VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why did my ACM certificate request fail?

I requested a public certificate AWS Certificate Manager (ACM) but the request failed. How can I troubleshoot this?Short descriptionTo troubleshoot failed ACM certificate requests, check the following:Available contactsUnsafe domainsAdditional verification requiredPublic domains that aren't validAmazon-owned domains

ResolutionAvailable contactsIf you used email validation to request the certificate, then make sure that:You have a working email address that is registered in WHOIS and that the address is visible with a WHOIS lookup.Your domain is configured to receive email. Your domain's name server must have a mail exchanger record (MX record) so ACM's email servers know where to send the domain validation email.For more information, see Error message: No Available Contacts.Unsafe domainsIf the requested certificate contains at least one domain in its domain scope that was reported as unsafe by VirusTotal, the certificate request fails. To correct the issue, do the following:Search for your domain name on the VirusTotal website to see if it's reported as suspicious.If you believe that the result is a false positive, then notify the organization that is reporting the domain. VirusTotal is an aggregate of several antivirus and URL scanners and can't remove your domain for you.After you correct the problem and the VirusTotal registry is updated, request a new public certificate.For more information, see Error message: Domain Not Allowed.Additional verification requiredThis occurs as a fraud-protection measure if your domain ranks within the Alexa top 1000 websites.Use the AWS Support Center to contact AWS Support. AWS Support will assist you with adding your domains to an allow list. For more information, see Error message: Additional Verification Required.Public domains that aren't validIf the requested certificate includes a public domain that isn't valid, then the certificate fails with the following error:"One or more domain names is not a valid public domain."Request a new certificate, and then make sure that the top-level domains of all domains specified in the certificate’s domain scope are valid.Amazon-owned domainsIf the requested certificate includes an Amazon-owned domain, such as those ending in amazonaws.com, then the certificate request will fail with the following error:"Additional verification required to request certificates for one or more domain names in this request."Request a new certificate with a domain name that isn't owned by Amazon. For more information, see Error message: Additional Verification Required.

Related informationCertificate request failsACM certificate characteristicsWhy am I not receiving validation emails when using ACM to issue or renew a certificate?
Question: How can I resolve the "Cannot initialize SFTP Protocol" error when I connect to an AWS Transfer Family SFTP-enabled server?

I created an AWS Transfer Family SFTP-enabled server. Then, I created a server user and I added a public key to the user. However, when the user connects to the server using WinSCP, they get the error message "Cannot initialize SFTP Protocol. Is the host running an SFTP server?" How can I fix this?Note: This error message varies across SFTP clients. For example, if you're using Cyberduck, the error is "EOF while reading packet. Please contact your web hosting service provider for assistance." If you're using OpenSSH, the error is "Exit status 1 (Connection closed)."ResolutionThis error typically occurs when the logging role of your AWS Transfer Family server is configured incorrectly. To resolve the error, confirm that the AWS Transfer Family service has permission to assume the logging role that's associated with your server. Verify that the logging role's trust policy allows "Action": "sts:AssumeRole" for the Principal "Service": "transfer.amazonaws.com", similar to the following example statement:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "Service": "transfer.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}
Question: What do I do if I get the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message from Amazon SES?

What do I do if I get the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message from Amazon Simple Email Service (Amazon SES)?ResolutionIf you exceed the maximum sending quota per day or per second, Amazon SES returns the "Maximum sending rate exceeded" or "Daily sending quota exceeded" error message. To address this error message:Use the Amazon SES console to review your account's current sending quotas.Review your sending application and requirements to see if you can stay within the quotas by downscaling or implementing an exponential backoff mechanism.Note: If you receive a "Maximum sending rate exceeded" error, you can retry your request.If you determine that your current sending quotas don't meet your sending requirements, you can do one of the following:Move out of the Amazon SES sandboxAll new Amazon SES accounts are in the Amazon SES sandbox. To see if your account is in the sandbox, use the Amazon SES console.In the sandbox, your account has the following sending quotas:You can send a maximum of 200 messages per day.You can send a maximum of one message per second.Note: If your account is in the Amazon SES sandbox, then you can send messages only to and from verified email addresses.To request to move your account out of the sandbox, open a support case. In the same support case, you can also include a request to increase your sending quota by filling out the Requests section.Request an increase in your sending quotaIf your account is in production mode (not sandbox), you can monitor your quota usage and request a sending quota increase when you need it. To request an increase in your sending quota, open a support case and complete the fields in the Requests section.Note the following important considerations when requesting an increase in your sending quota:If your Amazon SES account is in production mode and you're sending high-quality emails, you might qualify for an automatic increase in your sending quota.When you request a new sending quota, be sure to request only the amount that you need. Your requested quota increase isn't guaranteed.Your sending quota increase can be denied if your Amazon SES account is under review.
Question: "How do I turn on functions, procedures, and triggers for my Amazon RDS for MySQL DB instance?"

