aws sagemaker get-sagemaker-servicecatalog-portfolio-statusNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.If you get Access Denied errors or the projects aren't active, then turn on the project templates and grant the required permissions for users. For more information, see SageMaker Studio permissions required to use projects.After you turn on the projects templates, you must get the ProductID and ProvisioningArtifactID values for the templates to create projects.To get the the product and provisioning artifact IDs, complete the following steps:Open the Service Catalog console.In the navigation pane, under Administration, choose Portfolios.Choose the Imported tab.In the search bar, enter Amazon SageMaker Solutions and MLOps products.Choose Amazon SageMaker Solutions and MLOps products.Review the Products page, and get the Product ID.Select the product or project template that you want to use (example: MLOps template for model building and training).Review the Product list page, and get the Provisioning Artifact ID.Use the project and provisioning artifact IDs in your CreateProject API or the following AWS CLI command:$aws sagemaker create-project --project-name myproject--service-catalog-provisioning-details ProductId="prod-xxxxxx",ProvisioningArtifactId="pa-xxxxxx"
Question: How do I troubleshoot connectivity issues with my Amazon EMR notebook?

I want to troubleshoot connectivity issues with my Amazon EMR notebook.

Short descriptionWhen connecting to your Amazon EMR notebook, you might receive errors similar to the following:Workspace (notebook) is stopped. Internal Error.Workspace (notebook) can now be used in local mode.Notebook is stopped. Service Role does not have the required permissions.Notebook is stopped. Notebook security group sg-xxxxxxxx does not have an egress rule to connect with the master security group sg-yyyyyy. Please fix the security group or use the default option.Notebook is stopped. Notebook security group sg-xxxxxxx should not have any ingress rules. Please fix the security group or use the default option.

ResolutionCheck the service role in the EMR notebooks1.    Validate that the notebook's AWS Identity and Access Management (IAM) role has the minimum required permissions. For more information, see Service role for EMR notebooks.2.    Verify that the notebook has all of the permissions contained in AmazonElasticMapReduceEditorsRole. Use the AWS managed policy S3FullAccessPolicy for full access to Amazon Simple Storage Service (Amazon S3). For more information, see AWS managed policy: Amazon S3FullAccess.3.    Remove any permissions restrictions from the bucket policy attached to the S3 bucket where the notebook is located.Check the security groups in the EMR notebooks1.    Validate that the security group used for your notebook has at least the minimal rules required. For more information, see Specifying EC2 security groups for EMR notebooks.2.    It's a best practice to use different security groups for the EMR cluster and the EMR notebook. The security groups for the notebook and the cluster have different inbound and outbound rule requirements.The notebook security group ElasticMapReduceEditors-Editor has an egress rule that allows connection to the master security group ElasticMapReduceEditors-Livy. This connection uses tcp/18888. Remove any outbound rules added in the notebook security group ElasticMapReduceEditors-Editor routing to 0.0.0.0/0.The master security group ElasticMapReduceEditors-Livy has an ingress rule that allows connection to the notebook security group ElasticMapReduceEditors-Editor. This connection uses tcp/18888. Remove any ingress rules added in the master security group ElasticMapReduceEditors-Livyrouting to 0.0.0.0/0.EMR cluster requirements1.    Verify that the attached cluster is compatible and meets all cluster requirements.2.    When Livy impersonation is turned on, verify that hadoop-httpfs is running on the EMR cluster master node.Use the following command to check the status of hadoop-httpfs:$ sudo systemctl status hadoop-httpfsUse the following command to turn on hadoop-httpfs:$ sudo systemctl start hadoop-httpfs
Question: Why can't I find my DataSync task logs in the CloudWatch log group?

