VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why are the items with expired Time to Live not deleted from my Amazon DynamoDB table?

Some of the items with expired Time to Live (TTL) aren't yet deleted from my Amazon DynamoDB table.

ResolutionThe DynamoDB TTL feature allows you to define a per-item timestamp to determine when an item is no longer needed. Shortly after the date and time of the specified timestamp, DynamoDB deletes the item from your table without consuming any write throughput. TTL is provided at no extra cost as a means to reduce stored data volumes by retaining only the items that remain current for your workload’s needs. When you activate TTL on a DynamoDB table, you must identify a specific attribute name that the service will look for when determining if an item is eligible for expiration. After you activate TTL on a table, a per-partition scanner background process automatically and continuously evaluates the expiry status of items in the table.Some of the common causes for deletion of expired items taking longer are the following:The actual delete operation of an expired item might vary depending on the size and activity level of your table. Because TTL is a background process, the nature of the capacity used to expire and delete items using TTL is variable.The TTL process typically deletes expired items within 48 hours of expiration. However, this timeline isn't an SLA. TTL deletes are done on best effort basis and deletion might take longer in some cases. During the deletion of objects using TTL, DynamoDB uses the backend capacity of the table to delete the objects instead of using the provisioned capacity. The deletion process might take longer if there are a large number of delete requests and not enough backend capacity to continuously delete those items.To check if TTL is working properly, do the following:Be sure that you activated TTL on the table and the related settings are correct.The item must contain the attribute that you specified when you activated TTL on the table.The TTL attribute’s value must have the datatype Number.The TTL attribute’s value must be a timestamp in Unix epoch time format in seconds.The TTL attribute value must be a datetimestamp with an expiration of no more than five years in the past.The TTL processes run on the table only when there is enough spare capacity so that these processes don't interfere with table operations. If the table or table partitions are using most of the allocated capacity, TTL processes might not run due to insufficient spare capacity.Items that are expired, but aren't yet deleted by TTL, still appear in reads, queries, and scans. If you don't want expired items in the result set, you must filter them out. To do so, use a filter expression that returns only items where the Time to Live expiration value is greater than the current time in epoch format. For more information, see Filter expressions for scan.

Related informationExpiring items by using DynamoDB Time to Live (TTL)
Question: Why did I receive the GuardDuty finding type alert Recon:EC2/PortProbeUnprotectedPort for my Amazon EC2 instance?

Amazon GuardDuty detected alerts for the Recon:EC2/PortProbeUnprotectedPort finding type for my Amazon Elastic Compute Cloud (Amazon EC2) instance.

Short descriptionThe GuardDuty finding type Recon:EC2/PortProbeUnprotectedPort means that an Amazon EC2 instance has an unprotected port that is being probed by a known malicious host.

ResolutionUse the following best practices to protect the unprotected port or remove inbound rules:Follow the instructions to view and analyze your GuardDuty findings.In the findings detail pane, note the port number.If the unprotected port is 22 for Linux, you can restrict access by following the instructions for authorizing inbound traffic for your Linux instances.If the unprotected port is 3389 for Windows, you can restrict access by following the instructions for authorizing inbound traffic for your Windows instances.If the unprotected port is 80 or 443 and you must keep these ports open, you can put the EC2 instance behind a load balancer.If the port doesn't have any application running on it and doesn't need to be open, you can remove the inbound rule for the EC2 instance security group and iptables rules.If you don't need to protect the unprotected port, you can ignore the Recon:EC2/PortProbeUnprotectedPort finding type.

Related informationMonitoring GuardDuty findings with Amazon CloudWatch EventsFinding types
Question: How can I find which Availability Zones I can use in my account?

I want to use an Availability Zone (AZ), but it's unavailable for my account. How can I find which AZs I can use in my account?Short descriptionAs AZs grow, the ability for AWS to expand them can become constrained. As a result, you might notice the following:Your account has fewer available AZs than what's publicly listed.One of your accounts has a different number of available AZs in a Region than another account.

ResolutionTo find which AZs you can use to launch resources in any of your accounts, do the following:Open the Amazon Elastic Cloud Compute (Amazon EC2) console.From the navigation bar, view the options in the Region selector.On the navigation pane, choose EC2 Dashboard.In the Service Health section, view the list of AZs under Availability Zone Status.Also, you can run the following command in the AWS Command Line Interface (AWS CLI) to generate a list of AZs in your account.Note: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure you confirm that you’re running a recent version of the AWS CLI.Note: Be sure to replace region-name with your Region's name. For example, ap-northeast-1.aws ec2 describe-availability-zones --region region-name

Related informationAvailability Zones
Question: How do I submit a Digital Millennium Copyright Act (DMCA) notice to AWS?

