VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why can't I select my preferred alias target when creating a Route 53 alias resource record set?

I'm creating an Amazon Route 53 alias resource record set in the Route 53 console, but I can't select my preferred resource from the Alias Target list.

Short descriptionIf no resources are available when creating an alias record using the Route 53 console, then the Alias Target list shows the message No Targets Available. Verify the following:Route 53 supports your resource as an alias target.The resource is on the same AWS account as your Route 53 hosted zone.If you're routing to an Amazon CloudFront distribution, the resource record name matches a CNAME in the CloudFront distribution.If you're routing to an Amazon Simple Storage Service (Amazon S3) bucket, the resource record name matches the Amazon S3 bucket name.

ResolutionVerify that Route 53 supports your resourceTo verify that Route 53 supports your resource and that you've configured your resource correctly, see Value/route traffic to.Verify that you're routing to resources on the same accountTo route to resources on a different AWS account, enter a value that identifies the resource.For example, to use an Amazon CloudFront distribution as an alias target, enter the CloudFront domain name.Check CloudFront distribution namesBefore routing to CloudFront distributions, be sure that the name of the resource record that you create matches a CNAME in the CloudFront distribution.For example, if the record name is example.com, then your CloudFront distribution must use example.com as one of its alternate domain names.Check S3 website endpoint namesMake sure that the name of the resource record for your Amazon S3 website endpoint matches the name of your Amazon S3 bucket. Also, configure your bucket for website hosting.For example, if your bucket's name is AWSDOC-EXAMPLE-BUCKET, the record name must also be AWSDOC-EXAMPLE-BUCKET.

Related informationValues specific for simple alias records
Question: How can I disable temporary credentials access while using query editor in Amazon Redshift?

I don't want users connecting to the Amazon Redshift query editor using temporary credentials. How can I disable temporary credentials access to the query editor?Short descriptionYou can connect to an Amazon Redshift cluster with the query editor using:AWS Secrets Manager.-or-AWS Identity and Access Management (IAM) temporary credentials.For more information, see Connecting with the query editor.

ResolutionFollow these instructions to create an IAM policy to restrict access to the query editor with temporary credentials.1.    Open the IAM console.2.    If you haven't already done so, create an IAM user.3.    In the navigation pane, choose Users.4.    In User name, choose the IAM user that you want to use to prevent access to the query editor.5.    Choose the Permissions tab, and then choose Add inline policy.6.    Choose the JSON policy tab, and then paste the following policy:Note: Replace account ID, cluster name, db-name, db-group, and db-user with your variables.{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "VisualEditor0",      "Effect": "Deny",      "Action": "redshift:GetClusterCredentials",      "Resource": [        "arn:aws:redshift:<region>:<account ID>cluster:<cluster name>"        "arn:aws:redshift:<region>:<account ID>:dbname:<cluster name>/<db-name>",        "arn:aws:redshift:<region>:<account ID>:dbgroup:<cluster name>/<db-group>",        "arn:aws:redshift:<region>:<account ID>:dbuser:<cluster name>/<db-user>"      ]    }  ]}7.    Choose Review policy.8.    For Name, enter a name for the policy, and then choose Create policy.Attempts to access the query editor using this IAM user with temporary credentials receive an error similar to the following:"Databases couldn't be listed".For more information, see Create an IAM role or user with permissions to call GetClusterCredentials.

Related informationWhy can't I connect to the Amazon Redshift query editor?Resource policies for GetClusterCredentials
Question: How do I assign a custom primary private IP address to my Amazon EC2 instance?

I want to assign a custom primary private IP address to my Amazon Elastic Compute Cloud (Amazon EC2) instance.

Short descriptionYou can associate a custom private IP address to your Amazon EC2 instance while you configure the instance before you launch it. However, the IP address must meet these conditions:Have a valid IPv4 range.Be within the CIDR range of the chosen subnet.Be available. The private IP address must not be tied to any other resource.Note: It's not possible to assign a new custom primary private IP address to an existing instance.

ResolutionConfigure an Amazon EC2 instance. For detailed steps, see Launch an instance using the old launch instance wizard or Launch an instance using the new launch instance wizard.In the Configure Instance Details section, for Network, select a virtual private cloud (VPC), or create a new VPC. For Subnet, select the subnet, or create a new subnet where you want to launch your instance.In the Network interfaces section, for Primary IP (the primary private IPv4 address of the network interface), enter the custom private IPv4 address.Complete the launch instance wizard configurations, and then launch the instance.

Related informationVPCs and subnets
Question: Why is the default value of the shared_buffers DB parameter for Aurora PostgreSQL higher than the default value for Amazon RDS PostgreSQL?