I ran an AWS DataSync task, but I can't find the logs in the relevant Amazon CloudWatch log group. How can I troubleshoot this?ResolutionConfirm that CloudWatch Logs has a resource policy that allows DataSync to upload logs. Follow these steps to review the CloudWatch Logs resource policies in the AWS Region of your DataSync agent:Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.1.    Run the describe-resource-policies command using the AWS Command Line Interface (AWS CLI):aws logs describe-resource-policies --region us-east-1Note: Each AWS account is allowed up to 10 resource policies per Region for CloudWatch Logs. If you exceed this limit, then you receive an error message when creating your resource policy.2.    Review the output of the command. If a resource policy isn't set up, then the output is similar to the following:{  "resourcePolicies": []}Important: Confirm that the resource policy for DataSync is enabled in the correct AWS Region. The policy must be in the same Region as the DataSync agent that you're using.Follow these steps to create a resource policy that grants DataSync permissions for uploading logs:1.    Create a JSON file that grants DataSync the minimum permissions for uploading logs:{  "Statement": [    {      "Sid": "DataSyncLogsToCloudWatchLogs",      "Effect": "Allow",      "Action": [        "logs:PutLogEvents",        "logs:CreateLogStream"      ],      "Principal": {        "Service": "datasync.amazonaws.com"      },      "Resource": "*"    }  ],  "Version": "2012-10-17"}You can name the file policy.json.2.    Run the put-resource-policy command using the AWS CLI to create a resource policy using the JSON file:aws logs put-resource-policy --policy-name trustDataSync --policy-document file://policy.json --region <Region>Important: Set the AWS Region of your DataSync agent as the value for --region.3.    Run the describe-resource-policies command to confirm that the resource policy was created:aws logs describe-resource-policies --region <Region>Note: Each AWS account is allowed up to 10 resource policies per Region for CloudWatch Logs. If you exceed this limit, you receive an error message when creating your resource policy. Use the put-resource-policy command to verify if you've reached the limit.4.    After you create the resource policy, the command output is similar to the following:{  "resourcePolicies": [    {      "policyName": "trustDataSync",      "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Sid\":\"DataSyncLogsToCloudWatchLogs\",\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"datasync.amazonaws.com\"},\"Action\":[\"logs:PutLogEvents\",\"logs:CreateLogStream\"],\"Resource\":\"*\"}]}",      "lastUpdatedTime": 1577448776606    }  ]}5.    To test the resource policy, run a DataSync task. A few minutes after the task runs, confirm that you're seeing the log stream from the relevant CloudWatch log group.

Related informationOverview of managing access permissions to your CloudWatch Logs resources
Question: How do I resolve "403 Error - The request could not be satisfied. Request Blocked" in CloudFront?

Amazon CloudFront is returning the error message "403 Error - The request could not be satisfied. Request Blocked."Short descriptionThe error message "403 Error - The request could not be satisfied. Request Blocked." is an error from the client. This error can occur due to the default actions of AWS WAF rules associated with the CloudFront distribution. The following settings might cause a Request Blocked error:When the default action is set to Allow, the request matches a rule that has Action set to Block.When the default action is set to Block, the request matches the conditions of a rule that has Action set to Block.-or-When the default action is set to Block, the request doesn't match the conditions of any rule that has Action set to Allow.For information on troubleshooting other types of 403 errors, see How do I troubleshoot 403 errors from CloudFront?ResolutionTo resolve the Request Blocked error:Open the CloudFront console.Choose the ID for the distribution that you want to update.Choose the General tab.Under Settings, in the AWS WAF web ACL list, choose the web access control list (web ACL) associated with your distribution.In the AWS WAF console, choose Web ACLs.On the Web ACLs page, for AWS Region, choose Global (CloudFront).Choose the web ACLs that require review. Check that the AWS WAF default action is set on the web ACL.To resolve the Request Blocked error when the default action is Allow, review the requests. Be sure that they don't match the conditions for any AWS WAF rules with Action set to Block.If valid requests match the conditions for a rule that blocks requests, then update the rule to allow the requests.To resolve the Request Blocked error when the default action is Block, review the requests. Be sure that they match the conditions for any AWS WAF rules with  Action set to Allow.If valid requests don't match any existing rules that allow requests, then create a rule that allows the requests.Note: For more troubleshooting, use theAWS WAF console to review a sample of requests that match the rule that might cause the Request Blocked error. For more information, seeTesting and tuning your AWS WAF protections.

Related informationHow do I resolve "403 ERROR - The request could not be satisfied. Bad Request" in Amazon CloudFront?How AWS WAF worksUsing AWS WAF to control access to your content
Question: How do I resolve the AWS CloudFormation error "Unable to assume role and validate the listeners configured on your load balancer" when I launch an Amazon ECS resource?

