VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I migrate my transit VPC to a transit gateway?

How do I migrate my Amazon Virtual Private Cloud (Amazon VPC) from a Transit VPC to a Transit Gateway.

ResolutionCreate a transit gateway.Create the Amazon VPC attachments for the spoke VPCs. If the spoke VPCs:Are in different accounts, share the transit gateway to the second account. Then, create attachments in the second account.Are in different Regions, create a new transit gateway in the second Region. Then, create a peering attachment between the two transit gateways.Create transit gateway virtual private network (VPN) connections to the on-premises networks, if applicable.Note: After the VPN tunnels are UP, you can change the on-premises gateway to prefer the transit gateway VPN tunnels over the virtual gateway tunnels.Configure the transit gateway route tables.In the spoke VPC route tables, change the target from the virtual private gateway to the transit gateway. Be sure to modify the spoke VPC route tables only during a schedule maintenance window.After communication is established on the transit gateway, remove each of the spoke VPC tags individually. Then, delete any VPNs connected to on-premises networks, if applicable. These actions remove the VPN connection between the spoke VPC and the transit network VPC.Note: The default tag for the spoke VPCs is configured with key: transitvpc:spoke and  value: true.After all spokes are migrated to the transit gateway, delete the transit network VPC AWS CloudFormation stack.
Question: How can I resolve certificate expired or "invalid certificate" errors when invoking an API Gateway API using a custom domain name?

I set up a custom domain name for my API Gateway API. I received an error that the AWS Certificate Manager (ACM) certificate is expired or "invalid certificate". How can I resolve this error?Short descriptionThe certificate has expired error occurs when the certificate used for creating the custom domain name is expired.The "invalid certificate error" occurs because of a mismatched common name (CN) or subject name in the certificate.

ResolutionExpired ACM certificatesIf your certificate is expired, you might receive an error similar to the following:"SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED]"To check the certificate expiry, run the OpenSSL command s_client similar to the following:openssl s_client -servername <custom domain name> -connect <custom domain name>:443 2>/dev/null | openssl x509 -noout -datesTo renew the certificate, see Managed renewal for ACM certificates.To avoid expired certificates, see How to monitor expirations of imported certificates in ACM.Mismatched ACM certificatesIf your certificate has a mismached CN or subject name, you might receive an error similar to the following:"ERR_CERT_COMMON_NAME_INVALID"Confirm the following settings:The certificate used to create the custom domain name exists in ACM.The certificate subject name or CN includes the custom domain name. For example, if the custom domain name is custom.example.com, then the subject name or CN must include custom.example.com or *example.com.Make sure that there is a DNS record pointing to the API Gateway custom domain name. The DNS record can be either a CNAME or A type.Note: Custom domain names can't point directly to the execute-api endpoint because the certificate doesn't have the custom domain listed as the Subject Alternative Name (SAN).Example configuration:custom.example.com -> CNAME record -> d-yg54udirl4.execute-api.us-east-1.amazonaws.comYou can check your configuration by running the dig command on your custom domain similar to the following:$ dig custom.example.com

Related informationHow can I resolve DNS resolution or certificate mismatch errors for my API Gateway custom domain name?
Question: "Why is my Amazon Connect CCP displaying missed calls, but not incoming calls?"

The Contact Control Panel (CCP) in my Amazon Connect contact center is displaying missed calls, but not incoming calls. Why is this happening, and how do I troubleshoot the issue?Short descriptionThe CCP makes a getAgentSnapshot API call whenever a call is routed to an agent. When there are no incoming calls, the CCP automatically makes the API call every 30 seconds. This API call returns the agent's current status to determine if the agent is available to accept a call or not.If the API endpoints hosted through Amazon CloudFront don't return a response to the getAgentSnapshot API call, then the CCP doesn't display the incoming call. When the connection to the API endpoints is reestablished, the CCP then changes the agent's status to a Missed Call state.This type of networking issue appears in the Snapshots section of the CCP Log Parser, similar to the following example.Note: You can use the CCP Log Parser to turn your raw Amazon Connect CCP logs into a more read-friendly format. For more information, see CCP Log Parser in GitHub.CCP Log Parser Snapshots section example of a networking issue that caused the CCP to not display an incoming call...00:46:26.484Z Available00:46:56.474Z Available00:47:26.471Z Available00:49:31.880Z MissedCallAgent...Note: The two-minute duration between 00:47:26.471Z Available and 00:49:31.880Z MissedCallAgent indicates that there was a networking issue during that time period. If there's no networking issue, the agent status is returned at 30-second intervals.