Material that I own the copyright for is being distributed using AWS resources without my permission. How do I submit a Digital Millennium Copyright Act (DMCA) notice to AWS?ResolutionThe Digital Millennium Copyright Act (DMCA) is the United States law governing claims that copyright-protected material is being distributed online.If you believe that AWS resources are being used to host or distribute copyrighted material that you own the copyright for without your permission, first consider whether there is an exception to copyright that applies in this case (such as fair use). If after considering this you still want to make a copyright complaint, you can reach out directly to the site operator using the contact details provided on the site. Or, to submit a DMCA notice to AWS, follow the steps outlined below. Remember that only the copyright owner or their authorized representative can file a report of copyright infringement.Steps to submit a DMCA notice to AWSGather the documentation described at Notice and procedure for making claims of copyright infringement.Send the information to ec2-abuse@amazon.com or abuse@amazonaws.com.Note: The AWS Abuse team won't open attachments under any circumstance. You must provide any necessary information in plaintext.If you provide your notice in the body of an email and send it to ec2-abuse@amazon.com or abuse@amazonaws.com, you don't need to provide a physical signature.What happens next?After we receive your DMCA notice, you'll receive an automated email acknowledging receipt of your notice. If we have questions about your notice, we'll email you asking for more information. We request that you respond to our email so that we can continue looking into your report.If your DMCA notice is complete and valid and the reported content is on AWS, we'll take action expeditiously including contacting our customer to remove or disable access to the infringing content. Whenever we remove content in response to a DMCA notice, we provide a copy of the original complaint as well as your contact information to our customer. If our customer doesn't believe that the content is infringing or that the content shouldn't be removed, they might reach out to you directly to resolve the issue or they might submit a counter-notice to us under the DMCA.Repeat infringer policyAWS terminates the accounts of repeat infringers in appropriate circumstances.The information above is provided for general informational purposes only and is not legal advice. If you have any questions about this information or your specific situation or rights, seek legal advice from a professional.

Related informationHow do I provide a counter-notice to a DMCA notice?
Question: Why did I get an AWS Config error after turning on AWS Security Hub?

How to troubleshoot AWS Config errors after turning on AWS Security Hub.

Short descriptionWhen setting up AWS Security Hub, you might have one of the following errors:"AWS Config is not enabled on some accounts.""AWS Config is not enabled in all regions.”"An error has occurred with AWS Config. Contact AWS Support."ResolutionUse the following best practices for configuring and troubleshooting AWS Config with Security Hub:Note: AWS Config rules created by Security Hub do not incur any additional costs.Verify that AWS Config is turned on in the same AWS Region as Security HubManually turn on AWS Config in the same Region as Security Hub as follows:1.    Open the AWS Config console in the same Region that you have Security Hub turned on.2.    If AWS Config is not turned on, follow the instructions for setting up AWS Config with the Console.Note: If you have Security Hub configured in multiple Regions, repeat these steps for each Region.Verify AWS Config is recording all resources including global in your RegionModify the type of resources AWS config records as follows:1.    Open the AWS Config console, and choose Settings.2.    In Settings, confirm Recording is on.3.    In Resource types to record, select Record all resources supported in this region.4.     In Resource types to record, select Include global resources (e.g., AWS IAM resources).5.    Choose Save.Note:These settings apply to all of your AWS accounts that are configured with Security Hub, including AWS Organizations member accounts.You do not have to record all resource types in AWS Config. However, be sure that the required resource types for CIS, PCI DSS, and AWS foundational security best practices controls are recording.You do not need to turn on global resources in all Regions. To avoid duplicate configuration settings, you can turn on global settings in only the same AWS Region as Security Hub per AWS account.It can take up to 24 hours for the recorder settings to complete.Use Amazon CloudWatch log filter patterns to search AWS CloudTrail log dataSearch for and troubleshoot AWS Config error messages as follows:1.    Follow steps 1-4 in Search log entries using the console.2.    In Filter, paste the following example syntax, and then choose enter on your device:EventSource: config.amazonaws.com<br>3.    Note the error. Then, follow the instructions for How can I troubleshoot AWS Config console error messages?Verify the permissions on the Security Hub service-linked roleAWS Security Hub uses service-linked roles to provide permissions to AWS services. The following AWS Identity and Access Management (IAM) permission allows access to AWS Config with Security Hub:{<br>"Effect": "Allow",<br>"Action": [<br>"config:PutConfigRule",<br>"config:DeleteConfigRule",<br>"config:GetComplianceDetailsByConfigRule",<br>"config:DescribeConfigRuleEvaluationStatus"<br>],<br>"Resource": "arn:aws:config:*:*:config-rule/aws-service-rule/*securityhub*"<br>}<br>For more information, see Using service-linked roles for AWS Security Hub.

