VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I grant Full Access permissions to another user in WorkMail?

I want to allow another user to have full access to an Amazon WorkMail mailbox. How can I do this?ResolutionYou can grant permissions to users to allow access to a shared mailbox without sharing access credentials. The Full Access permission allows for full read and write access to the mailbox. You can also grant Send As or Send on Behalf permissions.Note: The Full Access mailbox permission can only be granted to other available users. The Send As or Send on Behalf permissions can be granted to both users and groups.For instructions to grant mailbox permissions, see Working with mailbox permissions.After permissions are granted, the user can access the shared mailbox using the WorkMail web application.

Related informationWhat is Amazon WorkMail?
Question: Do bounces from the Amazon SES suppression list affect my daily sending quota?

If I get a bounce from an email address that's on an Amazon Simple Email Service (Amazon SES) suppression list, does the bounce get counted in my daily sending quota?ResolutionYes, emails that you send to addresses on the global suppression list or your account-level suppression list are counted toward your daily sending quota.Note: The impact to your bounce rate depends on the suppression list:Global suppression list: Amazon SES counts bounces from email addresses on the global suppression list toward your account's bounce rate.Account-level suppression list: Amazon SES doesn't count bounces from email addresses on your account-level suppression list toward your account's bounce rate.If you send an email to an address that's on the global suppression list, you get an error message similar to the following:"Amazon SES has suppressed sending to this address because it has a recent history of bouncing as an invalid address. For more information about how to remove an address from the suppression list, see the Amazon SES Developer Guide: http://docs.aws.amazon.com/ses/latest/DeveloperGuide/remove-from-suppressionlist.html"If you send an email to an address that's on your account-level suppression list, you get an error message similar to the following:"Amazon SES did not send the message to this address because it is on the suppression list for your account. For more information about removing addresses from the suppression list, see the Amazon SES Developer Guide at https://docs.aws.amazon.com/ses/latest/DeveloperGuide/sending-email-suppression-list.html"If you get one of those error messages:Verify that the email address is a valid email address.If the email address is valid, then remove the email address from the suppression list.Note: Amazon SES automatically removes email addresses from the global suppression list after a set interval, up to 14 days.Global vs. account-level suppression listsAmazon's global suppression list is activated by default, and it cannot be changed by individual users. However, you can override this list by activating your account-level suppression list, which takes precedence. For example, if an email address is on the global suppression list, SES still delivers to the address if it's absent from your active account-level suppression list.In a global suppression list, repeated bounces from an email address will continue to raise the account's bounce rate. However, an account-level list will not count repeated bounces toward the account's bounce rate, even if those bounces count toward the daily sending quota. Therefore, it's a best practice to use and actively manage an account-level suppression list.Note: Account-level suppression lists can now be managed at both the account level and configuration set level.

Related informationBounces and Complaints (Amazon SES FAQs)
Question: How can I rotate an AWS Secrets Manager secret for a DB connection that requires SSL?

My AWS Secrets Manager rotation function can't connect to an Amazon Relational Database Service (Amazon RDS) instance with Secure Socket Layer (SSL). I receive an error similar to the following:": setSecret: Unable to log into database with previous, current, or pending secret of secret"ResolutionRotation functions for Amazon RDS (except Amazon RDS for Oracle) and Amazon DocumentDB automatically use SSL/TLS to connect to your database if it's available. If SSL or TLS isn't available, then the rotation functions use an unencrypted connection.If you set up secret rotation before December 20, 2021, then your rotation function might be based on an older template that doesn't support SSL/TLS. To support connections that use SSL/TLS, you must recreate your rotation function. For more information, see My database requires an SSL/TLS connection but the AWS Lambda rotation function isn't using SSL/TLS.Verify connection to the database for your DB user and retrieve the secret1.    To connect to your Amazon RDS instance, see Connecting to an Amazon RDS DB instance.2.    To connect your Amazon DocumentDB, see Developing with Amazon DocumentDB.3.    To retrieve the secret, see Retrieve secrets from AWS Secrets Manager in code.4.    To automatically rotate the secret, see Automatically rotate an Amazon RDS, Amazon DocumentDB, or Amazon Redshift secret.

