VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why does my IAM credential report show my AWS Config managed rules as not compliant?

My AWS managed config rules aren't compliant when I used the API to turn on multi-factor authentication (MFA) for my AWS Identity and Access Management (IAM) users or rotated IAM access keys.

Short descriptionThe AWS managed config rules mfa-enabled-for-iam-console-access,  iam-user-mfa-enabled,  access-keys-rotated, and  iam-user-unused-credentials-checkaren't compliant after invoking the API GenerateCredentialReport. This is because these rules rely on the credential report generated by the API.When a GenerateCredentialReport call is invoked, IAM checks if there is an existing report. If the report was generated within the past four hours, the API call will use the most recent report rather than generating a new report. If the most recent report is older than four hours or there are no previous reports, the GenerateCredentialReport API generates a new report. For more information, see Getting credential reports for your AWS account.

ResolutionChange the MaximumExecutionFrequency parameter to more than 4 hours. MaximumExecutionFrequency indicates the maximum frequency with which AWS Config runs evaluations for an AWS Managed Periodic rule.Open the AWS Config console, and then choose Rules.In Rule name, select your AWS Config rule, and then choose Edit.In Trigger, select the Frequency dropdown menu, and choose 6, 12, or 24 hours.Choose Save.To update the rule trigger frequency using the AWS Command Line Interface (AWS CLI), run the put-config-rule command.

Related informationConfigRuleGetCredentialReport
Question: Why does the AWS Glue crawler classify my fixed-width data file as UNKNOWN when I use a built-in classifier to parse the file?

When I parse a fixed-width .dat file with a built-in classifier, my AWS Glue crawler classifies the file as UNKNOWN.

Short descriptionBuilt-in classifiers can't parse fixed-width data files. Use a grok custom classifier instead.

ResolutionCreate the grok custom classifier1.    Open the AWS Glue console.2.    In the navigation pane, choose Classifiers.3.    Choose Add classifier, and then enter the following:For Classifier name, enter a unique name.For Classifier type, choose Grok.For Classification, enter a description of the format or type of data that is classified, such as "special-logs."For Grok pattern, enter the built-in patterns that you want AWS Glue to use to find matches in your data. To parse a .dat file, no delimiter is required between fields. Because each field has a known length, you can use a regex pattern to find matches.Example:(?<col0>.{7})(?<col1>.{8})(?<col2>.{14})(?<col3>.{52})(Optional) For Custom patterns, enter any custom patterns that you want to use. These patterns are referenced by the grok pattern that classifies your data. Each custom pattern must be on a separate line. For more information, see Custom classifier values in AWS Glue.4.    Choose Create.Create and run the crawler1.    In the navigation pane, choose Crawlers.2.    Choose Add crawler.3.    For Crawler name, enter a unique name.4.    Choose the arrow next to the Tags, description, security configuration, and classifiers (optional) section, and then find the Custom classifiers section.5.    Choose Add next to the customer classifier that you created earlier, and then choose Next.6.    On the Specify crawler source type page, choose Data stores, and then choose Next.7.    On the Add a data store page, enter the following:For Choose data store, choose your preferred data store.For Include path, enter the path to your .dat file.8.    Choose Next,and then confirm whether or not you want to add another data store.9.    On the Choose an IAM role page, select an existing AWS Identity and Access Management (IAM) role or create a new one. Choose Next.10.    For Frequency, choose Run on demand, and then choose Next.11.    On the Configure the crawler's output page, for Database, choose the database that you want the table to be created in. Choose Next.12.    Choose Finish to create the crawler.13.    When the crawler status changes to Ready, select the crawler name, and then choose Run crawler.14.    Wait for the crawler to finish, and then choose Tables in the navigation pane. The Classification must match the classification that you entered for the grok custom classifier (for example, "special-logs").

Related informationWorking with classifiers on the AWS Glue ConsoleWriting grok custom classifiersAdding classifiers to a crawler
Question: How do I get a Lambda function in a VPC to access Systems Manager Parameter Store?