I want to turn on functions, procedures, and triggers for my Amazon Relational Database Service (Amazon RDS) for MySQL DB instance.

ResolutionAmazon RDS is a managed service and doesn't provide system access (SUPER privileges). If you turn on binary logging, then set log_bin_trust_function_creators to true in the custom database (DB) parameter group for your DB instance.If you create a DB instance without specifying a DB parameter group, then Amazon RDS creates a new default DB parameter group. For more information, see Working with parameter groups.Create a DB parameter group.Modify the custom DB parameter group, and then set the parameter: log_bin_trust_function_creators=1Choose Save Changes.Note: Before using the DB parameter group with a DB instance, wait at least 5 minutes.In the navigation pane, choose Databases.Choose the DB instance that you want to associate with the DB parameter group.Choose Modify.Select the parameter group that you want to associate with the DB instance.Reboot the DB instance.Note: The parameter group name changes immediately, but parameter group changes aren't applied until you reboot the instance without failover.If you're already using a custom parameter group, then complete only steps 2–3. The parameter log_bin_trust_function_creators is a dynamic parameter that doesn't require a DB reboot.When you turn on automated backup for a MySQL DB instance, you also turn on binary logging. When creating a trigger, you might receive the following error message:"ERROR 1419 (HY000): You don't have the SUPER privilege and binary logging is enabled (you might want to use the less safe log_bin_trust_function_creators variable)"If you receive this error, then modify the log_bin_trust_function_creators parameter to 1. This allows functions, procedures, and triggers on your DB instance.Note: When you set log_bin_trust_function_creators=1, unsafe events might be written to the binary log. Binary logging is statement based (binlog_format=STATEMENT).For more details about the parameter log_bin_trust_function_creators, see log_bin_trust_function_creators and Stored program binary logging in the MySQL documentation.

Related informationHow can I resolve 1227 and definer errors when importing data to my Amazon RDS for MySQL DB instance using mysqldump?Modifying parameters in a DB cluster parameter group
Question: How can I allow the tasks in my Amazon ECS services to communicate with each other?

I want to allow the tasks in my Amazon Elastic Container Service (Amazon ECS) services to communicate with each other.

Short descriptionYou can allow your tasks to communicate with each other using Service discovery. Service discovery helps manage HTTP and DNS namespaces for your Amazon ECS services.Note: Service discovery supports the A and SRV DNS record types. DNS records are automatically added or removed as tasks start or stop in the Amazon ECS service. Tasks or applications that need to connect to your Amazon ECS service can locate an existing task from the DNS record.

ResolutionImportant: You can't update an existing service to use service discovery, or modify the service discovery configuration once your service is created. You can only configure service discovery when you create a new service.Before you get started with service discovery, see Service discovery and review Service discovery considerations.Configure service discovery using either the Amazon ECS console or the AWS Command Line Interface (AWS CLI).Important: After you have configured service discovery, use the YourServiceDiscoveryServiceName.YourServiceDiscoveryNamespace format to query DNS records for a service discovery service within your Amazon Virtual Private Cloud (Amazon VPC).
Question: How do I re-create a terminated EC2 instance?

My Amazon Elastic Compute Cloud (Amazon EC2) instance was terminated, but I want to recover or restore data from that instance. Can I re-create a terminated EC2 instance?ResolutionAs part of an Amazon EC2 instance termination, the data on any instance store volumes associated with that instance is deleted. By default, the root Amazon Elastic Block Store (Amazon EBS) volume is automatically deleted.It's not possible to recover either the original Amazon EC2 instance or any volumes that were deleted as part of the termination process. However, you can use the following methods to re-create the terminated instance:Launch a replacement EC2 instance using Amazon EBS snapshots or Amazon Machine Images (AMI) backups that were created from the terminated Amazon EC2 instance.Attach an EBS volume from the terminated instance to another EC2 instance. You can then access the data contained in those volumes.Use the following methods to prevent instance termination and volume deletion:Enable termination protection of the EBS volume when you launch an EC2 instance. If you enable this option and the instance is later terminated, then the EBS root volume isn't deleted. You can then launch a new EC2 instance from the available root volume. For more information, see How can I prevent my Amazon EBS volumes from being deleted when I terminate Amazon EC2 instances?Set the instance shutdown behavior to stop the instance instead of terminating it. For more information, see Change the instance initiated shutdown behavior.If the instance is part of an Amazon EC2 Auto Scaling group, you can customize the termination policy or use scale-in protection. For more information, see Controlling which Auto Scaling instances terminate during scale in.In addition to regularly taking snapshots and AMIs to back up critical data, consider using termination protection to help prevent this issue in the future. You can also automate snapshots with Amazon Data Lifecycle Manager (Amazon DLM) and AWS Backup.