Related informationAWS Security Hub now generally available
Question: How can I troubleshoot issues with Accelerated VPN?

How can I troubleshoot issues with AWS Accelerated VPN?ResolutionConfirm that your firewall configuration meets all requirementsFor more information, see Configuring a firewall between the internet and your customer gateway device.Confirm that NAT-traversal is activated on the customer gateway deviceNAT-traversal (NAT-T) is required for an Accelerated VPN connection. NAT-T is activated by default. If you downloaded a configuration file from the Amazon Virtual Private Cloud (Amazon VPC) console, check the NAT-T setting and start it if necessary.Note: If NAT-T is deactivated on the customer gateway device the tunnel will still come up. However, in this scenario the issue could still persist for the data traffic.For more information, see Your customer gateway device.Confirm that lifetime parameters matchThe IKE tunnel lifetime parameter must match what's set on your AWS Virtual Private Network (AWS VPN). By default, these settings are:28,800 seconds (8 hours) for phase 13,600 seconds (1 hour) for phase 2If necessary, change the AWS VPN parameters to match your IKE tunnel parameters.Confirm the connection's compatibility with Global Accelerator (if applicable)If your Site-to-Site VPN connection uses certificate-based authentication, it might not be compatible with AWS Global Accelerator. There's limited support for packet fragmentation in Global Accelerator. If you require an Accelerated VPN connection that uses certificate-based authentication, your customer gateway device must support IKE fragmentation. Otherwise, don't activate your VPN for acceleration. For more information, see How AWS Global Accelerator works.Confirm that acceleration was configured in the proper sequenceAcceleration can't be activated or deactivated for an existing Site-to-Site VPN connection. Instead, create a new Site-to-Site VPN connection with acceleration activated or deactivated as needed. Then, configure your customer gateway device to use the new Site-to-Site VPN connection. Finally, delete the previous Site-to-Site VPN connection. For more information on Accelerated VPN restrictions, see Rules and restrictions.
Question: How do I resolve the "Server.InternalError: Internal error on launch" error for a failed stack in AWS CloudFormation?

I tried to create an Amazon Elastic Compute Cloud (Amazon EC2) instance with an AWS CloudFormation stack, but my stack creation failed. Then, I received the "Server.InternalError: Internal error on launch" error message. How can I resolve this error?Short descriptionYou receive this error if duplicate or invalid device mappings are specified in your AWS CloudFormation template. You can't have two block devices map to the same location (for example, /dev/sdb).Note: If you're using a Nitro-based instance type (for example, c5, m5, or t3), then you won't receive this error, because /dev/sdb and /dev/xvdb are mapped to two different NVMe devices in the operating system.

ResolutionIn the BlockDeviceMappings property of your AWS CloudFormation template, confirm that your block devices aren't mapping to the same location by checking the value of DeviceName for each block device.In the following JSON and YAML example templates, the block devices specified are /dev/xvdb and /dev/xvdc. The root volume is automatically provisioned for the instance, and the block devices are associated as secondary volumes.JSON:    "Ec2Instance" : {      "Type" : "AWS::EC2::Instance",       "Properties" : {        "...OtherProperties..."        "BlockDeviceMappings" : [          {            "DeviceName" : "/dev/xvdb",            "Ebs" : { "VolumeSize" : "100" }          },{            "DeviceName" : "/dev/xvdc",            "Ebs" : { "VolumeSize" : "100" }          }        ]      }    }YAML:EC2Instance:    Type: AWS::EC2::Instance    Properties:        ...OtherProperties...        BlockDeviceMappings:        -          DeviceName: /dev/xvdb          Ebs:            VolumeSize: 100        -          DeviceName: /dev/xvdc          Ebs:            VolumeSize: 100Related informationBlock device mappingEC2 block device mapping examplesDevice names on Linux instances
Question: How do I prepare for end of support for Kubernetes 1.15 on Amazon EKS?

I want to prepare for the end of support for Kubernetes 1.15 on Amazon EKS in Amazon Elastic Kubernetes Service (Amazon EKS).

Short descriptionKubernetes 1.15 on Amazon EKS reaches end of support on May 3, 2021.Note: After Open Source community support for Kubernetes 1.15 ended on May 6, 2020, AWS provided an additional one year of support for Kubernetes 1.15 on Amazon EKS. This means that no bug fixes or security vulnerability patches will be back-ported to Kubernetes 1.15 on Amazon EKS. For more information, see Kubernetes Patch Releases on the Kubernetes GitHub site.