Related informationCustomize a Lambda rotation function for Secrets ManagerHow do I create a rotation function with an AWS Secrets Manager secret for an unsupported database?AWS Secrets Manager now automatically enables SSL connections when rotating database secrets
Question: What is the maintenance window for Amazon RDS and Amazon Redshift?

What is the maintenance window for Amazon Relational Database Service (Amazon RDS) and Amazon Redshift? What is the difference between cluster maintenance and instance maintenance?ResolutionThe maintenance window for Amazon RDS and Amazon Redshift occurs weekly, and DB instances can receive upgrades to the operating system (OS) or to the DB engine. AWS requires at least a 30-minute window in your instance's weekly schedule to confirm that all instances have the latest patches and upgrades. During the maintenance window, tasks are performed on clusters and instances. For the security and stability of your data, maintenance can cause instances to be unavailable.The maintenance window defines when the deployment or operation begins, but maintenance itself can take longer to complete. As a result, the time used for some operations can exceed the duration of the maintenance window.Amazon RDSAmazon RDS maintenance can affect all instances or just specific instances. To minimize the impact that Amazon RDS maintenance can have on your workload, see How do I minimize downtime during required Amazon RDS maintenance?Amazon AuroraFor all versions after Amazon Aurora 1.8, DB updates are performed cluster-wide, and maintenance is deployed during the cluster's maintenance window. DB engine updates to Aurora clusters can be performed across all instances or on a one-by-one basis, depending on the type of update. For more information, see Maintaining an Amazon Aurora DB cluster.Amazon RedshiftAmazon Redshift maintenance affects all instances that require updates for OS- or engine-specific updates. To minimize the impact that Amazon Redshift maintenance can have on your workload, schedule around maintenance windows.

Related informationWhat happens to Amazon RDS and Amazon Redshift queries that are running during a maintenance window?How do I configure notifications for Amazon RDS or Amazon Redshift maintenance windows?How long is the Amazon RDS maintenance window?
Question: Why is my certificate renewal still pending after I validated my domain names using the ACM managed renewal process?

I validated my domain using the AWS Certificate Manager (ACM) managed renewal process, but the status is still "Pending validation." How can I resolve this?Short descriptionThe renewal process differs for email-validated certificates and DNS-validated certificates.ACM tries to automatically renew your ACM certificates 60 days before the certificate expires for DNS-validated certificates. To confirm that a domain is validated, expand the certificate's details in the ACM console. Or, use the describe-certificate command in the AWS Command Line Interface (AWS CLI). If ACM can't automatically validate one or more domain names in the certificate, then the renewal status is "Pending validation."This can happen because:Not all the domains listed in the ACM certificate are validated.The automatic validation failed.The managed renewal process is asynchronous.The original certificate expired.Note: For email-validated certificates renewals, ACM begins sending renewal notices 45 days before expirations that require action by the domain owner.

ResolutionUse the following instructions to troubleshoot the ACM renewal status "Pending validation."Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Not all the domains listed in the ACM certificate are validatedIf you validate domains manually, then each domain included in the ACM certificate must be validated.If you use email validation, then a set of validation emails is sent for each domain. You must complete the steps included in these emails to validate the domains. For more information, see Email validation.The automatic validation failedIf ACM can't automatically validate a domain, see Handling failures in managed certificate renewal.The managed renewal process is asynchronousIt can take up to a few hours for ACM to obtain the new certificate. During this time, the status in the ACM console remains Pending validation.If the update is delayed, then the domain's validation status in the ACM console is Success and the certificate's renewal status is Pending validation.The original certificate expiredIf the original email-validated ACM certificate expires, then the certificate status changes from Issued to Pending validation. You must validate the domain within 72 hours, or the renewal status changes from Pending validation to Failed. If the renewal fails, you must request another public certificate for the domains.