I have an AWS Lambda function in an Amazon Virtual Private Cloud (Amazon VPC). I want to connect the function to AWS Systems Manager Parameter Store, but I can't establish the connection. Why can't my function access Parameter Store, and how do I configure the function so that it can?Short descriptionLambda functions within an Amazon VPC don't have internet access. The network interfaces that Lambda creates within an Amazon VPC have private IP addresses, and can't use an internet gateway to gain internet access. This configuration blocks the function from accessing other AWS resources outside of the Amazon VPC, such as Parameter Store.Note: It's a best practice to not put your Lambda function in an Amazon VPC unless the function must access other resources in the VPC.

ResolutionTo allow a Lambda function that's in an Amazon VPC to access Parameter Store, do one of the following:Give your function internet access.Set up an interface endpoint in your Amazon VPC that allows your function to access Systems Manager.Note: AWS PrivateLink VPC endpoints rely on DNS. If you use AWS PrivateLink, make sure that you configure the DHCP options for your Amazon VPC so that DNS is set up for it. For more information, see Using DNS with your VPC.

Related informationConfiguring a Lambda function to access resources in an Amazon VPCVPC endpoints
Question: What information should I include in my AWS Support case?

I have a Developer or Business Support plan, and I’m opening a technical support case to get help from AWS Support.

ResolutionAll the following information can be helpful to AWS Support engineers attempting to diagnose the issue:A description of your use case. What is the intended behavior for this resource / application / project?The environment in which you’re observing the issue. Is this your production, staging, development, or test environment? Who is the intended audience for this content / application?Region. Include information on Regions from which you launched or are attempting to launch your resources.Resource IDs of the affected resources. Include Amazon Elastic Compute Cloud (Amazon EC2) instance IDs, Amazon Simple Storage Service (Amazon S3) object and bucket names, Amazon CloudFront distribution IDs, API request IDs, and so on.Dates / times when you experienced the issue, and how long the issue persisted. Be sure to include your time zone.Log files from the approximate time the issue occurred. You can attach these directly to your case.Any error messages that you’re receiving.The steps you took, or the steps a Support engineer might take, to reproduce the issue.For networking and DNS issues, the outputs of tcptraceroute / TCP MTR / telnet / netcat / curl / dig / nslookup commands.

Related informationAWS Support CenterAWS Support
Question: How can I troubleshoot when I'm unable to initiate a remote PowerShell session with FSx for Windows File Server over an external trust?

I want to configure shadow copies on Amazon FSx for Windows File Server. However, I'm unable to do so because I get the following error while I set up a remote PowerShell session:"enter-pssession : Connecting to remote server <FSx_DNS_Name> failed with the following error message : WinRM cannot process the request. The following error occurred while using Kerberos authentication: Cannot find the computer <FSx_DNS_Name>. Verify that the computer exists on the network and that the name provided is spelled correctly. For more information, see the about_Remote_Troubleshooting Help topic."ResolutionFirst, confirm that your configuration meets the following prerequisites:You must create a trust relationship between the on-premises Microsoft Active Directory and AWS Directory Service for Microsoft Active Directory.Note: At minimum, you must have two one-way trust relationships. One one-way trust relationship must be an outgoing trust from the AWS Managed Microsoft AD where your Amazon FSx computer objects are. The other one-way trust relationship must be an incoming trust on the on-premises Microsoft AD.You must have an on-premises AD user that is part of the Amazon FSx administrators group in the AWS Managed Microsoft AD directory.Your Amazon FSx security group must have rules that allow traffic to and from the IP addresses or security group IDs associated with the client that you want to manage Amazon FSx and enable shadow copies from. The Amazon FSx security group must allow this inbound and outbound traffic on the following ports:TCP/UDP 445 (SMB)TCP 135 (RPC)TCP/UDP 1024-65535 (Ephemeral ports for RPC)If your configuration meets the prerequisites, but you're still getting the "Kerberos authentication: Cannot find the computer" error, then the error might be related to the Microsoft external trust. For Kerberos authentication to work with Microsoft external trust, the application building the service principal names (SPNs) must build three-part SPNs. The enter-pssession cmdlet requests only a two-part SPN, so the request fails. If you run a network trace while you run the PowerShell cmdlet, then the request returns an error message similar to "Kerberos: KRB_ERROR - KDC_ERR_S_PRINCIPAL_UNKNOWN."To resolve this error and enable Kerberos authentication over a Microsoft external trust, configure Kerberos Forest Search Order (KFSO) for the Kerberos client in the on-premises AD domain. In the Use forest search order window, for Forests to Search, add the domain names for your self-managed AD and the AWS Managed Microsoft AD. Add the domain names in the following format and order:selfmanaged.example.com;awsmanaged.example.comAfter you apply these settings on the machine that you use to maintain Amazon FSx, you can proceed with enabling shadow copies for Amazon FSx.