I want to understand the differences between default values of DB parameter groups for Amazon Aurora PostgreSQL and Amazon Relational Database Service (Amazon RDS) PostgreSQL?ResolutionPostgreSQL recommends using a reasonable starting value for shared_buffers of 25% of the memory in your system. However, you can change this value depending on your workload requirements. To find an appropriate value for shared_buffers for your workload, see the PostgreSQL documentation for Resource Consumption.PostgreSQL relies heavily on the operating system for its caching (double buffering). As a result, allocating more than 40% of RAM to shared_buffers is unlikely to perform better than a smaller value.For RDS DB instances, the default value of the DB parameter group is set to 25% of total memory. For Aurora DB instances, the default value of the DB parameter group is set between 50% and 75%, depending on the instance class. Default values for Aurora DB instances are higher because Aurora PostgreSQL eliminates double buffering and doesn't utilize file system cache. As a result, Aurora PostgreSQL can increase shared_buffers to improve performance. It's a best practice to use the default value of 75% for the shared_buffers DB parameter when using Aurora PostgreSQL. A smaller value can degrade performance by reducing the available memory to the data pages while also increasing I/O on the Aurora storage subsystem. For more information, see Amazon Aurora PostgreSQL reference.Note: You might need to reduce the value of the shared_buffers parameter for some workloads. For example, you might need to reduce the value if your workload accepts a large number of connections that is higher than the default value, or if you frequently use larger work_mem, maintenance_work_mem, and so on. However, a smaller value for shared_buffers means that the cache hit ratio is also lower. As a result, you might see an increase in access latency for database pages because of frequent storage access.

Related informationWorking with parameter groups
Question: How do I dynamically use parameters stored in Systems Manager with an AWS CloudFormation stack?

I have multiple parameter values stored in the AWS Systems Manager Parameter Store. I want to use these parameters dynamically in an AWS CloudFormation stack based on my requirements.

Short descriptionThe following resolution uses Microsoft Windows and Linux as example environments to demonstrate how to use different parameters dynamically in a CloudFormation stack.Important: When you use the following commands and template, make sure to replace Windows and Linux with your requirements.Resolution1.    Open the AWS Systems Manager console.2.    In the navigation pane, choose Parameter Store.3.    Create Systems Manager parameters as type String to store Amazon Machine Image (AMI) IDs for Linux or Windows.Linux:LinuxAmiId - AMI-Id-for-Linux-resources-or-Windows:WindowsAmiId - AMI-Id-for-Windows-resourcesNote: Replace AMI-Id-for-Linux-resources and AMI-Id-for-Windows-resources with the AMI IDs for your resources.4.    Use the following example CloudFormation template to create the parameter that selects which AMI to use for deployment: "Parameters": {    "AmiToUse": {      "Type": "String",      "AllowedValues": [        "windows",        "linux"      ]    }  },  "Conditions": {    "CreateWindowsResources": {      "Fn::Equals": [        "windows",        {          "Ref": "AmiToUse"        }      ]    }  },  "Resources": {    "EC2Instance": {      "Type": "AWS::EC2::Instance",      "Properties": {        "ImageId": {          "Fn::If": [            "CreateWindowsResources",            "{{resolve:ssm:WindowsAmiId:1}}",            "{{resolve:ssm:LinuxAmiId:1}}"          ]        }      }    }  }Note: In the preceding template, if AmiToUse is selected as windows, then the CreateWindowsResources condition evaluates to true. CloudFormation uses the value stored at WindowsAmiId to provision the AWS::EC2::Instance resource. For Linux, the condition evaluates to false, and CloudFormation uses the value stored at LinuxAmiId to provision the AWS::EC2::Instance resource.For more information on dynamic referencing, see Use dynamic references to specify template values.

Related informationCloudFormation Workshop: Dynamic reference lab
Question: How do I set up an email forwarding rule in WorkMail?

I want to create a rule in Amazon WorkMail that forwards my received email messages to another email address. How can I do this?ResolutionYou can create a rule in your mailbox that forwards emails that match specific conditions to the intended party. Replies to the forwarded email will go to the email account that created the email forwarding rule.For instructions, see Working with email rules, and then follow the steps for To create an email forwarding rule.Note: Email rules don't work for recipients in Bcc.

Related informationHow do I set up an email redirecting rule in WorkMail?Signing in to the Amazon WorkMail web clientAmazon WorkMail FAQs
Question: How do I troubleshoot common issues when using my Amazon MSK cluster with SASL/SCRAM authentication?

I'm facing issues with my Amazon Managed Streaming for Apache Kafka (Amazon MSK) cluster with SASL/SCRAM authentication enabled.

