VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I set up a NAT gateway for a private subnet in Amazon VPC?

I have Amazon Elastic Compute Cloud (Amazon EC2) instances in a private subnet of my Amazon Virtual Private Cloud (Amazon VPC). How can I configure these instances to communicate securely with the internet?Short descriptionA network address translation (NAT) gateway allows EC2 instances to establish outbound connections to resources on internet without allowing inbound connections to the EC2 instance. It's not possible to use the private IP addresses assigned to instances in a private VPC subnet over the internet. Instead, you must use NAT to map the private IP addresses to a public address for requests. Then, you must map the public IP address back to the private IP addresses for responses.

ResolutionCreate a public VPC subnet to host your NAT gateway.Create and attach an internet gateway to your VPC.Create a custom route table for your public subnet with a route to the internet gateway.Verify that the network access control list (ACL) for your public VPC subnet allows inbound traffic from the private VPC subnet. For more information, see Work with network ACLs.Create a public NAT gateway then create and associate your new or existing Elastic IP address.Update the route table of your private VPC subnet to point internet traffic to your NAT gateway.Test your NAT gateway by pinging the internet from an instance in your private VPC subnet.

Related informationMonitor NAT gateways with Amazon CloudWatch
Question: How can I sign or share a compliance report that requires an NDA using AWS Artifact?

I need to sign or share a nondisclosure agreement (NDA) with Amazon Web Services (AWS) for security compliance or auditing purposes.

Short descriptionYou and your AWS Partner Network (APN) can use an AWS account to access reports requiring an NDA using AWS Artifact.

ResolutionFollow the instructions for downloading reports in AWS Artifact.Reports requiring an NDA are accessible by signing the terms and conditions in AWS Artifact. You must accept the AWS Artifact NDA to access and download confidential documents in AWS Artifact. You must sign the NDA each time that you access confidential reports.If you have an existing NDA with Amazon covering the same confidential information as provided in AWS Artifact, then your existing NDA applies. You can use your existing NDA instead of the AWS Artifact NDA.For more information, see AWS Artifact Agreements.Note: Reports requiring approval from Amazon are reviewed and approved within 24 hours. For more information, see Getting Started with AWS Artifact.

Related informationHow can I download and share AWS Artifact documents with regulators and auditors, or with others in my company?AWS Artifact FAQs
Question: How do I view traffic passing through an Amazon Route 53 resolver outbound endpoint?

I want to view traffic passing through Amazon Route 53 resolver outbound endpoint. How can I do this?Short descriptionTo view traffic passing through Route 53 resolver endpoints, configureAmazon Virtual Private Cloud (Amazon VPC) Traffic Mirroring.

ResolutionConfigure network connectivityConfirm the target EC2 instance's security group and network access control list (network ACL) allow incoming traffic on UDP port 4789 from the outbound endpoint elastic network interface.Confirm the target EC2 instance has connectivity to the outbound endpoint's network interface subnet.Confirm the outbound endpoint network interface subset is configured for outgoing traffic for the EC2 instance on UPD port 4789. The subset configuration includes network ACL, security groups, and routing tables.Set up Amazon VPC Traffic Mirroring1.    Create a traffic mirror target using the network interface of the EC2 instance you're using as the target.2.    Create a mirror filter to identify the DNS traffic from the outbound endpoint network interface to the EC2 mirror target.Example mirror filter for Route 53Note: The example values in this table represent the following:VPC A is associated with Route 53 resolve rule to forward *.test.com domain DNS queries to on-premise networkOn-premise network is hosting domain *.test.comValueInbound RuleOutbound RuleRule numberRule priorityRule priorityRule ActionAcceptAcceptProtocolUDP and TCPUDP and TCPSource port range531024-65535Destination port range1024-6553553Source CIDR blockOn-premise CIDRVPC A CIDRDestination CIDR blockVPC A CIDROn-premise CIDR3.    Create a mirror session for each outbound endpoint network interface to the mirror EC2 instance. Use the following values:            Mirror source: outbound endpoint network interfaceMirror target: traffic mirror that you created previouslySession number: 1Filter: mirror filter that you created previouslyView mirrored trafficFor Linux operating systems1.    View the captured traffic logs by running the following command:sudo tcpdump -w <filename>.pcap -i <eth> port 4789For filename, use the filename where you want to store the captured traffic logs. For eth, use the ethernet port that you want to use on your EC2 instance. 2.    Transfer the file from the EC2 instance to your local computer by running the following command:scp -i <keypair>.pem ec2-user@<ec2 instance's public/private DNS name or IP address>:<file path>/<filename>.pcap ~/Desktop/For keypair, use the keypair you used to log into the instance. For filename, use the filename where you want to store the captured traffic logs.3.    Open the capture file to view the DNS packets.For windows operating systems1.    Open the Wireshark tool.2.    Filter traffic using the IP address of the outbound resolver endpoint.3.    Open the capture file to view the DNS packets.