Related informationUsing DNS names with Kerberos authentication
Question: How do I troubleshoot latency with my Amazon SageMaker endpoint?

When I invoke my Amazon SageMaker endpoint, I experience high latency.

Short descriptionUse Amazon CloudWatch to monitor the latency metrics ModelLatency and OverheadLatency for a SageMaker endpoint that serves a single model.ModelLatency is the amount of time that a model takes to respond to an inference request, as viewed by SageMaker. This duration includes the local communication time for the model to send the request and fetch the response. It also includes the completion time of the inference inside the model container.OverheadLatency is the amount of time that SageMaker takes to respond to an invocation request with overheads. This measurement lasts from when SageMaker receives a request until it returns a response, minus ModelLatency.When you use a SageMaker multi-model endpoint, the following additional metrics are available in CloudWatch:ModelLoadingWaitTime: The amount of time that an invocation request waits for the target model to download or load, before performing inference.ModelDownloadingTime: The amount of time to download the model from Amazon Simple Storage Service (Amazon S3).ModelLoadingTime: The amount of time to load the model from the container.ModelCacheHit: The number of InvokeEndpoint requests that are sent to the endpoint where the model previously loaded.Multi-model endpoints load and unload models throughout their lifetime. You can use the LoadedModelCount CloudWatch metric to view the number of loaded models for an endpoint.

ResolutionHigh ModelLatencyTo reduce this latency, take any of the following actions:Benchmark the model outside of a SageMaker endpoint to test performance.If SageMaker Neo supports your model, then you can compile the model. SageMaker Neo optimizes models to run up to twice as fast with less than a tenth of the memory footprint with no loss in accuracy.If AWS Inferentia supports your model, then you can compile the model for Inferentia. This offers up to three times higher throughput and up to 45% lower cost per inference compared to the AWS GPU-based instances.If you use a CPU instance and the model supports GPU acceleration, then use a GPU instance to add GPU acceleration to an instance.Note: The inference code might affect the model latency depending on how the code handles the inference. Any delays in code increase the latency.An overused endpoint might cause higher model latency. To dynamically increase and decrease the number of instances that are available for an endpoint, add auto scaling to an endpoint.High OverheadLatencyMultiple factors might contribute to OverheadLatency. These factors include the payload size for request and responses, request frequency, and the authentication or authorization of the request.The first invocation for an endpoint might have an increase in latency because of a cold start. This is expected with the first invocation requests. To avoid this issue, send test requests to the endpoint to pre-warm it. Note that infrequent requests might also lead to an increase in OverheadLatency.
Question: How do I export an ElastiCache for Redis backup to S3?

How do I export my Amazon ElastiCache for Redis backup to Amazon Simple Storage Service (Amazon S3)?Short descriptionTo copy an ElastiCache snapshot (rdb file) to an S3 bucket, first make sure that the bucket is in the same Region as the ElastiCache cluster. Then, you need to set a bucket policy and Identity and Access Management (IAM) permissions so that ElastiCache and IAM users can access the bucket. Amazon ElastiCache requires permission in the bucket policy to access the S3 bucket and copy the .rdb file. Additionally, the users' IAM permissions must be set to access the object (.rdb file) in the S3 bucket.PrerequisitesComplete the following steps before you export your backup:Create or identify an Amazon S3 bucket within the same Region as ElastiCache cluster.Grant Amazon ElastiCache service access to S3.Allow the IAM user permission to copy and paste to the bucket.