ResolutionConfirm that nothing is blocking traffic to API endpoints with TCP port 443. For more information, see Replace Amazon EC2 and CloudFront IP range requirements with a domain allow list.If you're allowing traffic with IP address ranges, then confirm that all IP addresses used by Amazon Connect are on the required allow lists. For more information, see Allow IP address ranges.Confirm that your network connection is stable enough to allow the CCP to maintain connection with the required endpoints. To validate connectivity to Amazon Connect, use the Amazon Connect Endpoint Test Utility.Confirm that the agents' workstations meet the minimum requirements for the CCP.
Question: How to create a private integration using an internal Application Load Balancer for an Amazon API Gateway HTTP API?

I want to create a private integration using an internal Application Load Balance for an Amazon API Gateway HTTP API. How can I do this?ResolutionFollow these instructions to create the Amazon Virtual Private Cloud (Amazon VPC) link, HTTP API, private integration, and deploy the HTTP API.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.Create the VPC link1.    If you haven't already done so, follow the instructions to create an Application Load Balancer.2.    Open the API Gateway console, and in the navigation pane choose VPC links.3.    From VPC Links, choose Create.(Optional) You can also create a VPC link by using the AWS CLI command create-vpc-link similar to the following:aws apigatewayv2 create-vpc-link --name MyVpcLink \    --subnet-ids subnet-aaaa subnet-bbbb \    --security-group-ids sg1234 sg56784.    From Choose a VPC link version, choose VPC link for HTTP APIs.5.    For Name, enter a name for your VPC link.6.    Choose the VPC dropdown list, choose a VPC for your Application Load Balancer to connect to.For Subnets, choose your subnets to include in the VPC link.8.    For Security groups, choose the security groups for the VPC link, and then choose Create.Create an HTTP API and route1.    Open the API Gateway console, and then choose Create API.2.    For HTTP API, choose Build.3.    For API name, enter a name, and then choose Next.4.    For Configure routes, choose Next.5.    For Configure stages, choose Next, and then choose Create.6.    In the navigation pane, choose Routes, and then choose Create.7.    For Method, choose ANY.8.    For path, enter /{proxy+} and choose Create.Create a private integration and deploy the HTTP API1.    Open the API Gateway console, and then choose your HTTP API.2.    In the navigation pane, choose Integrations.3.    For Integrations, choose Manage integrations, and then choose Create.4.    For Attach this integration to a route, choose ANY /{proxy+}.5.    For Integration target, choose Private resource.6.    For Integration details, choose Select manually.7.    For Target service, choose ALB/NLB.8.    For Load balancer, choose your load balancer.9.    For Listener, choose HTTP 80.10.    For VPC link, choose your VPC, and then choose Create.11.    (Skip this step if auto deploy is active) Choose Deploy to deploy your HTTP API.12.    For Invoke URL, copy the URL and paste it into a new browser window. For example, https://abcdef123.execute-api.us-east-1.amazonaws.com.The HTTP API URL renders successfully in the browser window.

Related informationAmazon API Gateway HTTP API tutorialsHow do I map the response status codes for API Gateway integrations in HTTP APIs?
Question: Can I use a single CloudFront web distribution to serve content from multiple origins using multiple behaviors?

Can I use a single Amazon CloudFront web distribution to serve content from multiple origins using multiple behaviors?ResolutionYou can configure a single CloudFront web distribution to serve different types of requests from multiple origins. For example, your website might serve static content from an Amazon Simple Storage Service (Amazon S3) bucket and dynamic content from a load balancer. You can serve both types of content from a CloudFront web distribution.Follow these steps to configure a CloudFront web distribution to serve static content from an S3 bucket and dynamic content from a load balancer:Open your web distribution from the CloudFront console.Choose the Origins tab.Create one origin for your S3 bucket, and another origin for your load balancer.Note: If you're using a custom origin server or an S3 website endpoint, you must enter the origin's domain name into the Origin Domain Name field.From your distribution, choose the Behaviors tab.Create a behavior that specifies a path pattern to route all static content requests to the S3 bucket. For example, you can set the "images/*.jpg" path pattern to route all requests for ".jpg" files in the images directory to the S3 bucket.Edit the Default (*) path pattern behavior and set its Origin as your load balancer.

Related informationWorking with distributions
Question: How can I configure multiple users to use the same Client VPN endpoint?

I want to configure multiple users to use the same AWS Client VPN endpoint. I need to be able to identify which user is currently connected to the endpoint so that I can make any necessary access changes to the correct user. How can I do this?Short descriptionThis article shows you how to generate a client-side certificate using the following command:./easyrsa build-client-full client1.domain.tld nopassFor more information on creating your own server-side certificate and uploading those certificates to AWS Certificate Manager, see Mutual authentication in the AWS Client VPN guide.

