VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How can I control access to my instances using Session Manager?

I want to control access to my instances so that certain users can start a Session Manager session for the instances that I specify. How can I do that?Short descriptionYou can manage your Amazon Elastic Compute Cloud (Amazon EC2) instance or on-premises instance using AWS Systems Manager Session Manager. Session Manager connects through a browser-based shell, or through the AWS Command Line Interface (AWS CLI).You can use Identity and Access Management (IAM) policies to control the users that can access the instance using Session Manager. The IAM policy also controls the API actions that the users can perform.PrerequisitesComplete the Session Manager prerequisites.Verify or create an IAM instance profile with Session Manager permissions.(Optional) Install the Session Manager plugin for the AWS CLI.

ResolutionTo allow users to connect to Session Manager, first create an IAM policy that grants StartSession access to the IAM user. Then, attach the IAM policy to the IAM user.Follow these steps to create and attach an IAM policy that allows an IAM user to start a Session Manager session using the AWS CLI. The following example policy restricts the ability to start a session to specific instances.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.1.    Open the IAM console, and then choose Policies from the left navigation pane.2.    Choose Create policy, and then choose the JSON tab.3.    Copy the Restrict access to specific instances sample JSON document, and then paste the policy to the JSON tab in the console.Important: The resource ARN in the example policy uses the us-east-2 AWS Region, and includes placeholders for the instance ID and account ID. Be sure to replace these values with your own.4.    Choose Next: Tags.5.    Choose Next: Review.6.    For Name, enter a policy name.7.    (Optional) For Description, enter a description.8.    Choose Create policy to save the policy.9.     Attach the IAM policy to the user that you want to allow to access to the instance using Session Manager.Users that are granted access can now initiate the start-session API call using the following AWS CLI command:Note: The user must replace instance-id with the instance ID that they want to start a session for.aws ssm start-session --target instance-idTo allow users to start a session using the Amazon EC2 console, you must also attach the following AWS managed policies to the user:AmazonSSMReadOnlyAccessAmazonEC2ReadOnlyAccess

Related informationAdditional sample IAM policies for Session ManagerStart a sessionCreating IAM policies (console)How AWS Systems Manager works with IAMAWS managed policies for AWS Systems Manager
Question: How is the pricing benefit of a Reserved Instance applied across an organization's consolidated bill?

How is the pricing benefit of a Reserved Instance (RI) applied in an organization's consolidated billing family?ResolutionRI discounts apply to accounts in an organization's consolidated billing family depending upon whether RI sharing is turned on or off for the accounts. By default, RI sharing for all accounts in an organization is turned on. The management account of an organization can change this setting by turning off RI sharing for an account.If RI sharing is turned on for an account in an organization, then:At least one account in the organization's consolidated billing family must be running an instance that matches the specifications of the RI for the discount to apply to the management account's bill.The discount for any RIs purchased on that account is applied to the combined usage for that instance type on the management account's bill.The RI discount applies to the total usage of the instance type for the full duration of the RI. The RI discount applies even if the purchasing member account is closed.The discount on the RIs purchased on a member account doesn't apply to the consolidated bill if the member account leaves the organization or is removed from the organization by the management account. For more information, see Before removing an account from an organization.The account that originally purchased the RI receives the discount first. If the purchasing account has no instances that match the terms of the RI, then the discount for the RI is assigned to any matching usage on another account in the organization.If RI sharing is turned off for an account in an organization, then:RI discounts apply only to the account that purchased the RIs.RI discounts from other accounts in the organization's consolidated billing family don't apply.The charges accrued on that account are still added to the organization's consolidated bill and are paid by the management account.Capacity reservations can be shared within an AWS organization at no additional cost. For more information, see Work with shared Capacity Reservations.

Related informationConsolidated billing for AWS OrganizationsUnderstanding consolidated bills
Question: Why can't I find the user name that created an EBS volume by searching CloudTrail events logs?

I want to find out who created an Amazon Elastic Block Store (Amazon EBS) volume so that I can safely delete it.