ResolutionTo prepare for end of support, complete the following steps:Understand the impact of end of support.Complete the Kubernetes 1.16 update prerequisites.Update your Amazon EKS clusters by May 3, 2021.For more information on preparing for deprecation, see Preparing for Kubernetes API deprecations when going from 1.15 to 1.16.Note: If you're having issues with your Amazon EKS pods or apps, see Kubernetes 1.16 update prerequisites. The most common issue is kube-proxy failing to start because the --resource-container flag is still in the kube-proxy DaemonSet. To resolve this issue, remove the --resource-container flag.
Question: How do I create a subdomain for my domain that's hosted in Route 53?

I want to create a subdomain for my domain that's hosted in Amazon Route 53, but I don't know how.

Short descriptionUsing a separate hosted zone to route internet traffic for a subdomain is known as delegating responsibility for a subdomain to a hosted zone. It might also be referred to as subdomain delegation through name servers.PrerequisitesBefore you begin, be sure to implement the following requirements:A valid registered domain (regardless of the registrar)An authoritative hosted zone for the registered domain in Route 53ResolutionCreate a hosted zone for the subdomain in Route 53Create a hosted zone with the same name as the subdomain that you want to route traffic for, such as acme.example.com. To do this, complete the following steps:Open the Route 53 console.In the navigation pane, choose Hosted zones.Choose Create hosted zone.In the navigation pane, enter the name of the subdomain (such as acme.example.com).Note: For more information, see DNS domain name format.For Type, accept the default value of Public hosted zone.Choose Create hosted zone.Find the name servers that Route 53 assigned to the new hosted zoneWhen you create a hosted zone, Route 53 automatically assigns four name servers to the zone. To start using the hosted zone for the subdomain, create a new name server (NS) record in the hosted zone for the domain (example.com). The name of the NS record must be the same as the name of the subdomain (acme.example.com).After creating the hosted zone for the subdomain, expand the Hosted zone details dropdown list for the subdomain in the hosted zone (acme.example.com). In the right pane, copy the names of the four servers listed as the Name servers under Hosted zone details.Add NS records to route traffic to your subdomainComplete the following steps to route traffic to your subdomain. These steps also apply to cross-account scenarios where the hosted zone for the domain and the subdomain are in different accounts.Select the hosted zone for the domain (example.com). Be sure not to select the name of the subdomain (some.example.com).In the hosted zone for the domain, choose Create record.For Name, enter the name of the subdomain.For Value, enter the names of the name servers.For Record type, choose NS - Name servers for a hosted zone.For TTL (Seconds), select a more common value for an NS record, such as 172,800 seconds.For Route Policy, choose Simple routing.Choose Create Records.Note: To remove the subdomain delegation (acme.example.com), first delete the NS record in the parent hosted zone (example.com). Then, delete the subdomain hosted zone. These steps protect your subdomain from an unauthorized takeover.Create records in the subdomain hosted zoneCreate your records in the newly-created subdomain hosted zone. Test the record resolution using the dig/nslookup command.Example dig/nslookup command:dig acme.example.com
Question: How do I set up UDP load balancing with my Network Load Balancer?

I want to register a User Datagram Protocol (UDP) service to my Network Load Balancer. How can I do this?ResolutionCreate a new target group using UDPOpen the Amazon Elastic Cloud Compute (Amazon EC2) console.From the navigation pane, choose Target Groups.Choose Create target group.For Target type, choose Instances or IP addresses.For Target group name, enter a name for the target group.For Protocol, choose UDP or TCP_UDP.For Port, choose the port that the service is listening on.For VPC, choose your VPC.For Health check protocol, choose TCP, HTTP, or HTTPS.Expand Advanced health check settings, and then choose Override.For Healthy threshold, enter the number of health checks.Choose Next, and then choose Create target group.For more information, see Create a target group for your Network Load Balancer.Register targets to the target groupOpen the Amazon EC2 console.From the navigation pane, in Load Balancing, choose Target Groups.In Target groups, choose your target group, choose Actions, and then choose Register targets.For Available instances, choose your Instance ID or IP address that you created previously, and then choose Include as pending below.Choose Register pending targets.For more information, see Register targets with your target group.Modify the health check for the target groupOpen the Amazon EC2 console.From the navigation pane, in Load Balancing, choose Target Groups.In Target groups, choose your target group.Choose the Health checks tab, and then choose Edit.In Health check protocol, choose your protocol (TCP, HTTP, or HTTPS).Expand Advanced health check settings.In Port, choose either Traffic port or Override, and then choose Save changes.For more information, see Modify the health check settings of a target group.Add a listener to your Network Load BalancerOpen the Amazon EC2 console.From the navigation pane, in Load Balancing, choose Load Balancers.Choose your Network Load Balancer, choose the Listeners tab, and then choose Add listener.Choose the Protocol dropdown list, and then choose your protocol (UDP or TCP_UDP).Choose the Select a target group dropdown list, choose your target group, and then choose Add.For more information, see Create a listener for your Network Load Balancer.

Related informationUDP load balancing for Network Load Balancer