Related informationManaged renewal for ACM certificatesCheck a certificate's renewal statusWhy did my publicly trusted ACM certificate fail managed renewal?
Question: "How can I access Amazon S3 Requester Pays buckets from AWS Glue, Amazon EMR, or Amazon Athena?"

I want to access an Amazon Simple Storage Service (Amazon S3) Requester Pays bucket from AWS Glue, Amazon EMR, or Amazon Athena.

Short descriptionTo access S3 buckets that have Requester Pays turned on, all requests to the bucket must have the Requester Pays header.

ResolutionAWS GlueAWS Glue requests to Amazon S3 don't include the Requester Pays header by default. Without this header, an API call to a Requester Pays bucket fails with an AccessDenied exception. To add the Requester Pays header to an ETL script, use hadoopConfiguration().set() to turn on fs.s3.useRequesterPaysHeader on the GlueContext variable or the Apache Spark session variable.GlueContext:glueContext._jsc.hadoopConfiguration().set("fs.s3.useRequesterPaysHeader","true")Spark session:spark._jsc.hadoopConfiguration().set("fs.s3.useRequesterPaysHeader","true")The following is an example of how to use the header in an ETL script. Replace the following values:database_name: the name of your database your_table_name: the name of your table s3://awsdoc-example-bucket/path-to-source-location/: the path to the source bucket s3://awsdoc-example-bucket/path-to-target-location/: the path to the destination bucketimport sysfrom awsglue.transforms import *from awsglue.utils import getResolvedOptionsfrom pyspark.context import SparkContextfrom awsglue.context import GlueContextfrom awsglue.job import Jobfrom awsglue.dynamicframe import DynamicFrame## @params: [JOB_NAME]args = getResolvedOptions(sys.argv, ['JOB_NAME'])sc = SparkContext()glueContext = GlueContext(sc)spark = glueContext.spark_sessionjob = Job(glueContext)job.init(args['JOB_NAME'], args)spark._jsc.hadoopConfiguration().set("fs.s3.useRequesterPaysHeader","true")# glueContext._jsc.hadoopConfiguration().set("fs.s3.useRequesterPaysHeader","true")##AWS Glue DynamicFrame read and writedatasource0 = glueContext.create_dynamic_frame.from_catalog(database = "your_database_name", table_name = "your_table_name", transformation_ctx = "datasource0")datasource0.show()datasink = glueContext.write_dynamic_frame.from_options(frame = datasource0, connection_type = "s3", connection_options = {"path":"s3://awsdoc-example-bucket/path-to-source-location/"}, format = "csv")##Spark DataFrame read and writedf = spark.read.csv("s3://awsdoc-example-bucket/path-to-source-location/")df.show()df.write.csv("s3://awsdoc-example-bucket/path-to-target-location/")job.commit()Amazon EMRSet the following property in /usr/share/aws/emr/emrfs/conf/emrfs-site.xml:<property>   <name>fs.s3.useRequesterPaysHeader</name>   <value>true</value></property>AthenaTo allow workgroup members to query Requester Pays buckets, choose Enable queries on Requester Pays buckets in Amazon S3 when you create the workgroup. For more information, see Create a workgroup.

Related informationDownloading objects in Requester Pays bucketsHow do I troubleshoot 403 Access Denied errors from Amazon S3?
Question: How can I load data from the Slack app to Amazon S3 by using Amazon AppFlow?

I want to extract my data from the Slack app, and load it to Amazon Simple Storage Service (Amazon S3). How can I use Amazon Appflow to do this do this?Short descriptionTo load your Slack data to Amazon S3, first create an app on Slack. Then, extract data from that app to Amazon S3 using Amazon Appflow. You can also use the method in this article to load data from an existing Slack app to Amazon S3.To do this, you need to:Note your client ID, client secret, and Slack instance name.Set a redirect URL.Set the required user scopes in Slack.