Short descriptionAWS CloudTrail event logs CreateVolume aren't available for EBS volumes created during an Amazon Elastic Compute Cloud (Amazon EC2) launch.To determine the user name that created the EBS volume:EBS volumes created manually can use the volume ID to view CloudTrail event logs for CreateVolume.EBS volumes created during EC2 launch can use the EC2 instance ID to view CloudTrail event logs for RunInstances.For more information, see Viewing CloudTrail events in the CloudTrail console.Note: This only applies to EBS volumes that were created after activating AWS Config and CloudTrail.

ResolutionDetermine if the EBS volume was created during EC2 launch or manually createdOpen the Amazon EC2 console, expand Elastic Block Store, and then choose Volumes.Copy the Volume ID of your EBS volume.Open the AWS Config console, and then choose Resources.In the Resource type dropdown list, choose AWS EC2 Volume.In Resource identifier, paste the Volume ID from step 2. Then, select the radio button and choose Resource Timeline to open the timeline of the resource as captured by AWS Config.In Events, expand the Configuration Change. Then, choose View full record.Expand Relationships.If you don't see an EC2 instance ID, this means that your EBS volume was created manually.If you see an EC2 instance ID, this means that your EBS volume was created during EC2 launch or attached afterwards. Copy the EC2 Instance ID.Find the user name that created the EBS volumeIf the EBS volume was created manually, then follow these steps:Open the CloudTrail console, and then choose Event history.In Filter, choose Resource name.In Enter resource name, paste the volume ID of your EBS volume, and then press Enter from your device.Choose the Event to expand and show the full event record. Note the arn and userName to identify the user who manually created the EBS volume.If the EBS volume was created during EC2 launch, then follow these steps:Open the CloudTrail console, and then choose Event history.In Filter, choose Resource name.In Enter resource name, paste the EC2 instance ID that you copied from the AWS Config console. Then, press Enter from your device.Choose the Event to expand and show the full event record. Note the arn and userName to identify the user who launched the EC2 Instance.Note: You can't delete an EBS volume if the DeleteonTermination attribute is set to false. For more information, see Preserve Amazon EBS volumes on instance termination.
Question: How do I copy my Amazon EBS snapshot to another AWS Region?

I want to copy my Amazon Elastic Block Store (Amazon EBS) snapshot to a different AWS Region. How can I do this?Short descriptionYou can either manually copy your Amazon EBS snapshot to another AWS Region, or automate the copy process using Amazon Data Lifecycle Manager.

ResolutionManually copy an EBS snapshot to another RegionMake sure that the snapshot is in the completed state. Then, use the Amazon Elastic Compute Cloud (Amazon EC2) console, or the AWS Command Line Interface to copy the snapshot to another Region. Before copying the snapshot, see Copy an Amazon EBS snapshot and check the Prerequisites, Considerations, and Pricing.Note: If you delete the most recent snapshot copy, then the next copy that you create is a complete, non-incremental copy. Because it's a full copy, the snapshot incurs storage costs. For more information, see Incremental snapshot copying.Automate the snapshot copy process using Data Lifecycle ManagerYou can also use Amazon Data Lifecycle Manager to automate snapshot copying to other Regions by creating a snapshot lifecycle policy.Note: Using Amazon Data Lifecycle Manager requires credentials. For more information, see AWS Identity and Access Management.

Related informationHow can I troubleshoot problems using Amazon Data Lifecycle Manager?
Question: Is AWS down?

I tried to access my AWS account or its resources, but I wasn't able to access them.

ResolutionIf you're getting a browser or connection error (for example, a 404 error) when accessing the AWS Management Console, try the following:Clear your browser's cache and cookies.Use a different browser to access the AWS Management Console.Check with your system administrator to verify that your network doesn't block amazon.com, aws.amazon.com, or its subdomains.The issue might be related to one of your AWS resources. Check your AWS Personal Health Dashboard for notifications from AWS if you're unable to reach a specific resource, such as an Amazon Elastic Compute Cloud (Amazon EC2) instance or Amazon RDS database. For example, an unreachable Amazon EC2 instance might currently be undergoing scheduled maintenance.Check the AWS Service Health Dashboard if you're unable to reach an AWS service or console, such as the Amazon EC2 console. AWS services are Regional, so be sure to select your AWS Region from the dropdown list. The Service Health Dashboard displays information about service disruptions and open events.