ResolutionNote: client1.domain.tld is a placeholder name used in the following commands. Replace with your own client domain name. You can run this command as many times as needed for each user who needs their own unique client-side certificate.1.    Create a Client VPN endpoint.2.    Generate unique client-side certificates for each user. The following example show two users, User1 and User2. Replace with your unique users as needed.$ ./easyrsa build-client-full user1.example.com nopass            $ ./easyrsa build-client-full user2.example.com nopass3.    Retrieve the contents of the certificate (".crt") files for all users to update the client-side Client VPN configuration file:sudo cat user1.exmaple.com.crt            sudo cat user2.example.com.crt4.    Retrieve the contents of the key (".key") files for all users to update the client-side Client VPN configuration file:sudo cat user1.example.com.key            sudo cat user2.example.com.key5.    Add the raw content of the .crt and .key files to each of the users in the Client VPN configuration files. Users store this file locally. Use the **<cert></cert>**and <key></key> identifiers directly following the **</ca>**line within the Client VPN configuration file. Or, specify the .crt and .key file paths, as shown in the following example.Note: Replace username with your client's user name. If the .crt and .key file is not located in /Users/username/Downloads, then change the path accordingly.cert /Users/username/Downloads/*.crt    key /Users/username/Downloads/*.key6.    Save the configuration files, then provide the files to each user. Users then use the files to connect to the Client VPN endpoint.7.    After connecting to the Client VPN endpoint:Open the Amazon Virtual Private Cloud (Amazon VPC) console.Choose Client VPN Endpoints.Select the Client VPN endpoint.Choose the Connections tab, and then choose Common Name. The TLD certificates that appear on the tab, beginning with each user's name.8.    (Optional) Configure client certificate revocation lists (CRLs) to block or revoke access to specific client certificates. Adding a client's certificate to a revocation list (CRL) revokes the client's access to the Client VPN endpoint.
Question: How do I resolve a Trusted Advisor alert that shows my Amazon EBS usage has reached the service limit?

AWS Trusted Advisor shows that my Amazon Elastic Block Store (Amazon EBS) usage is more than 80% of the Amazon EBS Active Volumes service limit. How do I increase the limit?Short descriptionThe AWS Trusted Advisor monitors the resources in an AWS account and provides recommendations to help you follow best practices. One of its tasks is to monitor the service quotas in all Regions. Trusted Advisor then alerts you if your account reaches more than 80% of a service quota in any Region. This limit isn't enforced, and you are only notified so that you can investigate the usage and make any changes in your AWS account. There is no effect on the performance and durability of your EBS volumes. But, if you exceed the account limits this might affect your ability to create new volumes in that Region.

ResolutionYou can follow recommendations to delete resources or request a service quota increase in the Region where AWS Trusted Advisor shows the alert. To request a limit increase for your account, create a support case. Or, request an increase directly from the Service Quotas dashboard for the appropriate quota name in the correct Region.

Related informationWhat is Service Quotas?How can I request, view, and manage service quota increase requests using AWS CLI commands?Amazon Elastic Block Store - Service quotas
Question: "I'm using the AWS CLI, an AWS SDK, or an application to access my Amazon S3 bucket, but I'm getting the error "The AWS Access Key Id you provided does not exist in our records." Why?"

I want to access my Amazon Simple Storage Service (Amazon S3) bucket using the AWS Command Line Interface (AWS CLI), an AWS SDK, or my own application. However, when I send a request to my bucket, I get the error "The AWS Access Key Id you provided does not exist in our records." How can I fix this?ResolutionThe error message "The AWS Access Key Id you provided does not exist in our records" indicates that there's an issue with the credentials that you're using. The access key that you're using might have been deleted, or the associated AWS Identity and Access Management (IAM) role or user might have been deleted.To resolve the issue, check credentials that you're using. If you're using the AWS CLI, run this command to list the stored access keys:aws configure listYou can also run the get-caller-identity AWS CLI command to get details on the IAM credentials you're using to call the API:aws sts get-caller-identityNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.If you're using an AWS SDK, run the GetCallerIdentity action for the SDK that you're using.After you obtain the credentials that you're using, verify that those credentials are still valid.If you're using an IAM role, follow these steps:Open the IAM console.Choose Roles.Verify that the IAM role is listed. If the role isn't listed, then create a new IAM role.If you're using an IAM user, follow these steps:Open the IAM console.Choose Users.Verify that the IAM user is listed. If the user isn't listed, then you must create a new IAM user.If the IAM user is listed, choose the user name to view its Summary page.Choose the Security credentials tab, and then check whether the associated Access keys appear. If the access keys are missing or inactive, then you must create new access keys or activate the keys.Note: If you're using a session token, make sure to pass the session token with the access key and secret key. When you copy your security token and keys, be sure to check for any typos that don't align with your use case.You can also use a session token with multi-factor authentication (MFA) to protect programmatic calls that are specific to AWS API operations. Run the sts get-session-token command in the AWS CLI with the code from your MFA device. For more information, see How do I use an MFA token to authenticate access to my AWS resources through the AWS CLI?Related informationConfiguring the AWS CLI
Question: How can I immediately delete a Secrets Manager secret so that I can create a new secret with the same name?