ResolutionLog in to Slack, and create a workspace.Create a channel, and give access to your users by adding their email ID.Create an app in the workspace that you created by adding a name, and then choosing the Create App button.After you create an app, note the following information on the confirmation page. You need this information to create an Amazon AppFlow connector to Slack. See this example:App ID: A0****DDate of app creation: October 20, 2021Client ID: 2****97.2**9Client secret: 5****95Signing secret: d0****f4Verification code: U******qOn the same page, under Install your app section, choose permission scope.Under User Token Scopes, add an OAuth Scope for your user token.Under Redirect URLs, add a URL similar to this:For us-eas-1 Region use: https://console.aws.amazon.com/appflow/oauthFor all other Regions, use: https://region.console.aws.amazon.com/appflow/oauthNote: Be sure to replace "region" in this URL with the Region you are using.Open the Amazon AppFlow console.Choose Create flow, and then under Source name, choose Slack.Under Choose Slack connection, choose Create new connection.Under Connect to Slack, Enter the details that you noted in step 4.For Destination name, choose Amazon S3, and for Destination bucket, choose the S3 bucket that you want to use.Map all fields, and then choose Run flow.After your flow is finished running, check the output file in the S3 bucket that you specified as a destination.

Related informationWhat is Amazon AppFlow?Supported source and destination applications
Question: Can I verify my domain for Amazon SES in multiple accounts or AWS Regions?

Can I verify my domain for Amazon Simple Email Service (Amazon SES) in multiple AWS accounts or AWS Regions?Short descriptionAmazon SES now uses DomainKeys Identified Mail (DKIM) to verify and manage your domain identity. If you set up your domain through DKIM, then you can verify your identity across multiple accounts or Regions through DKIM-based verification. For domains that are verified by DKIM and managed by Amazon Route 53, Amazon SES automatically updates the DNS server with the necessary records. For more information, see Creating and verifying identities in Amazon SES.If your domain is verified by DKIM but isn't managed by Route 53, then you must configure three DKIM CNAME records to your DNS provider.Domains that are verified with TXT records must manually add accounts or Regions to the record in order to verify them. If you created your domain with a TXT record and use Route 53 as your DNS service, then follow these steps.

ResolutionFollow these steps to verify your domain in multiple accounts or Regions through your domain's TXT record:1.    Verify your domain in the first account or Region.2.    Open the Route 53 console.3.    From the navigation pane, choose Hosted zones.4.    Choose the TXT record that you created when you verified your domain in the first account or Region.5.    In the Value box, go to the end of the existing attribute value, and then press Enter.6.    Add the attribute value for the additional account or Region.7.    Save the record set. Note that some DNS providers don't allow you to assign multiple values to the same TXT record. In this case, first verify the domain once with _amazonses in the TXT record's attribute name. Then, verify the domain again with _amazonses removed from the attribute name. In the following example, the domain is example.com:_amazonses.example.com    TXT    "TokenValue"example.com               TXT    "TokenValue"Warning: For this use case where you must add _amazonses to the attribute name, you can verify the same domain only two times.8.    After you update the record set, validate the record. On a Linux operating system or on macOS, you can run a dig command:$dig TXT _amazonses.example.com +shortOn a Windows operating system, you can run the nslookup command:$nslookup -type=TXT  _amazonses.example.comThe expected output for either the dig command or the nslookup command is the value of the TXT record. Along with your existing TXT records, the output should include the recently added TXT record, similar to the following:"amSXqexampleyqEPQy+jkMfF63uB9y6MG1FA/Du3x8Q=""0biRnexample5QDj43bNpT5Z+gQfdpfKqaP2tm8x4NE="9.    After the correct record is added and is resolving, Amazon SES shows the domain as verified. If the domain isn't verified within 72 hours, you can retry the verification process.

Related informationDomain and email address verification problems
Question: "What is the AWS Free Tier, and how do I use it?"

I want to test AWS using resources covered under the AWS Free Tier. I want to know how the AWS Free Tier works, and what I should keep in mind when using it.

Short descriptionThe AWS Free Tier is automatically activated on each new AWS account. With the AWS Free Tier, you can try out some AWS services free of charge up to a specific maximum amount of usage each month.Important: Not all AWS services are free. Some services launched under the Free Tier have usage limits. If you exceed the usage limits, then you're charged at standard rates.Check the AWS Free Tier offerings to be sure that the services you intend to use are covered and the applicable usage limits.