Related informationWhat do I do if I can't access my AWS account?How do I create and activate a new AWS account?How do I sign in to the AWS Management Console?
Question: How do I upgrade my ElastiCache for Redis engine version and what is the impact of upgrading?

How do I upgrade my Amazon ElastiCache for Redis engine version and what is the impact of upgrading?ResolutionUpgrade the Redis engine versionMake a backup of your Redis cluster or replication group. For more information, see Making manual backups.Modify the ElastiCache cluster or the replication group and then choose a new engine version.Note: When upgrading, keep the following in mind:When upgrading major engine versions, for example from 5.0.6 to 6.0, you must choose a new parameter group that's compatible with the new engine version.If encryption is turned on for your current cluster or replication group, you can't upgrade to an engine version that doesn't support encryption. For example, you can't upgrade from version 3.2.6 to 3.2.10.Downgrading to an older engine version after upgrading isn't supported.Impacts of upgradingThe ElastiCache for Redis engine upgrade process makes a best effort to retain your existing data and requires successful Redis replication.Starting with Redis engine version 5.0.5, you can upgrade your cluster version with minimal downtime. The cluster is available for reads during the entire upgrade. The cluster is available for writes for most of the upgrade duration, except during the failover operation. The failover operation lasts a few seconds.You can upgrade your ElastiCache clusters with versions earlier than 5.0.5. The upgrade process is the same but might incur longer failover time during DNS propagation (30s-1m).For Redis clusters with Multi-AZ turned on, it's a best practice to schedule engine upgrades during periods of low incoming write traffic. When upgrading to Redis 5.0.6 or higher, the primary cluster continues to be available to service requests during the upgrade process.For single node Redis clusters and clusters with Multi-AZ turned off, it's a best practice to make sure that sufficient memory is available to Redis. For more information see, Ensuring that you have enough memory to create a Redis snapshot. For single clusters and clusters with Multi-AZ turned off in any version of Redis, the primary node is unavailable to service requests during the upgrade process.

Related informationUpgrading engine versions
Question: How do I resolve the "Unable to negotiate: No matching host key type found" error when connecting to my EC2 Linux instance using SSH?

I receive the error "No matching host key type found" or "No matching key exchange method found" when connecting to my Amazon Elastic Compute Cloud (Amazon EC2) Linux instance using SSH.  Short description

Short descriptionYou might see one of the following errors when connecting to an EC2 Linux instance using SSH:No matching host key type found: This error occurs If SSH can't negotiate a common encryption algorithm or host key with the server that you're connecting to.No matching key exchange method found: This error indicates a problem with the key exchange algorithm negotiated between the SSH client and server during the SSH handshake. This error occurs when the SSH client and server have different or incompatible key exchange algorithms.

ResolutionUpdate the openssh-clientOlder versions of the openssh-client might not support the key exchange algorithm negotiated by the server. Run one of the following commands to update the client to the latest version:Ubuntu and Debiansudo apt upgrade openssh-clientAmazon Linux, RHEL, and Fedorasudo yum upgrade openssh-clientsResolve the "no matching host key type found" errorExample errorUnable to negotiate with X.X.X.X port 22. no matching host key type found. Their offer: rsa-sha2-512,rsa-sha2-256,ecdsa-sha2-nistp256,ssh-ed25519.To resolve this error, make sure that the server and client have at least a single matching host key algorithm. Run the following command on the server and the client to check the host key algorithm:sudo ssh -Q keyTo add additional algorithms in the client, append the following line in the ~/.ssh/config or /etc/ssh/ssh_config file:vi ~/.ssh/configHostkeyAlgorithms +ssh-ed25519Resolve the "no matching key exchange method found" errorExample error Unable to negotiate with X.X.X.X port 22: no matching key exchange method found. Their offer: curve25519-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha25To resolve this error, make sure that the server and client having at least a single matching key exchange algorithm. Run the following command on the server and the client to check the key exchange algorithm:sudo ssh -Q kexTo add additional key exchange algorithm on the client, append the following line in the ~/.ssh/config or /etc/ssh/ssh_config file:vi ~/.ssh/configKexAlgorithms +diffie-hellman-group16-sha512Related informationOpenSSH Legacy Options on openssh.com
Question: How do I restart a service in Amazon EMR?

