VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I retain the automated snapshots of my Amazon RDS DB instance for a longer period?

I want to retain the automated snapshots of my Amazon Relational Database Service (Amazon RDS) DB instances for a longer period.

ResolutionAmazon RDS creates and saves the automated snapshots of your DB instance during the backup window of your DB instance. The automated snapshots are saved according to the backup retention period that you specify for the instance.Activating automated backupsYou can activate automated backups by setting the backup retention period to a positive, non-zero value. To activate automated snapshots and set the backup retention period, see Enabling automated backups. You can set the backup retention period from 1 to 35 days. The maximum retention period currently available for automated snapshots is 35 days. When automated backups are turned on for your DB Instance, Amazon RDS automatically performs a full, daily snapshot of your data and captures transaction logs. When you initiate a point-in-time recovery, transaction logs are applied to the most appropriate daily backup to restore your DB instance to the specific time that you request.Copying the automated backupTo retain a particular automated snapshot for longer than 35 days, you can copy the snapshot. The copy is stored as a manual snapshot. You can retain this manual snapshot for as long as you need. Unlike automated backups, manual snapshots aren't subject to the backup retention period. Manual snapshots don't expire.Note: For very long-term backups of RDS for MariaDB, RDS for MySQL, and RDS for PostgreSQL data, it's a best practice to export the snapshot data to Amazon Simple Storage Service (Amazon S3). If the major version of your DB engine is no longer supported, then you can't restore to that version from a snapshot. For more information, see Exporting DB snapshot data to Amazon S3.Creating a manual snapshotYou can also choose to create a manual snapshot of your DB instance to retain the data for a longer period of time. For more information, see Creating a DB snapshot.

Related informationWorking with backupsAmazon RDS FAQs - Automatic backups and database snapshots
Question: How can a Client VPN user get a static IP address to access the internet?

How can I allow AWS Client VPN users access to the internet with a static public IP address?ResolutionFollow these instructions to create a NAT gateway and allow a Client VPN user to access the internet.Note: Creating a NAT gateway results in additional AWS charges. For more information, see NAT gateway pricing.1.    Make sure the Amazon Virtual Private Cloud (Amazon VPC) has private and public subnets. To create an Amazon VPC and subnet, see working with VPCs and subnets.2.    Follow the instructions to create a NAT gateway with the public subnet. The NAT gateway is assigned an Elastic IP address. Note this example route table:Route table for the public subnet associated with the NAT gateway:0.0.0.0/0  Target destination Internet Gateway (IGW)3.    Associate the Client VPN endpoint with the private subnet. The private subnet has a route to the internet through the NAT gateway. Note this example route table:Route table for the private subnet associated with the Client VPN endpoint:0.0.0.0/0  Target destination nat-abcdbac(NAT Gateway)4.    Add a Client VPN endpoint destination route 0.0.0.0/0 or the destination's public IP address range on the Client VPN route table. For the target VPC subnet ID, select the private subnet from step 3. For more information, see create an endpoint route.5.    Add an authorization rule to enable access to the internet (0.0.0.0/0), or the specified public network IP address. For more information, see create a Client VPN authorization rule. Related informationUsing AWS Client VPN to scale your work from home capacity
Question: How can I increase disk space for my Amazon ECS container on AWS Fargate?

I want to increase disk space for my Amazon Elastic Container Service (Amazon ECS) container on AWS Fargate.

Short descriptionAmazon ECS tasks that are hosted on Fargate platform version 1.4.0 or later receive at least 20 GiB of ephemeral storage. For more than 20 GiB of storage, use one of the following options:Fargate ephemeral storage for storage sizes up to 200 GiB. Ephemeral storage is non persistent. For steps on using ephemeral storage, see the Resolution section.Amazon Elastic File System (Amazon EFS) volumes for scalable file storage. Amazon EFS volumes provide persistent storage. For steps on using Amazon EFS volumes, see How do I mount an Amazon EFS file system on an Amazon ECS container or task running on Fargate?Note: Your Amazon EFS file system and Fargate tasks must be in the same Amazon Virtual Private Cloud (Amazon VPC).