ResolutionKeep the following in mind when using the AWS Free Tier:Free Tier includes three different types of offeringsTrials: These are short-term trial offers that start from the date that you activate a service. You pay standard rates after the trial period expires. For more information on how different services are charged, see AWS Pricing.12-Months free: These offers provide limited usage for 12 months after your initial sign-up date. You pay standard rates after your 12 months free usage term expires or if your application use exceeds the free tier limits.Always free: These offers are available to all AWS customers and don't expire at the end of your 12-month AWS Free Tier term.Not all free usage is part of the AWS Free TierSome services offer free trials outside of AWS Free Tier. Other services offer some level of service for free, whether or not your account is covered under the AWS Free Tier.Check the service's pricing documentation to find out if that service has a free trial option.Your access to services is not restricted by the AWS Free TierYou are responsible for the services that you launch. You might incur charges for any services and usage that are not covered by the Free Tier. For information on how much your resources will cost after the Free Tier limits are exceeded, see How do I estimate the cost of my planned AWS resource configurations?Avoid unnecessary chargesTo avoid unnecessary charges, see How do I make sure I don't incur charges when I'm using the AWS Free Tier?Related informationAWS Free Tier FAQsEligibility for the AWS Free TierI unintentionally incurred charges while using the AWS Free Tier. How do I make sure that I'm not billed again?
Question: How do I move my provisioned Amazon Redshift cluster into a different subnet?

I'm trying to move my Amazon Redshift cluster into a different subnet. How can I do that?Short descriptionWhen a new Amazon Redshift cluster is launched, an Amazon Virtual Private Cloud (Amazon VPC), security group, and cluster subnet group are provided. During the launch, Amazon Redshift picks up random subnets from the associated cluster subnet group.You have two options for moving your existing provisioned Amazon Redshift cluster into a different subnet: You can either use an existing subnet group, or you can create a new subnet group that contains the subnet where you will move the provisioned Amazon Redshift cluster. After you have a subnet group with the preferred subnet, you must restore your cluster from a snapshot. Be sure that there is only one subnet in the subnet group. Otherwise, Amazon Redshift might not launch the cluster in that specific subnet.

ResolutionTo move your Amazon Redshift cluster into a different subnet group, perform these steps:1.    Create a manual snapshot of the cluster.2.    Restore the cluster using the snapshot that you just created.3.    Under Additional configurations, turn off the Use defaults settings.4.    Choose Network and security.5.    Select the desired subnet group.6.    Choose Restore cluster from snapshot.For more information, see How do I move my Amazon Redshift cluster from one VPC to another VPC?To confirm the subnet and subnet group that your Amazon Redshift cluster is using, perform these steps:1.    Open the Amazon Redshift console.2.    Choose the Clusters tab.3.    Select your Amazon Redshift cluster.4.    Choose the Properties tab.5.    Navigate to Network and security to view network details. The Network and security information shows you the subnet group that's being used.6.    Under the Properties tab, navigate to Node IP addresses. This section has information that can help you verify the subnet that's being used. The subnet listed must be from your subnet group.Subnet best practicesWhen you move your Amazon Redshift cluster into a different subnet, consider the following best practices:Configure your cluster subnet group so that the subnets reside in a homogenous network. In a homogenous network configuration, all the subnets that belong to that group share similar networking rules, performing as a uniform network. A homogenous network configuration also minimizes any connectivity issues that can occur when moving your Amazon Redshift cluster into a different subnet.Be sure that there are enough IP addresses present in each of your subnets within the subnet group. Otherwise, Amazon Redshift provisions your cluster into two or more subnets within the same Availability Zone (AZ). If there are no available subnets within the same Availability Zone, or there aren't enough IP addresses present, your cluster launch might fail. To resolve a launch failure, delete any unused elastic network interfaces. Or, you can move your AWS resources into a different subnet by choosing a different subnet group.