ResolutionComplete the prerequisitesStep 1: Create or identify an Amazon S3 bucket to export to within the same Region as the ElastiCache cluster.Step 2: Grant Amazon ElastiCache access to the S3 bucket.1.    Open the Amazon S3 console.2.    Choose the name of the Amazon S3 bucket that you want to copy the backup to.3.    Choose the Permissions tab.4.    Scroll down on the Permissions page, select Access control list (ACL), and then select Edit.Add grantee Canonical Id: 540804c33a284a299d2547575ce1010f2312ef3da9b3a053c8bc45bf233e43535.    Select the following options listed:Objects: List, WriteBucket ACL: Read, Write5.    Choose Save.Note: GovCloud Regions use a different ID:Canonical Id: 40fa568277ad703bd160f66ae4f83fc9dfdfd06c2f1b5060ca22442ac3ef8be6Step 3: Make sure that the user responsible for exporting the backup has the correct permissions to interact with the bucket.The following is an example policy that provides the correct permissions:{  "Version": "2012-10-17",  "Statement": [{    "Effect": "Allow",    "Action": [      "s3:GetBucketLocation",      "s3:ListAllMyBuckets",      "s3:PutObject",      "s3:GetObject",      "s3:DeleteObject",      "s3:ListBucket"    ],    "Resource": "arn:aws:s3:::*"  }]}After you complete these preceding prerequisites, follow the steps in the following Export an ElastiCache for Redis backup to S3 section.Export an ElastiCache for Redis backup to S31.    Open the ElastiCache console.2.    In the left navigation pane select Backups.3.    From the list of backups, choose the box to the left of the name of the backup that you want to export.4.    Choose Copy.5.    Enter a name for your backup in New backup name. Amazon ElastiCache adds an instance identifier and .rdb to the value that you enter here. For example, if you enter my-exported-backup, Amazon ElastiCache creates my-exported-backup-0001.rdb.6.    From the Target S3 location list, choose the name of the Amazon S3 bucket that you want to export your backup to.7.    Choose Copy.

Related informationExporting a backupSeeding a new cluster with an externally created backup
Question: "For Amazon S3 request rates, what's the difference between prefixes and nested folders? How many prefixes can I have in an S3 bucket?"

For Amazon Simple Storage Service (Amazon S3) request rates, what's the difference between key prefixes and nested folders? How many prefixes can I have in an S3 bucket?ResolutionPrefixesA key prefix is a string of characters that can be the complete path in front of the object name (including the bucket name). For example, if an object (123.txt) is stored as BucketName/Project/WordFiles/123.txt, the prefix might be “BucketName/Project/WordFiles/123.txt”. The prefix can be any length, including the entire object key name.If the 123.txt file is saved in a bucket without a specified path, Amazon S3 automatically adjusts the prefix value according to the request rate. Partitions can be automatically formed at any point in the prefix string.A partitioned prefix in a bucket can support 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second. There is no limit to the number of prefixes that you can have in a bucket. However, be aware that a spike in the request rate can cause throttling.Note: In Amazon S3, there are no partitions for keys or objects. Partitions exist only at the prefix level, and not at the object level. For more information about using prefixes in Amazon S3, see Organizing objects using prefixes.FoldersIn Amazon S3, folders are used to group objects and organize files. Unlike a traditional file system, Amazon S3 doesn't use hierarchy to organize its objects and files. Amazon S3 console supports the folder concept only as a means of grouping (and displaying) objects.More specifically, a folder is the value between the two "/" characters. For example, if a file is stored as BucketName/Project/WordFiles/123.txt, the file path indicates that there is a folder ("Project") and subfolder ("WordFiles"). Both "Project" and "WordFiles" are considered to be folders. If the 123.txt file is saved in a bucket without a specified path, then no folders are used to store the file.Note: The folder structure might not indicate any partitioned prefixes that support request rates.Difference between prefixes and foldersThe difference between a prefix and a folder is the significance of the "/" character. For folders, the "/" character signifies a subfolder or object name. For prefixes, "/" is just another character. The "/" does not indicate a partition placement.Note: The folder structure only applies to the Amazon S3 console. For more information, see Organizing objects in the Amazon S3 console using folders.