I deleted an AWS Secrets Manager secret. Then I tried to recreate the secret using the same name. However, I received an error similar to the following:"You can't create this secret because a secret with this name is already scheduled for deletion"Short descriptionWhen you delete a secret, Secrets Manager doesn't immediately delete the secret. Secrets Manager schedules the secret for deletion after a recovery window of a minimum of seven days. This means that you can't recreate a secret using the same name using the AWS Management Console until the recovery window ends. You can permanently delete a secret without any recovery window using the AWS Command Line Interface (AWS CLI). For more information, see Delete a secret.

ResolutionRun the DeleteSecret API call with the ForceDeleteWithoutRecovery parameter to delete the secret permanently.Notes:If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.Secrets deleted using the ForceDeleteWithoutRecovery parameter can't be recovered or restored.Use the AWS Secrets Manager console to get the deleted Secrets Manager secret IDNote: You can skip this step if you already know the deleted secret's ID.Open the Secrets Manager console.In the navigation pane, choose Secrets.Choose the settings icon, and then in Preferences, select Show secrets scheduled for deletion.In Visible columns, turn on the Deleted on toggle switch, and then choose Save.In the Secrets pane, note the Secret name and Deleted on fields to locate the deleted secret ID.In Secret name, choose your secret.In Secrets detail, copy the Secret name.Use the AWS CLI to permanently delete the secretIn this example, replace your-secret-name with your Secrets Manager secret ID or ARN, and your-region with your AWS Region.aws secretsmanager delete-secret --secret-id your-secret-name --force-delete-without-recovery --region your-regionRun the DescribeSecret API call to verify that the secret is permanently deleted.Note: The deletion is an asynchronous process. There might be a short delay.aws secretsmanager describe-secret --secret-id your-secret-name --region your-regionYou receive an error similar to the following:An error occurred (ResourceNotFoundException) when calling the DescribeSecret operation: Secrets Manager can't find the specified secret.This error means that the secret is successfully deleted.Related informationdelete-secret
Question: Why can’t I select an Availability Zone for my Amazon VPC interface endpoint?

I'm using Amazon Virtual Private Cloud (Amazon VPC) to create an interface VPC endpoint. However, I can't select my preferred subnet for the Availability Zone.

Short descriptionWhen you create an interface VPC endpoint to connect with AWS PrivateLink services, note the following:You must select subnets for the same Availability Zone where the elastic network interface was launched.The Availability Zone mapping can be different between AWS accounts. For example, the subnet that's mapped as us-east-1a in one account might be mapped as us-east-1c in another account.Note: AWS allows you to identify the actual location of your resources relative to your accounts with the Availability Zone ID (AZ ID). An AZ ID is a unique and consistent identifier for an Availability Zone across all AWS accounts.When you create an interface endpoint in your account, keep the following points in mind:You can select an Availability Zone only if it corresponds to active Availability Zones on the Network Load Balancer of the provider VPC.The Amazon VPC console automatically performs the Availability Zone mapping.If an Availability Zone isn't activated for the provider VPC's Network Load Balancer, then you receive the error Service not supported in this Availability Zone.

ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you're using the most recent AWS CLI version.Check which Availability Zones are enabled on the Network Load Balancer of the provider VPC. Use the command describe-vpc-endpoint-services:aws ec2 describe-vpc-endpoint-services --service-names SERVICE-NAMEFor example, use the following command to see activated Availability Zones:aws ec2 describe-vpc-endpoint-services --service-names com.amazonaws.vpce.us-east-1.vpce-svc-xxxxxxxxxxIn this example, the output shows that you can select the us-east-1b subnet:{    "ServiceDetails": [         .............................            "ServiceName": " com.amazonaws.vpce.us-east-1.vpce-svc-xxxxxxxxxx ",            "VpcEndpointPolicySupported": false,            "Owner": "##########",            "AvailabilityZones": [                "us-east-1b"            ],        ..............................}This output is mapped to the values of the AWS account that is running the command. Therefore, both service provider accounts and service consumer accounts can run the preceding command, even if they are in different Availability Zones. For consumer accounts, make sure that the accounts are allowed as AWS principals on the endpoint service.

Related informationShare your services through AWS PrivateLink