Related informationResolving Domain Name System (DNS) queries between VPCs and your network
Question: How do I customize my nginx configuration to modify the "client_max_body_size" in Elastic Beanstalk?

I want to upload large size files to my AWS Elastic Beanstalk environment without receiving the error message "413 Request Entity Too Large".

Short descriptionBy default, NGINX has a limit of 1MB on file uploads. If the size of a request exceeds the configured value, then the 413 Request Entity Too Large error is returned. To upload files larger than 1 MB, configure the client_max_body_size directive in the NGINX configuration files.Important: M and MB are equivalent expressions for "megabyte". For example, 2M is equal to 2 MB. However, use only M in your configuration file, as MB isn't valid in a configuration file.

ResolutionTo configure the client_max_body_size in Amazon Linux 2 environments, do the following:1.    To extend the Elastic Beanstalk default NGINX configuration, add the .conf configuration file client_max_body_size.conf that includes the following:client_max_body_size 50M;Note: In the preceding example, the value of the client_max_body_size is updated to 50M. Substitute any value in place of 50 as per your requirements.2.    Copy the .conf configuration file client_max_body_size.conf to a folder named .platform/nginx/conf.d/ in your application source bundle. The Elastic Beanstalk NGINX configuration includes .conf files in this folder automatically. Make sure to create this path if it doesn't exist in your source bundle. The following example shows the structure of the .platform directory and .conf file in the application zip file:-- .ebextensions       -- other non nginx server config files            -- .platform       -- nginx           -- conf.d                 -- client_max_body_size.conf                   -- other application filesThe file client_max_body_size.conf has a path like this: my-app/.platform/nginx/conf.d/client_max_body_size.conf.3.    Deploy your code and the new .platform/ directory together as a new application version in your Elastic Beanstalk environment.4.    After the deployment is completed, log in to the instance running on the Elastic Beanstalk environment. After logging in, check that the settings to the NGINX server are applied. To do this, use the following command:$ sudo nginx -T | egrep -i "client_max_body_size"nginx: the configuration file /etc/nginx/nginx.conf syntax is oknginx: configuration file /etc/nginx/nginx.conf test is successfulclient_max_body_size 50M;
Question: How do I troubleshoot BGP connection issues over VPN?