I need to restart an Amazon EMR service, such as YARN ResourceManager.

Short descriptionThe process for restarting a service differs depending on which Amazon EMR release version you're using:Amazon EMR 5.30.0 and later release versions: Use the sudo systemctl stop and sudo systemctl start commands.Amazon EMR 4.x-5.29.0 release versions: Use the sudo stop and sudo start commands.Amazon EMR 2.x-3.x release versions: Use the sudo restart command.

ResolutionAmazon EMR 5.30.0 and later release versions1.    Connect to the master node using SSH.2.    List all running services:systemctl --type=service3.    To list a specific service, run a command similar to the following. For example, to list the Zeppelin service:systemctl --type=service | grep -i zeppelinExample output:zeppelin.service  loaded active running Zeppelin4.    To see a detailed status report for a specific service:sudo systemctl status zeppelinExample output:zeppelin.service - Zeppelin   Loaded: loaded (/etc/systemd/system/zeppelin.service; enabled; vendor preset: disabled)   Active: active (running) since Tue 2020-04-21 18:26:53 UTC; 4min 59s ago  Process: 25719 ExecStart=/usr/bin/su -s /bin/bash zeppelin -c cd /var/lib/zeppelin && /usr/lib/zeppelin/bin/zeppelin-daemon.sh --config '/etc/zeppelin/conf' start (code=exited, status=0/SUCCESS) Main PID: 25749 (java)    Tasks: 0   Memory: 4.0K   CGroup: /system.slice/zeppelin.service           25749 /etc/alternatives/jre/bin/java -Dfile.encoding=UTF-8 -Xms1024m -Xmx1024m -XX:MaxPermSize=512m -Dlog4j.configuration=file:///etc/zeppelin/con...5.    Stop the service:Note: You must use the stop and start commands in the following steps. Don't use the restart command.sudo systemctl stop zeppelin6.    Verify that the service is stopped:sudo systemctl status zeppelin7.    Start the service:sudo systemctl start zeppelin8.    Verify that the service is running:sudo systemctl status zeppelinAmazon EMR 4.x-5.29.0 release versions1.    Connect to the master node using SSH.2.    List all running services:initctl list3.    Run the following command to stop the service. Replace "hadoop-yarn-resourcemanager" with the service that you want to restart.Note: You must use the stop and start commands in the following steps. Don't use the restart command.sudo stop hadoop-yarn-resourcemanager4.    Wait a few seconds, and then start the service:sudo start hadoop-yarn-resourcemanager5.    Verify that the process is running:sudo status hadoop-yarn-resourcemanagerAmazon EMR 2.x-3.x release versions1.    Connect to the master node using SSH.2.    List all running services:ls /etc/init.d/3.    Run the following command to restart the service. Replace "hadoop-hdfs-namenode" with the service that you want to restart.sudo /etc/init.d/hadoop-hdfs-namenode restart4.    Verify that the process is running:sudo /etc/init.d/hadoop-hdfs-namenode status

Related informationAbout Amazon EMR releases
Question: How do I turn on encryption at rest for an existing Amazon EFS file system?

I created an Amazon EFS file system without encryption and now I want to turn on encryption of data at rest.

Short descriptionAfter you create an existing file system (EFS), you can't change its encryption setting. This means you can't modify an unencrypted file system to make it encrypted. Instead, you must:Create a new Amazon EFS file system with encryption turned on.Copy the data from the existing file system into the new file system.

ResolutionCreate a new Amazon EFS file system with encryption turned on. To copy the data from your existing EFS file system to a new EFS file system, use the EFS replication feature. The EFS replication process replicates the data and metadata on the source file system to a new destination EFS file system.After creating an EFS replication configuration, Amazon EFS performs the initial sync that copies all data and metadata on the source to the destination file system. The amount of time that the initial sync takes to finish depends on the size of the source file system. After the initial sync completes, the replication process continues to keep the destination file system in sync with the source.2. Fail over to the destination file system.Note: Encryption at rest isn't turned on by default when creating a new file system using the AWS CLI, API, or SDKs. For more information, see Creating a file system using the AWS CLI.