Related informationAWS re:Invent 2018: Best practices for Amazon S3 and Amazon S3 GlacierOrganizing, listing, and working with your objects
Question: How do I connect to my Amazon RDS for MySQL instance by using MySQL Workbench?

I want to connect to my Amazon Relational Database Service (Amazon RDS) DB instance that's running MySQL using MySQL Workbench.

ResolutionFollow the steps below to connect MySQL Workbench to your Amazon RDS DB instance:Download and install MySQL Workbench.Open MySQL Workbench, and then choose the ⊕ sign beside MySQL Connections to set up a new connection.In the Setup New Connection dialog box, enter a name for your connection.In the Parameters section, enter these details:Host name: Enter the RDS endpoint.Port: Enter the Port number.Username: Enter the primary user.Note: You can get these details from the Amazon RDS console. From the Databases section, choose Instances, and then select the instance that you are connecting to. From the Connectivity and Security tab, choose Configuration. The primary user is listed here.Choose Test Connection.In the pop-up window that appears, enter the password that you configured when you created the DB instance, and then choose OK.After testing your connection, from the Setup new connection dialog box, choose OK to save the connection.If you receive an error when you test the connection, check that you configured the network correctly.

Related informationHow can I troubleshoot connectivity to an Amazon RDS DB instance that uses a public or private subnet of a VPC?Scenarios for accessing a DB instance in a VPCControlling access with security groups
Question: How does Amazon DynamoDB handle spiky loads in short intervals?

I want to know how Amazon DynamoDB handles spiky workloads in short intervals.

ResolutionWhen you use provisioned mode, DynamoDB provides a degree of flexibility in your per-partition throughput provisioning by providing burst capacity. DynamoDB currently retains up to 5 minutes (300 seconds) of unused read and write capacity. Suppose that a DynamoDB table has its capacity provisioned at 150 RCUs and has no usage in the last 5 minutes. For this configuration, the table has 45,000 read units of burst capacity (150 * 300). Therefore, if a sudden spiky load pushes consumption to 200 read units, then DynamoDB can leverage burst capacity to accommodate 200 RCUs for 15 minutes.Example: 45,000 / (200 - 150) = 900 seconds = 15 minutesHowever, consider the following:Burst capacity is provided on a best effort’s basis and isn't guaranteed. Therefore, don't consider the burst capacity when you configure a table's provisioned capacity.DynamoDB might consume the burst capacity for background maintenance and other tasks without prior notice.Burst capacity can't alleviate partition-level throttling. A partition key that doesn't have a high cardinality can result in many requests that target just a few partitions. If a resulting hot partition exceeds the per partition limits of 3,000 RCU or 1,000 WCU per second, or a combination of both, your table throttles.For more information, see Using burst capacity effectively. In on-demand capacity mode, DynamoDB automatically adapts to your application's traffic volume. On-demand capacity mode instantly accommodates up to double the previous peak traffic on a table. Suppose that your application's traffic pattern varies between 25,000 and 50,000 consistent reads per second and 50,000 reads per second is the previous traffic peak. In this case, the on-demand capacity mode instantly accommodates sustained traffic of up to 100,000 reads per second. If your application sustains the traffic of 100,000 reads per second, then that peak becomes your new previous peak. With this new peak, subsequent traffic might reach up to 200,000 reads per second.However, if your spikes are nearly immediate and more than double the previous peak, your table might throttle. For more information, see Read/write capacity mode.