My BGP session can't establish a connection or is in an idle state over my VPN tunnel. How can I troubleshoot this?ResolutionTo troubleshoot BGP connection issues over VPN, check the following:Check the underlying VPN connectionFor BGP-based VPN connections, the BGP session can be established only if the VPN tunnel is up. If the VPN tunnel is down or flapping, then you experience issues with establishing the BGP session. Verify that the VPN is up and stable. If the VPN isn't coming up or it isn't stable, see the following:Why is IKE (phase 1 of my VPN tunnel) failing in Amazon VPC?I can’t establish my VPN tunnel: IPsec is failingHow do I troubleshoot VPN tunnel inactivity or instability or tunnel down on my customer gateway device?Check the BGP configuration on your customer gateway deviceThe IP addresses of the local and remote BGP peers must be configured with the downloaded VPN configuration file from the VPC console.The local and remote BGP Autonomous System Numbers (ASN) must be configured with the downloaded VPN configuration file from the VPC console.If the configuration settings are correct, then ping the remote BGP peer IP from your local BGP peer IP to verify the connectivity between BGP peers.Be sure that the BGP peers are directly connected to each other. External BGP (EBGP) multi-hop is turned off on AWS.Note: If your BGP session is flapping between active and connect states, verify that TCP port 179 and other relevant ephemeral ports are not blocked.Debugs and packet capturesIf the BGP configuration on the customer gateway is verified and the pings between the BGP peer IPs are working, then collect this information from the customer gateway device for further analysis:BGP and TCP debugsBGP logsPacket captures for traffic between the BGP peer IPsCheck if the BGP session is going from established to idle statesFor VPN on a VGW, if you see the BGP session going from established to idle state, then verify the number of routes that you are advertising over the BGP session. You can advertise up to 100 routes over the BGP session. If the number of routes advertised over the BGP session is more than 100, then the BGP session goes to the idle state.To resolve this, do one of the following:Advertise a default route to route to AWS, or summarize the routes so that the number of routes received is fewer than 100.-or-You can migrate your VPN connection to a transit gateway as transit gateway supports 1,000 routes advertised from a customer gateway.For more information, see Site-to-Site VPN quotas.

Related informationHow can I troubleshoot BGP connection issues over Direct Connect?Amazon VPC FAQs
Question: "How can I find who stopped, rebooted, or terminated my EC2 Windows instance?"

My Amazon Elastic Compute Cloud (Amazon EC2) Windows instance was unexpectedly stopped, rebooted, or terminated. How can I identify who stopped, restarted, or terminated the instance?ResolutionAn EC2 Windows instance can be stopped or rebooted either through AWS or through the Windows operating system. An EC2 Windows instance can be terminated only through AWS.If the instance was stopped, rebooted, or terminated through AWSYou can stop, reboot, or terminate your instance through AWS from:The AWS Management ConsoleThe AWS Command Line Interface (AWS CLI)AWS Tools for PowerShellAWS APIsAWS SDKIf the event occurred in the last 90 days, then you can get more information about the event using AWS CloudTrail logs. To view the event on CloudTrail, follow these steps:Open the CloudTrail console.In the navigation pane, choose Event history.In the Lookup attributes dropdown menu, select Event name.For Enter an event name, enter StopInstances if your instance was stopped. Enter RebootInstances if your instance was rebooted. Enter TerminateInstances if your instance was terminated.To see more information about an event, choose the event name. On the StopInstances, RebootInstances, or TerminateInstances details page, you can see the user of the AWS Identity and Access Management (IAM) that initiated the event.If the instance was stopped or rebooted within the Windows OSIf the instance wasn't stopped or rebooted through AWS, then the event was likely initiated within the Windows OS. To find more information about this event within the Windows OS, follow these steps while logged in to the instance:Open Event Viewer.On the navigation pane, expand Windows Logs and then choose System.On the Actions pane, choose Filter Current Log.In the All Event IDs field, enter 1074 or 1076.The event log indicates which user initiated the event in the Source field.Note: An EC2 Windows stop or reboot can occur at the Windows OS level when:A user is logged into the instance and a Windows update reboots the OS.An unexpected hardware failure occurs.An AWS planned maintenance event stops or restarts the instance.A third-party tool issued the command.AWS sends notifications about planned instance retirements and unexpected hardware failure over email or on your Personal Health Dashboard.
Question: How do I protect my data against accidental EC2 instance termination?