ResolutionUse Fargate ephemeral storageYou can use either version 2 of the Amazon ECS console, or AWS Command Line Interface.Note: If you receive errors when running the AWS CLI, confirm that you're running a recent version of the AWS CLI.Use the V2 consoleNote: The ephemeral storage option isn't available in the classic console.Open the Amazon ECS console.In the navigation pane, choose Task definitions.Choose Create a new task definition. You can also revise an existing task definition.Add the required information of the container, and then choose Next.Under Storage, for ephemeral storage, provide the required amount of ephemeral storage. The minimum is 21 GiB and the maximum is 200 GiB.Choose Next, and then choose Create.Use the AWS Command Line Interface (AWS CLI)1.    Run the register-task-definition command to create or update the task definition with increased storage up to 200 GiB. Use the --ephemeral-storage flag.$ aws ecs register-task-definition --region <example-region> --cli-input-json file://<path\_to\_json>/demo.json --ephemeral-storage sizeInGiB=<example-integer>Note: Replace example-region with your AWS Region and example-integer with your integer.2.    Describe the task definition to confirm the updated ephemeral storage.aws ecs describe-task-definition --task-definition <example-task-definition-name> --region <example-region>Note: Replace example-task-definition-name with your task definition name.Example output:"ephemeralStorage": {            "sizeInGiB": <example-value>        }For more information on configuring ephemeral storage, see Bind mount examples.
Question: What are the differences between AWS accounts and AWS India accounts?

What are the differences between AWS accounts and Amazon Web Services India Private Limited (AWS India) accounts?ResolutionThe main difference between AWS accounts and AWS India accounts is the seller of record. AWS accounts are administered by Amazon Web Services, Inc., or its affiliates, but AWS India accounts are administered by Amazon Web Services India Private Limited.To sign up for an AWS India account, see Managing an account in India.If you have an existing account with an address in India, your account is either AWS or AWS India, depending on when you opened the account. To know whether your account is with AWS or AWS India, see Determining which company your account is with.Here are some other ways that AWS India accounts are different from AWS accounts:By default, AWS India accounts are billed in Indian Rupees (INR).Monthly bills for AWS India accounts must be paid manually each month in the AWS Billing and Cost Management console.Upfront fees for Reserved Instances and subscription charges for AWS Support plans must be paid manually.AWS India accounts can't sell Reserved Instances on the Reserved Instance Marketplace.You might be required to verify your payment method when you make a payment. For example, you might be asked to type a security code provided by your financial institution.AWS India accounts can't change the country attributed to the account's physical address.Note: If you purchase services from other sellers of record, such as the AWS Marketplace, then you might be billed differently for those services.

Related informationWhat is Amazon Web Services India Private Limited (AWS India)?
Question: How do I view past or current AWS payments?

I want to see my billing history and the payments that I've made to AWS.

ResolutionYou can view your AWS billing and payments information in the Billing and Cost Management console.View your current or past AWS billsTo view your AWS bill, open the Bills pane of the Billing and Cost Management console, and then choose the month that you want to view from the dropdown list.Important: Because you're charged for what you use, it's a best practice to check your AWS bills often. Consider checking your bills weekly, or after you change the services or architecture you use.Bills are finalized at the beginning of each month. After a bill is final, you can download a PDF version of your bill, as well as any applicable tax invoices, by choosing Print on the Bills pane.View your AWS paymentsYou can view the history of your AWS payments in the Payments pane of the Billing and Cost Management console.If your seller of record is Amazon Web Services, then AWS automatically charges your default payment method between the 3rd and 5th of the following month.If your seller of record is Amazon Web Services India Private Limited (AWS India), you pay your final bill manually each month. For more information, see Managing an Account in India.If you have outstanding AWS bills, or your automatic payment to your credit card fails, then retry your payment using Verify and pay next to unpaid bills.To update or change your payment method, see How do I add a new payment method to my AWS account?Related informationViewing your billAWS pricingWhen will my AWS bill be ready?
Question: How can I automate the cleanup of Docker containers and images in Amazon ECS?