ResolutionYou're getting the ClusterAuthorizationException error in broker logsYou might see the following error message when you access your Amazon MSK cluster:org.apache.kafka.common.errors.ClusterAuthorizationException: Request Request(processor=11, connectionId=INTERNAL_IP-INTERNAL_IP-0, session=Session(User:ANONYMOUS,/INTERNAL_IP), listenerName=ListenerName(REPLICATION_SECURE), securityProtocol=SSL, buffer=null) is not authorized.You get this error when both the following conditions are true:Your Amazon MSK cluster has Simple Authentication and Security Layer (SASL)/Salted Challenge Response Mechanism (SCRAM) authentication enabled.You've set resourceType=CLUSTER and operation=CLUSTER_ACTION in the access control lists (ACLs) for your cluster.The Amazon MSK cluster doesn't support this setting because this setting prevents the internal Apache Kafka replication. With this setting, the identity of the brokers appear as ANONYMOUS for inter-broker communication. If you need your cluster to support these ACLs while using the SASL/SCRAM authentication, then you must grant the permissions for ALL operations to the ANONYMOUS user. This prevents the restriction of replication between the brokers. Use the following command to grant this permission to the ANONYMOUS user:./kafka-acls.sh --authorizer-propertieszookeeper.connect=example-ZookeeperConnectString --add --allow-principalUser:ANONYMOUS --operation ALL --clusterYou changed the user name and/or password for your AWS Secrets Manager secret, but the old credentials are still activeAn AWS Secrets Manager secret must be associated with a single user. If the user no longer needs access to the cluster, the secret must be dissociated, and the ACLs must be updated. When you update the user name on the secret, the old user name is not automatically dissociated. Therefore, it's a best practice to create a new secret for the new user. If you need to use the old secret, first dissociate the secret, and then update the credentials before associating the secret again. For more information, see Working with users.Non-admin users are able to create new ACLs and modify the existing ACLsBy default, any user can create or modify ACLs. To prevent non-admin users from creating or updating ACLs using Apache ZooKeeper, be sure to restrict access to Apache ZooKeeper by placing the zooKeeper nodes in a separate security group. Also, be sure all the Apache Kafka commands and client connections are run through bootstrap brokers instead of Apache ZooKeeper. Note that all Apache Kafka operations can be performed using the bootstrap string.

Related informationApache Kafka ACLsScram secrets
Question: How can I turn on SSL on my Aurora PostgreSQL-Compatible DB instance and how can I connect to my instance using SSL certificates?

I want to connect to my Amazon Aurora PostgreSQL-Compatible Edition DB cluster using a Secure Socket Layer (SSL) connection.

Short descriptionYou can encrypt a connection to your Aurora PostgreSQL-Compatible DB cluster from your application using either SSL or Transport Layer Security (TLS). SSL and TLS connections provide a single layer of security for your cluster, and encrypt the data that moves between your client and cluster. For more information, see Using SSL/TLS to encrypt a connection to a DB cluster.To be secure, SSL connections must be configured on both the client and server before you make the connection. If SSL is not configured on the server, then the client might send sensitive information like passwords. For more information on creating an SSL-secured connection, see the PostgreSQL documentation for SSL support.The SSL modes for PostgreSQL are:verify-fullverify-carequirepreferallowdisableFor more information on choosing the right SSL mode for your use case, see the PostgreSQL documentation for Protection provided in different modes.

ResolutionAmazon Relational Database Service (Amazon RDS) creates the SSL or TLS certification for your cluster when you create it. For more information, see Security with Amazon Aurora PostgreSQL.Connect to your DB cluster over SSL/TLS1.    Download the SSL/TSL certificate.2.    Import the certificate into your operating system.3.    Connect to your Aurora PostgreSQL-Compatible DB cluster over SSL/TLS.See this example:psql -h DBInstance.cluster-Account-Number.eu-west-1.rds.amazonaws.com  -p 5432 "dbname=postgres user=postgres sslrootcert=global-bundle.pem sslmode=verify-full"When you set rds.force_ssl to 1 (on), your DB instance's pg_hba.conf file is modified to support the new SSL configuration. You can use the pg_hba_file_rules view to see the summary of contents of the pg_hba.conf file. The type value in the pg_hba_file_rules view is updated to hostssl after rds.force_ssl is set to 1 (on).You can make it a requirement that connections to your DB cluster use SSL/TLS. To do this, use the rds.force_ssl parameter. The rds.force_ssl parameter is set to 0 by default, meaning it is turned off. To turn this parameter on, set rds.force_ssl to 1. This makes SSL/TLS a requirement for connections to your DB cluster.For more information, see Securing Aurora PostgreSQL data with SSL/TLS.Review the SSL connectionTo review that the SSL connection, run this command:postgres=> select ssl_is_used(); ssl_is_used------------- t(1 row)postgres=> select ssl_cipher();         ssl_cipher----------------------------- ECDHE-RSA-AES128-GCM-SHA256(1 row)
Question: How do I subscribe to Microsoft Office license with BYOL Amazon WorkSpaces?