I get an error message when I use AWS CloudFormation to launch an Amazon Elastic Container Service (Amazon ECS) resource (AWS::ECS::Service).

Short descriptionIf I'm using a Classic Load Balancer, I get an error message similar to this:"12:21:48 UTC+0100 CREATE_FAILED AWS::ECS::Service ECSService Unable to assume role and validate the listeners configured on your load balancer. Please verify the role being passed has the proper permissions."If I'm using an Application Load Balancer, I get an error message similar to this:"12:21:48 UTC+0100 CREATE_FAILED AWS::ECS::Service ECSService Unable to assume role and validate the specified targetGroupArn. Please verify that the ECS service role being passed has the proper permissions."If you create an Amazon ECS service with an independent AWS Identity and Access Management (IAM) policy resource that specifies an instance profile, the Amazon ECS service can fail and return an error message.

ResolutionTo resolve the error for both Classic Load Balancers and Application Load Balancers, try one or more of the following solutions:Confirm that the IAM role for the Amazon ECS service has the right permissions to register and deregister container instances with your load balancers.Tip: You can use this AWS CloudFormation template as a reference to build out your Amazon ECS architecture components with the right dependencies. The architecture components include an Amazon ECS cluster, service, load balancers, container instances, and IAM resources.Confirm that your AWS Auto Scaling group or Amazon ECS container instance has an instance profile associated as an attribute.Use the DependsOn attribute to specify the dependency of the AWS::ECS::Service resource on AWS::IAM::Policy. Or, use a custom resource to delay the stack creation process and give service role permissions time to propagate.
Question: How do I resolve problems when accessing a service in the AWS Management Console?

I'm unable to access a service from the AWS Management Console.

Short descriptionYou might receive one of the following error messages:You are not subscribed to this serviceThe AWS Access Key Id needs a subscription for the serviceYour service sign-up is almost complete!ResolutionResolve "You are not subscribed to this service" or "The AWS Access Key Id needs a subscription for the service" errorsWhen you created your AWS account, all available services at that time were activated. However, as new services are released, they aren't automatically put into an active state without your permission. You must subscribe to each service individually as they are released.To activate all existing services and new services as they are released, you must sign in as the AWS account root user. Then, in your account settings page, update your account subscription.Resolve "Your service sign-up is almost complete!" errorsFinish the account sign-up process.You might need to provide a valid payment method, verify your account, or choose a support plan.

Related informationCreating your first IAM admin user and groupManaging your AWS payment methods
Question: How do I avoid throttling when I call PutMetricData in the CloudWatch API?

I receive the error "400 ThrottlingException" for PutMetricData API calls in Amazon CloudWatch.

Short descriptionWhen you receive the error "400 ThrottlingException" for PutMetricData API calls in CloudWatch, you also receive the following message:<ErrorResponse xmlns="http://monitoring.amazonaws.com/doc/2010-08-01/">  <Error>    <Type>Sender</Type>    <Code>Throttling</Code>    <Message>Rate exceeded</Message>  </Error>  <RequestId>2f85f68d-980b-11e7-a296-21716fd2d2e3</RequestId></ErrorResponse>To help service performance, CloudWatch throttles requests for each AWS account based on the AWS Region. For current PutMetricData API request quotas, see CloudWatch service quotas.Note: All calls to the PutMetricData API in a Region count towards the maximum allowed request rate. This number includes calls from any custom or third-party application. Examples of such applications include the CloudWatch Agent, the AWS Command Line Interface (AWS CLI), and the AWS Management Console.

ResolutionIt's a best practice to use the following methods to reduce your call rate and avoid API throttling:Distribute your API calls evenly over time rather than making several API calls in a short time period. If you require data to be available with a 1-minute resolution, then you have an entire minute to emit that metric. Use jitter (randomized delay) to send data points at various times.Combine as many metrics as possible into a single API call. For example, a single PutMetricData call can include 1,000 metrics and 150 data points. You can also use pre-aggregated data sets, such as StatisticSet, to publish aggregated data points. This reduces the number of PutMetricData calls per second.Retry your call with exponential backoff and jitter.

Related informationCloudWatch API reference