I am trying to clean up Docker containers and images in Amazon ECS automatically. How do I do this?Short descriptionBy default, the Amazon ECS container agent automatically cleans up stopped tasks and Docker images that aren't used by tasks on your container instances. The automated image cleanup feature requires at least version 1.13.0 of the Amazon ECS container agent.

ResolutionYou can turn off the image cleanup, but you can't turn off the cleanup of the containers that belong to the stopped tasks. You can change the wait duration using the ECS_ENGINE_TASK_CLEANUP_WAIT_DURATION variable.Important: If you set ECS_DISABLE_IMAGE_CLEANUP to true, then automated image cleanup is turned off on your container instance and your images aren't automatically removed.For more information on the clean-up workflow, see Automated task and image cleanup. For more information on how to configure your automated task and image cleanup variables, see Tunable parameters.

Related informationAmazon Elastic Container Service Agent (AWS GitHub)Available parametersUpdating the Amazon ECS container agentCreating a container image for use on Amazon ECS
Question: How can I automatically start an AWS Glue job when a crawler run completes?

I want to configure AWS Glue to automatically start a job when a crawler run completes.

ResolutionYou can use AWS Glue triggers to start a job when a crawler run completes. However, the AWS Glue console supports only jobs and doesn't support crawlers when working with triggers. You can use the AWS Command Line Interface (AWS CLI) or AWS Glue API to configure triggers for both jobs and crawlers.Run the following AWS CLI command to create a trigger that can start a job when a crawler run completes:$ aws glue create-trigger --name testTrigger --type CONDITIONAL --predicate 'Logical=AND,Conditions=[{LogicalOperator=EQUALS,CrawlerName=testCrawler,CrawlState=SUCCEEDED}]' --actions JobName=testJob --start-on-creationNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.You can also create a trigger using Python boto3 SDK:import boto3client = boto3.client("glue")response = client.create_trigger(    Name="testTrigger",    Type="CONDITIONAL",    Predicate={        "Logical": "AND",        "Conditions": [            {                "LogicalOperator": "EQUALS",                "CrawlerName": "testCrawler",                "CrawlState": "SUCCEEDED",            },        ],    },    Actions=[        {"JobName": "testJob"},    ],    StartOnCreation=True,)With either of the preceding approaches, you can create the trigger testTrigger that can start the job testJob after the crawler testCrawler runs successfully.Note: The crawler testCrawler must be started only using a trigger. If you start the crawler manually, then the job doesn't get fired by the trigger. In AWS Glue, all jobs or crawlers are started only if they are started by a trigger. Be sure that all jobs or crawlers in a dependency chain are descendants of the scheduled or on-demand triggers.Additionally, you can use one of the following methods:Create an AWS Lambda function and an Amazon EventBridge rule. When you choose this option, the Lambda function is always on. It monitors the crawler regardless of where or when you start it. You can also modify this method to automate other AWS Glue functions. For more information, see How can I use a Lambda function to automatically start an AWS Glue job when a crawler run completes?Use AWS Glue workflows. This method requires you to start the crawler from the Workflows page on the AWS Glue console. For more information, see How can I use AWS Glue workflows to automatically start a job when a crawler run completes?
Question: How do I enable MFA for AD Connector?

I want to enable multi-factor authentication (MFA) for AD Connector. How do I do this?ResolutionBefore enabling MFA for AD Connector, review the AD Connector prerequisites.For detailed instructions on enabling MFA for AD Connector, see Enable multi-factor authentication for AD Connector.

Related informationHow do I enable MFA for AWS Managed Microsoft AD?Why is MFA failing on my AWS Managed Microsoft AD directory or my AD Connector?
Question: Why did I receive the GuardDuty finding type alert UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS for my Amazon EC2 instance?

Amazon GuardDuty detected alerts for the UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS finding type.

Short descriptionThe GuardDuty finding type UnauthorizedAccess:IAMUser/InstanceCredentialExfiltration.OutsideAWS indicates that AWS credentials that were created exclusively for an Amazon Elastic Compute Cloud (Amazon EC2) instance through an instance launch role are being used from an external IP address.