I want to add or subscribe to Microsoft Office license with BYOL Amazon WorkSpaces.

ResolutionBefore you begin, be sure that the following prerequisites are met:Your account is eligible for BYOL WorkSpaces. For more information, see Check the eligibility of your account for BYOL using the Amazon WorkSpaces console.You've enabled BYOL for your account using the Amazon WorkSpaces console.To add Microsoft Office to Workspaces, use one of the following methods:Add Microsoft Office when you create the BYOL image for deploying WorkSpaces. If you are using Windows 10, you have the option to subscribe to Microsoft Office Professional 2016 (32-bit) or 2019 (64-bit) through AWS. If you choose this option, Microsoft Office is pre-installed in your BYOL image and included on any WorkSpaces that you launch from this image. Use the new BYOL image to deploy WorkSpaces. For more information, see Add Microsoft Office to your BYOL image.Add Microsoft Office to the existing BYOL WorkSpaces. First, create a BYOL bundle that's subscribed to Microsoft Office. Then, use the WorkSpaces migration feature to migrate your current BYOL WorkSpaces with this new BYOL bundle.Upgrade your Microsoft Office package. You can upgrade your Microsoft Office package from Office 2016 to Office 2019 or vice versa. Create a BYOL image with the required Office version. Then, with the WorkSpaces migration feature, migrate your BYOL WorkSpaces using the new BYOL WorkSpaces bundle.

Related informationBring Your Own Windows desktop licenses
Question: Can I reopen my closed AWS account?

I closed my AWS account, but I want to reopen it and continue using AWS services.

Short descriptionIf you closed your account less than 90 days ago, then you can sign in to your account and file a support case to reopen the account.After 90 days, you can't reopen your closed account or open a new AWS account with the email address associated with your closed AWS account. Any content remaining in your closed account will be deleted.To create new AWS accounts or use AWS services, create a new AWS account using a different email address.Service attributes are retained as long as needed for billing and administration. AWS retains your account information as described in the Privacy Notice.

ResolutionReopen your accountIf you have closed your account within the last 90 days, then contact AWS Support to reopen your account using the following steps:Sign in to your AWS account as the root user. This is required to reopen an account.Check that a valid default payment method is associated with your account.Open a support case.In the Create case section, select Account and billing support, and enter all the required details.If your need is urgent, choose the Phone contact method to have an AWS Support agent contact you to help reopen your account.After AWS reopens your accountNote: After AWS reopens your account, it can take up to 24 hours for all services to activate.After your account is reopened, do the following:When you receive the email confirming that your services are active, sign in to the AWS Management Console.Re-subscribe to AWS services.Verify that your account and payment methods are correct and update any outdated information. Be sure to check your email address, phone number, account name, and your mailing address.After your account is re-established, check the following:If you had any Amazon Elastic Compute Cloud (Amazon EC2) instances, check if they are in a stopped state. You might need to restart your Amazon EC2 instances.If you had any Amazon Relational Database Service (Amazon RDS) instances, you can restore these instances from an automatically generated snapshot. For more information, see Restoring from a DB snapshot.Note: The snapshot was taken on the account closure date and is available for up to 30 days from the date the account was reopened.If you had any AWS Marketplace subscriptions, you must cancel your subscription and re-subscribe to the product.Check for active resources that you no longer need. To find all your active resources, see How do I check for active resources that I no longer need on my AWS account?Note: You might incur charges for any AWS services and resources that you didn’t delete before you originally closed your account.Note: The account resources in AWS China (Beijing) and AWS China (Ningxia) Regions are subject to the policies of operating partners (Sinnet in the Beijing Region and NWCD in the Ningxia Region). Account closure procedures might take longer in China than in other AWS Regions.

Related informationHow do I close my AWS account?Closing an account
Question: How do I use a software license that I own on AWS hardware?

I own a software license, and I want to use it on AWS hardware.

ResolutionAlthough AWS can’t provide licensing advice, we offer tools to help you use your licensed software on AWS infrastructure.Because some software licenses specify the types of hardware, lengths of time, or number of machines they can be run on, you might consider running your software on instances in a Dedicated Host.Dedicated Hosts are a way to provision an entire physical server for your own use, which can help you meet the requirements of some software licenses. Dedicated Hosts also support host recording using AWS Config, which can help with license reporting. For more information, see Bring your own license.If your software is a Microsoft product, see License Mobility for more information on how to use Microsoft software on AWS infrastructure.Your software might also be listed in the AWS Marketplace, and some software providers offer a "Bring Your Own License" (BYOL) version of their software, ready to launch on AWS infrastructure. For more information, see AWS Marketplace Buyers Guide.

Related informationAmazon EC2 Dedicated Hosts