What are some options that AWS offers that can help me protect my data against accidental Amazon Elastic Compute Cloud (Amazon EC2) instance termination? How can I troubleshoot and collect more information about probable termination causes and behaviors?ResolutionTo help protect against data loss caused by accidental termination of an Amazon EC2 instance, consider the following options when you configure EC2 infrastructure:Enable termination protection. Termination protection prevents an instance from accidental termination. By default, this option is disabled for EC2 instances. Enable this option to protect your instance from any unintentional termination. For more information, see Enable termination protection.Regularly back up your data. Back up your instance by doing one or more of the following:Create an Amazon Machine Image (AMI). An AMI can capture the data on all the EBS volumes attached to an instance. You can use the AMI to launch a new instance.Schedule regular Amazon Elastic Block Store (Amazon EBS) snapshots.Use AWS Backup.Output data to another AWS service or source. Consider using one of the following services to store the workflows you run on your instance:Amazon Simple Storage Service (Amazon S3)Amazon Relational Database Service (Amazon RDS)Amazon DynamoDBRecreate your instance or restore data from a terminated instance. If you backed up your instances, then you can use the backup to restore the terminated instance. For more information, see How do I recreate a terminated EC2 instance?Troubleshoot termination behaviors to identify the causes of termination. Several issue can cause your instance to terminate immediately on start-up. Or, your instance configuration might lead to instance termination. For more information, see Troubleshoot instance termination (shutting down) and Why did Amazon EC2 terminate my instance?Related informationBest practices for Amazon EC2Best practices for Windows on Amazon EC2How can I automate Amazon EBS snapshot management using Amazon Data Lifecycle Manager?
Question: How do I create a snapshot of an Amazon EBS RAID array?

I want to create snapshots of my Amazon Elastic Block Store (Amazon EBS) volumes that are configured in a RAID array. How can I take crash consistent snapshots across multiple Amazon EBS volumes on an Amazon Elastic Compute Cloud (Amazon EC2) instance?Short descriptionTo create snapshots for Amazon EBS volumes that are configured in a RAID array, use the multi-volume snapshot feature of your instance. The multi-volume snapshot feature is a one-click solution that takes individual, point-in-time backups of all Amazon EBS volumes attached to your instance. This process makes sure that the backup of your Amazon EBS volumes attached to the instance are in sync relative to each other, resulting in an accurate restore of the Amazon EBS volumes in RAID.Note: You can automate snapshot creation using the Amazon Data Lifecycle Manager.

ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Use the AWS Management Console or AWS CLI to create snapshots.Note: After the snapshots are created, each snapshot is treated like an individual snapshot. It's a best practice that you tag your multiple volume snapshots to manage them together during operations such as restore, copy, or retention.AWS Management Console1.    Open the Amazon EC2 console.2.    Under Elastic Block Store, select Snapshots.3.    Select Create Snapshot.4.    Choose Instance as the resource type.5.    Select the instance ID from the drop-down menu.6.    (Optional) Enter a Description of the snapshot.7.    (Optional) Select Copy Tags to automatically copy tags from the source volume to the corresponding snapshots.8.    Click Create Snapshot.AWS Command Line Interface (AWS CLI)Use the CreateSnapshots API.create-snapshots[--description <value>]--instance-specification <value>[--tag-specifications <value>][--dry-run | --no-dry-run][--copy-tags-from-source <value>][--cli-input-json <value>][--generate-cli-skeleton <value>]For parameter descriptions and example calls, refer to AWS CLI Command Reference - create-snapshots.

Related informationTaking crash-consistent snapshots across multiple Amazon EBS volumes on an Amazon EC2 instanceCreating an Amazon EBS snapshot - Multi-volume snapshotsRAID configuration on WindowsRAID configuration on LinuxBenchmark EBS volumes
Question: Why did I receive the AWS account ID status "Verification failed" with GuardDuty?

To manage multiple accounts in Amazon GuardDuty, I invited an AWS account to associate with my AWS account using AWS Organizations. The status of the member account is "Verification failed."Short descriptionTo manage multiple accounts in GuardDuty, you must choose a single AWS account to be the administrator account for GuardDuty. You can then associate other AWS accounts with the administrator account as member accounts.You can associate accounts with a GuardDuty administrator account with either of the following:An AWS Organizations organization that both accounts are members of.An invitation that's sent through GuardDuty.To send an invitation from the GuardDuty administrator account, you must specify the member account's account ID and email address. The "Verification failed" status indicates that the root email address or the account ID that you added as a GuardDuty member account are incorrect.For more information, see Managing multiple accounts in Amazon GuardDuty.