Related informationHow can I recover an accidentally deleted AMI?My Spot Instance was terminated. Can I recover it?How do I protect my data against accidental Amazon EC2 instance termination?
Question: How do I launch Amazon WorkSpaces with a directory that is currently running in another Region from the same account?

I want to use Amazon WorkSpaces, but the service isn’t yet available in the AWS Region that I currently use for other AWS services. How can I use my Microsoft Active Directory setup in one Region to use Amazon WorkSpaces in a different Region where the service is available?ResolutionTo launch Amazon WorkSpaces using a directory in another Region of the same AWS account, follow the steps below.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, then make sure that you’re using the most recent AWS CLI version.Create virtual private cloud (VPC) peering with another VPC in your accountCreate a VPC peering connection with a VPC in a different Region.Accept the VPC peering connection.The VPC peering connection is activated. You can view your VPC peering connections using the Amazon VPC console, the AWS CLI, or an API.Update route tables for VPC peering in both RegionsUpdate your route tables to turn on communication with the peer VPC over IPv4 or IPv6.You now have two VPCs in your account that are in different Regions, but that are talking to each other.Create an AD Connector and register Amazon WorkSpacesReview the AD Connector prerequisites.Connect your existing directory with AD Connector.When the AD Connector status changes to Active, open the AWS Directory Service console, and then choose the hyperlink for your Directory ID.For AWS apps & services, choose Amazon WorkSpaces to turn on access for Amazon WorkSpaces on this directory.Register the directory with Amazon WorkSpaces.When the value of Registered changes to Yes, you can launch a WorkSpace.

Related informationCreate with VPCs in different accounts and Regions
Question: How do I migrate my SSL certificate to the US East (N. Virginia) Region for use with my CloudFront distribution?

I have an SSL certificate in AWS Certificate Manager (ACM) that I want to associate with my Amazon CloudFront distribution. However, I can't associate the certificate with the distribution because it's not in the US East (N. Virginia) (us-east-1) Region. Can I move the certificate to US East (N. Virginia)?ResolutionYou can't migrate an existing certificate in ACM from one AWS Region to another. Instead, you must import or create a certificate in the target Region.To associate an ACM certificate with a CloudFront distribution, you must import or create the certificate in US East (N. Virginia). Additionally, the certificate must meet the CloudFront requirements.Follow these steps to import or create an ACM certificate for use with a CloudFront distribution:Open the ACM console in the US East (N. Virginia) Region.Note: From the AWS Region selector in the navigation bar, confirm that N. Virginia is selected.Proceed with the steps to import a certificate using the console, or request a certificate using the console.After the certificate is imported or validated successfully, you can associate the certificate and alternate domain names (CNAMEs) with your CloudFront distribution.

Related informationIssuing and managing certificates
Question: How do I remove rate limiting for bulk resource record operations in a Route 53 hosted zone?

My account is rate throttled (API throttled) when I perform bulk resource record operations on my Amazon Route 53 hosted zone.

Short descriptionWhen you are performing bulk resource record operations for your hosted zone in Route 53, you might receive an HTTP 400 (Bad Request) error. A response header that contains a Code element with a value of Throttling and a Message element with a value of Rate exceeded indicates rate throttling.Warning: Rate throttling happens when the number of API requests is greater than the hard limit of five requests per second (per account).If Route 53 can't process the request before the next request for the same hosted zone arrives, it rejects subsequent requests with another HTTP 400 error. The response header contains a Code element with a value of PriorRequestNotComplete and a Message element with a value of the request was rejected because Route 53 was still processing a prior request.Note: API calls by IAM users within the same account count towards global rate throttling for the account and affect API calls made from the AWS Management Console.