ResolutionFollow the instructions to view and analyze your GuardDuty findings. Then, in the findings detail pane, note the external IP address and IAM user name.The external IP address is safeIf the external IP address is owned by you or someone that you trust, then you can auto-archive the findings with a suppression rule.The external IP address is maliciousIf the external IP address is malicious, then you can deny all permissions to the IAM user.Note: Permissions for the IAM user are denied for all EC2 instances.Create an IAM policy with an explicit deny to block access to the EC2 instance for the IAM user similar to the following:Note: Replace your-roleID and your-role-session-name with the Principal ID.{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Deny",      "Action": [        "*"      ],      "Resource": [        "*"      ],      "Condition": {        "StringEquals": {          "aws:userId": "your-roleId:your-role-session-name"        }      }    }  ]}Follow the instructions for remediating a compromised EC2 instance.Note: As a security best practice, be sure to require the use of IMDSv2 on an existing instance.
Question: Why was I charged a retrieval fee to pull my data from an Amazon S3 Glacier vault?

I pulled information from an Amazon Simple Storage Service (Amazon S3) Glacier vault, but I was charged a fee.

ResolutionYou can retrieve a part of your total Amazon S3 Glacier storage without extra charges. Amazon S3 Glacier offers a 10 GB retrieval under Free Tier allowance. You can retrieve 10 GB of your Amazon S3 Glacier data per month for free. You can use the Free Tier allowance at any time during the month, and the allowance applies to only Standard retrievals. If you retrieve more than 10 GB in Standard retrievals under Free Tier, or use Expedited or Bulk retrievals, then you're charged a retrieval fee. For more information about data retrievals, see Amazon S3 Glacier FAQs.To minimize retrieval charges, set up a data retrieval policy for your account.

Related informationGetting started with Amazon S3 GlacierDownloading an archive in Amazon S3 Glacier
Question: How do I connect my private network to AWS public services using an AWS Direct Connect public VIF?

How do I connect my private network to AWS public services using an AWS Direct Connect public virtual interface (VIF)?ResolutionCreate a Direct Connect public VIF to connect AWS public endpoints with public IP addresses that are advertised to AWS over Border Gateway Protocol (BGP).You can configure:The on-premises router terminating the public VIF to network address translation (NAT) the private networks to the public peer IP address-or-The on-premises router terminating the public VIF to port address translation (PAT) the private networks to the public peer IP addressYou can also configure a subnet that you're advertising over the public VIF to connect to the AWS public resources. This allows your private networks to access public routable Amazon services in any AWS Region (except the AWS China Region).For example, suppose that you have a corporate network of 192.168.0.0/24 that accesses AWS public resources with the following peer IP addresses:198.51.100.1/24 as the local peer IP address198.51.100.2/24 as the remote peer IP addressIn this scenario:Use the local peer IP address associated with the public VIF as the NAT or PAT IP addressAdvertise 198.51.100.0/24 over the Direct Connect public VIFRelated informationHow can I set up a Direct Connect public VIF?Which type of virtual interface should I use to connect different resources in AWS?AWS Regional services list
Question: Why is my ACM certificate marked as ineligible for renewal?

I want to renew my AWS Certificate Manager (ACM) certificate. However, the certificate details value is ineligible for renewal.

Short descriptionACM certificates might be ineligible for renewal if:The certificate isn't associated with another AWS service.The certificate is expired.The certificate is imported.It's a private certificate issued with the IssueCertificate API call.

ResolutionFollow these instructions for your use case.Before you begin, use the ACM console or the AWS Command Line Interface (AWS CLI) to list detailed metadata about your certificates.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.The certificate isn't associated with another AWS serviceACM certificates must be associated with another AWS service such as Elastic Load Balancing (ELB).If the certificate details metadata In use? value is No, this means that your ACM certificate isn't associated with an AWS service.For a list of supported AWS services with ACM, see Services integrated with AWS Certificate Manager.The certificate is expiredExpired certificates aren't eligible for renewal. If the certificate is expired, you can request a new certificate.For more information, see Check a certificate's renewal status.The certificate is importedACM doesn't provide managed renewal for imported certificates. To renew an imported certificate, request a new certificate from your certificate issuer. Then, follow the instructions to manually reimport the certificate into ACM.Private certificate issued with the IssueCertificate API callACM doesn't manage the renewal of private certificates issued by calling the ACM Private CA IssueCertificate API. You can request a new certificate before the certificates expiration date from your CA.For more information, see Managed renewal for ACM certificates.