Related informationEncrypting data at restData encryption in Amazon EFSAmazon EFS replication
Question: Why can't I launch an Amazon RDS DB instance in a specific VPC?

I'm trying to launch an Amazon Relational Database Service (Amazon RDS) DB instance in an Amazon Virtual Private Cloud (Amazon VPC) but I received an error message.

ResolutionTo launch an Amazon RDS DB instance in a specific Amazon VPC, be sure to set up the Amazon VPC and the DB instance according to these requirements:Use an Amazon VPC that has at least two subnets in the AWS Region where you want to deploy your DB instance. If an Amazon VPC doesn't have at least two subnets, you receive the following error message: "VPC must have a minimum of 2 subnets in order to create a DB Subnet Group. Go to the VPC Management Console to add subnets."Create a DB subnet group and include only the subnets you want Amazon RDS to launch DB instances into. If a DB subnet group isn't created, then Amazon RDS creates a DB subnet group including all subnets for the Amazon VPC. Each DB subnet group must have subnets in at least two Availability Zones in an AWS Region. If your subnet group doesn't include subnets from at least two Availability Zones, you receive following error message: "DB Subnet Group doesn't meet availability zone coverage requirement. Please add subnets to cover at least 2 availability zones."Use one of the approved Amazon Elastic Compute Cloud (Amazon EC2) dedicated instance types, if you want your DB instance to be in a dedicated Amazon VPC that has an instance tenancy attribute that is set to Dedicated. If you use an instance type that isn’t supported for dedicated Amazon VPC, then the Amazon VPC is not listed.Note: If the DNS hostnames and DNS resolution attributes of the Amazon VPC aren't enabled, the Amazon VPC is listed when you choose Launch RDS Instance. However, if you try to launch an instance that is Publicly Accessible, you receive the following error message: "Cannot create a publicly accessible DB Instance. The specified VPC does not support DNS resolution, DNS hostnames, or both. Update the VPC and then try again."Related informationCreating a DB instance in a VPCWorking with a DB instance in a VPCHow do I change the VPC for an RDS DB instance?DNS support in your VPCWorking with DB subnet groups
Question: "How do I turn on the EPEL repository for my Amazon EC2 instance running CentOS, RHEL, or Amazon Linux?"

I want to turn on access to the Extra Packages for Enterprise Linux (EPEL) repository in an Amazon Elastic Compute Cloud (Amazon EC2) instance running CentOS, Red Hat Enterprise Linux (RHEL), or Amazon Linux-based distribution.

Short descriptionStandard repositories might not provide all the packages that can be installed on CentOS, RHEL, or Amazon Linux-based distribution. Turning on the EPEL repository provides additional options for package installation.

ResolutionFollow these steps to download, install, and turn on the EPEL repository on CentOS, RHEL, or Amazon Linux-based distribution.To verify the distribution, run the following command:cat /etc/os-releaseAmazon LinuxAmazon Linux 2:Install the EPEL release package for RHEL 7 and turn on the EPEL repository:sudo amazon-linux-extras install epel -yRHELRHEL 8:Install the EPEL release package for RHEL 8.sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -yRHEL 7:Install and turn on the EPEL release package for RHEL 7:sudo yum -y install https://dl.fedoraproject.org/pub/epel/epel-release-latest-7.noarch.rpmCentOSCentOS 8:Install the EPEL release package for RHEL 8. Turn on both the EPEL and PowerTools repositories. The PowerTools repository contains development tools required by many EPEL packages:sudo sed -i 's/mirrorlist/#mirrorlist/g' /etc/yum.repos.d/CentOS-*sudo sed -i 's|#baseurl=http://mirror.centos.org|baseurl=http://vault.centos.org|g' /etc/yum.repos.d/CentOS-*sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm -ysudo dnf config-manager --set-enabled PowerToolsCentOS 7:Install and turn on the EPEL release package. CentOS 7 includes the epel-release package in the base repositories:sudo yum -y install epel-releaseList repositories that are turned onTo verify that the EPEL repository is turned on, run the repolist command:sudo yum repolist

Related informationAdd repositories on an Amazon Linux instanceExtras library (Amazon Linux 2)Amazon Linux 2 FAQsExtra Packages for Enterprise Linux (EPEL)