ResolutionYou can use the following methods to avoid rate throttling:Batching requestsGroup individual operations of the same type into one change batch operation to reduce API calls.Note: UPSERT requests (update and insert) are counted twice.For example, you could request to CREATE, DELETE, or LIST many records with one batch operation.Using error retries and exponential backoffAdd error retries and exponential backoff to your Route 53 API calls.For example, use a simple exponential backoff algorithm that retries the call in 2^i seconds, where i is the number of retries.Randomizing start timesRandomize the start time for calling Route 53 APIs. Be sure that there aren't multiple applications executing the logic at the same time, because simultaneous requests can cause throttling.Introducing "sleep time" between callsIf the code function calls to Route 53 APIs are consecutive, add "sleep time" in between two calls to minimize throttling risk.Note: If your account is still rate throttled after using these troubleshooting methods, open a support case with Route 53 for assistance to locate the source IP address of the API calls that exceed the per second threshold. Then, you can shut off unnecessary sources, or use these troubleshooting methods to resolve the issue.

Related informationLimits – Amazon Route 53
Question: How do I resolve the error "unable to create input format" in Athena?

When I run a query in Amazon Athena, I get the error "unable to create input format".

ResolutionThere are multiple causes of this error. Here are some common scenarios and solutions:The AWS Glue crawler can't classify the data formatThe data is stored in Amazon Simple Storage Service (Amazon S3).You run an AWS Glue crawler with a built-in classifier to detect the table schema. The crawler returns a classification of UNKNOWN. At least one column is detected, but the schema is incorrect.When you query the table from Athena, the query fails with the error "HIVE_UNKNOWN_ERROR: Unable to create input format".To resolve this error, use a data type that is supported by a built-in classifier. If the data format can't be classified by a built-in classifier, then consider using a custom classifier.Athena doesn't support the data formatThe data is stored in Amazon S3.You run a crawler to create the table. The crawler classifies the table in a format that Athena doesn't support, such as ion or xml.When you query the table from Athena, the query fails with the error "HIVE_UNKNOWN_ERROR: Unable to create input format".To resolve this error, use a data format that Athena supports.One or more of the AWS Glue table definition properties are emptyThe AWS Glue table isn't created in Athena or by an AWS Glue crawler. The table is created using any other method. For example, the table is created manually on the AWS Glue console.When you query the table from Athena, the query fails with the error "HIVE_UNKNOWN_ERROR: Unable to create input format".This error occurs because one or more of the following properties in the AWS Glue table definition are empty:Input formatOutput formatSerde nameConfirm that these properties are set correctly for the SerDe and data format. Keep in mind that the SerDe that you specify defines the table schema. The SerDe can override the DDL configuration that you specify in Athena when you create your table.To update the table definition properties, do the following:Open the AWS Glue console.Select the table that you want to update.Choose Action, and then choose View details.Choose Edit table.Update the settings for Input format, Output format, or Serde name.Choose Apply.The data source in your Athena query is not supportedAthena supports querying tables only if the tables are stored in Amazon S3. You might get the "unable to create input format" error if you query a data source that's not supported by Athena.To resolve this error, use Athena Query Federation SDK. The SDK allows you to customize Athena with your own code. With Athena Federation SDK, you can integrate with different data sources and proprietary data formats. You can also build new user-defined functions. For more information, see Query any data source with Amazon Athena’s new federated query.

Related informationAdding classifiers to a crawlerUsing a SerDe
Question: Why aren't messages that I publish to my Amazon SNS topic getting delivered to my subscribed Amazon SQS queue that has server-side encryption activated?

When I publish messages to my Amazon Simple Notification Service (Amazon SNS) topic, they're not delivered to my Amazon Simple Queue Service (Amazon SQS) queue. How do I fix this issue if my Amazon SNS topic or Amazon SQS queue—or both—have server-side encryption (SSE) activated?Short descriptionYour Amazon SQS queue must use a AWS KMS key (KMS key) that is customer managed. This KMS key must include a custom key policy that gives Amazon SNS sufficient key usage permissions.Note: The required permissions aren't included in the default key policy of the AWS managed KMS key for Amazon SQS, and you can't modify this policy.If your topic has SSE activated, you must also do the following:Configure AWS Key Management (AWS KMS) permissions that allow your publisher to publish messages to your encrypted topic.Resolution1.    Create a new customer managed KMS key with a key policy that has the required permissions for Amazon SNS.2.    Configure SSE for your Amazon SQS queue using the custom KMS key you just created.3.    (If your Amazon SNS topic has SSE activated) Configure AWS KMS permissions that allow your publisher to publish messages to your encrypted topic.For more information, see Activating server-side encryption (SSE) for an Amazon SNS topic with an encrypted Amazon SQS queue subscribed.Note: To troubleshoot other message delivery issues, see Amazon SNS message delivery status.

Related informationEncryption at rest for Amazon SQSEncryption at rest for Amazon SNS dataConfiguring server-side encryption (SSE) for an SNS topicUsing key policies in AWS KMSEncrypting messages published to Amazon SNS with AWS KMS