ResolutionFollow these steps to designate a GuardDuty delegated administrator, and add member accounts using the GuardDuty console.Important:Be sure to use the root email address and account ID associated with the account.GuardDuty must be turned on in the member account before sending an invitation.You can bulk add accounts by uploading a .csv file. Be sure to specify the account ID and primary email address separated by a comma on separate lines. The first line of the .csv file must contain the account ID and email header in the following format:Account ID,Email111111111111,primary1@example.com222222222222,primary2@example.comYou can also use Python scripts to turn on GuardDuty in multiple accounts simultaneously. For this method, make sure that the accounts in the input .csv file are listed one per line. Use the account ID and email address without headers in the following format:111111111111,primary1@example.com222222222222,primary2@example.comAfter the GuardDuty member account accepts the invitation, the Status column for your member account changes to Enabled in the administrator account.

Related informationHow do I set up a trusted IP address list for GuardDuty?
Question: How can I map Availability Zones across my accounts?

An Availability Zone (AZ) in my account doesn't map to the same location as an AZ with the same name in a different account. I want to coordinate the distribution of my resources to the AZs across my accounts to confirm fault tolerance, improve performance, or optimize costs. How can I map AZs across accounts?ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.AZ names don't map to the same location across accounts. However, you can use Availability Zone IDs (AZ IDs) to map AZ across accounts:Open the AWS Resource Access Manager console.In the navigation bar, select your Region from the Region selector.In the Your AZ ID pane on the right, review the list of AZ names and their corresponding AZ IDs.Note: You can also use the aws ec2 describe-availability-zones --region "region-name" command in the AWS CLI to generate AZ ID information. Be sure to replace "region-name" with the name of your AWS region.Identify which AZ have the same AZ IDs across your accounts. AZs that have the same AZ IDs map to the same physical location.You can gain better insight into your resources by using the information from performing the previous steps. Then, you can make informed decisions on things such as:Launching new instances in a subnet that was created in your desired AZ.Moving an EC2 instance to another subnet, Availability Zone, or VPC.

Related informationUse consistent Availability Zones in VPCs across different AWS accounts
Question: How can I invoke a Lambda function asynchronously from my Amazon API Gateway API?

I want to invoke an AWS Lambda function asynchronously instead of synchronously for my Amazon API Gateway API.

ResolutionREST APIsIn Lambda non-proxy integration, the backend Lambda function is invoked synchronously by default. You can configure the Lambda function for a Lambda non-proxy integration to be invoked asynchronously by specifying 'Event' as the Lambda invocation type.1.    Open the API Gateway console, choose APIs, and then choose your REST API.2.    In Resources, choose GET, and then choose Integration Request.3.    In Integration type, choose Lambda Function.4.    Expand HTTP Headers, and then choose Add header.5.    For Name, enter X-Amz-Invocation-Type.6.    For Mapped from, enter 'Event'.7.    Redeploy the REST API.To invoke the Lambda function with the option for either asynchronous or synchronous, add an InvocationType header.1.    Open the API Gateway console, choose APIs, and then choose your REST API.2.    In Resources, choose GET, and then choose Method Request.3.    In Request Validator, choose the edit icon, choose the dropdown list, and then choose Validate query string parameters and headers.4.    Choose the update icon to save changes.5.    Expand HTTP Headers, and then choose Add header.6.    For Name, enter InvocationType, and then choose Required.7.    In Integration Request, Expand HTTP Headers, and then choose Add header.8.    For Name, enter X-Amz-Invocation-Type.9.     For Mapped from, enter method.request.header.InvocationType.10.    Redeploy the REST API.Clients can include the InvocationType: Event header in API requests for asynchronous invocations or InvocationType: RequestResponse for synchronous invocations.For more information, see Set up asynchronous invocation of the backend Lambda function.HTTP APIsHTTP APIs only support proxy integrations for Lambda. You can't set the X-Amz-Invocation-Type header in the API Gateway integration for HTTP APIs. You can use two Lambda functions with one acting as proxy.Example configuration:HTTP API --> Invoke Lambda1 synchronously --> Invoke Lambda2 asynchronously