Related informationTroubleshooting certificate validationIssuing and managing certificates
Question: How do I resolve the error "Connect timeout on endpoint URL" on Amazon SageMaker?

When I try to connect to an AWS service from my Amazon SageMaker notebook, I get an error similar to the following:"Connect timeout on endpoint URL: "https://athena.ap-southeast-2.amazonaws.com/"Short descriptionTo connect to AWS services, the notebook instance's subnet must have a virtual private cloud (VPC) endpoint for the service that you're connecting to. Or, the subnet must be able to reach the internet.

ResolutionUse one of the following options to resolve "Connect timeout on endpoint URL" errors.Add a VPC endpoint for the service to the notebook instance's subnetWhen you choose this option, you don't have to create a new notebook instance. Many AWS services offer either an interface endpoint or a gateway endpoint. For more information, see VPC endpoints. If the AWS service that you're connecting to doesn't offer an interface or gateway endpoint, create a new notebook instance.Create a new notebook instanceChoose one of the following configurations for a new notebook instance based on your security requirements:Create a new notebook instance with direct internet access enabled. This is the default option, regardless of whether or not you create the notebook instance in a VPC. For both VPC and non-VPC notebook instances, direct internet access is the easiest way to assure that a notebook instance can reach the public endpoint for the service that you're connecting to. When direct internet access is enabled, SageMaker provides a network interface that allows the notebook to communicate with the internet through a SageMaker-managed VPC. For more information, see Understanding Amazon SageMaker notebook instance networking configurations and advanced routing options.Create the notebook instance in a private subnet with direct internet access disabled. Then, add a NAT gateway to the subnet. The NAT gateway allows traffic to reach the public endpoint for the service that you're connecting to.

Related informationConnect a notebook instance in a VPC to external resources
Question: How do I retrieve log data from CloudWatch Logs?

I want to find log data for my Amazon Web Services (AWS) account. What are the best practices for getting log data from Amazon CloudWatch Logs?Short descriptionThere are four methods that are best practices for retrieving log data from CloudWatch Logs. You can use any one of these four, depending upon your use case:Use subscription filters to stream log data to another receiving source in real timeRun a query with CloudWatch Logs InsightsExport log data to Amazon Simple Storage Service (Amazon S3) for batch use casesCall GetLogEvents or FilterLogEvents in the CloudWatch APIResolutionUse subscription filtersTo immediately retrieve log data from CloudWatch Logs in real time, you can use subscription filters. For more information, see Real-time processing of log data with subscriptions and Using CloudWatch Logs subscription filters.Filtering for log events is performed internally, which prevents CloudWatch API throttling. Amazon Kinesis Data Streams automatically retries throttled service API calls.Run a query in CloudWatch Logs InsightsTo quickly search and analyze your log data, run a query in CloudWatch Logs Insights.Export log data to Amazon S3 (batch use cases)To move log data from CloudWatch Logs to Amazon S3 in batch use cases, see Exporting log data to Amazon S3. Log data can take up to twelve hours to become available for export from CloudWatch Logs. For real-time analysis and processing, use subscription filters.Important: An AWS account can have only one export task for log data in the state PENDING, PENDING_CANCEL, or RUNNING.Call GetLogEvents or FilterLogEventsTo find log data manually, use GetLogEvents or FilterLogEvents in the CloudWatch API.Important: This method isn’t scalable due to the transactions per second (TPS) quotas for GetLogEvents and FilterLogEvents. For current quotas, see CloudWatch Logs quotas. If you experience throttling when performing these actions, use subscription filters instead.

Related informationWhat is Amazon CloudWatch Logs?