VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I manually install the AWS CLI on an Amazon EC2 Windows instance?

I want to use the AWS Command Line Interface (AWS CLI) on my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance.

Short descriptionYou can use the AWS CLI to manage multiple AWS services and to automate common service and resource actions through scripts.Note: To install the AWS CLI on an instance, the instance must have internet access using a network address translation (NAT) instance or an internet gateway.

ResolutionFor instructions to install the AWS CLI on a Windows instance, see Installing or updating the latest version of the AWS CLI.Important: If you already installed AWS CLI version 1, then it's a best practice to uninstall version 1 and use only AWS CLI version 2.To view a description of a command in the AWS CLI, append help to the command. For more information, see Getting help with the AWS CLI.For a general overview of how AWS CLI commands are structured, see Command structure in the AWS CLI.

Related informationTroubleshooting AWS CLI errorsMigrating from AWS CLI version 1 to version 2
Question: How do I allow Amazon QuickSight access to an S3 bucket with a deny policy?

How can I be sure that my Amazon Simple Storage Service (Amazon S3) bucket policy allows access from Amazon QuickSight?Short descriptionWhen your Amazon S3 bucket uses a Deny policy, that policy overrides any S3 permissions that you specify in the Amazon QuickSight console. To allow Amazon QuickSight to access the S3 bucket, add the Amazon QuickSight service role (aws-quicksight-service-role-v0) as an exception in your Deny policy.Resolution1.    Be sure that Amazon QuickSight has permission to access the S3 bucket.2.    Use the AWS Command Line Interface (AWS CLI) or AWS Identity and Access Management (IAM) API to get the unique ID for the aws-quicksight-service-role-v0 role. The ID is unique to each Amazon QuickSight account. For example:aws iam get-role --role-name aws-quicksight-service-role-v0 --query 'Role.RoleId' --output json "AROAEXAMPLEID"Note: If you receive an error while running your AWS CLI commands, be sure that you’re using the most recent version of the AWS CLI.3.    Open the Amazon S3 console.4.    Choose the bucket that you want to access with Amazon QuickSight.5.    Choose the Permissions view.6.    Choose Bucket Policy.7.    Enter a bucket policy similar to this example. Replace AROAEXAMPLEID with your unique ID. If you want to add an exception for an IAM user, replace AIDAEXAMPLEUSERID with the unique ID of the IAM user. The IAM user policy must also contain an Allow statement for the S3 bucket. For example:{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Deny",      "Principal": "*",      "Action": "s3:*",      "Resource": [        "arn:aws:s3:::examplebucketname",        "arn:aws:s3:::examplebucketname/*"      ],      "Condition": {        "StringNotLike": {          "aws:userid": [            "AROAEXAMPLEID:*",            "AIDAEXAMPLEUSERID"          ]        }      }    }  ]}This Deny policy adds exceptions for the Amazon QuickSight service role and an IAM user.Note: If you delete the Amazon QuickSight service role and the IAM user, you will be locked out of the bucket. To resolve this problem, log in as the AWS account root user, and then use the delete-bucket-policy command to delete the bucket policy.

Related informationHow to restrict Amazon S3 bucket access to a specific IAM role
Question: Why can't I see CloudWatch Logs for an AWS DMS task?

Why can't I see Amazon CloudWatch Logs for an AWS Database Migration Service (AWS DMS) task?Short descriptionTo view the CloudWatch Logs for your AWS DMS task, confirm the following:Amazon CloudWatch is enabled on the AWS DMS task.The dms-cloudwatch-logs-role AWS Identity and Access Management (IAM) role is created. The IAM role has the correct permissions policy, and has the correct trust relationship for AWS DMS to assume the role.

ResolutionNote: If you receive errors when running AWS Command Line Interface (AWS CLI) commands, make sure that you’re using the most recent AWS CLI version.First, enable CloudWatch logging for your task, if you haven't already. To enable CloudWatch logging, your task must be in a Stopped or Failed state.If CloudWatch logging is enabled for your task and you still can't view the logs, confirm that you have the required IAM role. Open the IAM console, and then choose Roles from the navigation pane. Confirm that dms-cloudwatch-logs-role is listed. If you created the task using the AWS Command Line Interface (AWS CLI) or the dms-cloudwatch-logs-role role wasn't created because the account doesn't have sufficient permissions, then create the role with the required policies using the AWS CLI or follow these steps:1.    Open the IAM console, and then choose Roles from the navigation pane.2.    Choose Create role.3.    Choose AWS service from Select type of trusted entity. Doing this allows the AWS service in the next step to perform actions on your behalf.4.    Choose DMS from Choose a use case. This creates the following trust relationship policy so that AWS DMS can assume the role:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {           "Service": "dms.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}5.    Choose Next: Permissions.6.    Enter AmazonDMSCloudWatchLogsRole in the search field. Then, choose the policy to grant AWS DMS access to CloudWatch.7.    Choose Next: Tags.8.    Optionally, add metadata to the role by using tags as key-value pairs.9.    Choose Next: Review.10.    For Role name, enter dms-cloudwatch-logs-role.Note: The role name dms-cloudwatch-logs-role is case-sensitive, so be sure to enter the role name in lower case.11.    Role description is filled, and you can add or edit the description as needed.12.    Chose Create role.After the role is created, you can use CloudWatch Logs to monitor your AWS DMS task.

Related informationMonitoring AWS DMS tasks
Question: "How do I assign a static hostname to an Amazon EC2 instance running RHEL 5 or 6, CentOS 5 or 6, or Amazon Linux?"

I changed the hostname of my Amazon Elastic Compute Cloud (Amazon EC2) instance. However, when I reboot or stop and then start the instance, the hostname changes back. How do I make the hostname persist?Short descriptionTo make a hostname persist when rebooting or stopping and starting your EC2 instance, add the hostname to the appropriate configuration files on the instance.Note: The following steps apply to Amazon Linux and RHEL 5 or 6, and CentOS 5 or 6. For instructions that apply to other distributions, see one of the following:Changing the system hostnameHow do I assign a static hostname to an Amazon EC2 instance running SLES?How do I assign a static hostname to an Amazon EC2 instance running Ubuntu Linux?How do I assign a static hostname to an Amazon EC2 instance running RHEL 7 or CentOS 7?Resolution1.    Open /etc/sysconfig/network in vim:sudo vim /etc/sysconfig/network2.    Change the value of the HOSTNAME parameter (replace persistent_hostname with your preferred hostname):HOSTNAME=persistent_hostname3.    Set NETWORKING to yes:NETWORKING=yes4.    Save and exit the vim editor.Note: After making this change, press SHIFT + : to open a new command entry box in the vim editor. Type wq, and then press Enter to save your changes and exit vim.5.    Open /etc/hosts in vim:sudo vim /etc/hosts6.    Change the entry beginning with 127.0.0.1 to the following, replacing persistent_hostname, localdomain, and localhost with your preferred hostname, local domain, and local host:127.0.0.1 persistent_hostname.localdomain localhost localhost.localdomain7.    Save and exit the vim editor.8.    To verify that you successfully changed the hostname, reboot your instance, and then run the hostname command:sudo reboothostnameThe command returns the new hostname.

Related informationChanging the hostname of your Amazon Linux instance
Question: How do I set up and connect to SMTP using Amazon SES?

I want to set up Simple Mail Transfer Protocol (SMTP) for Amazon Simple Email Service (Amazon SES). How do I set up and connect to SMTP using Amazon SES?ResolutionFollow these steps to set up SMTP with Amazon SES and then connect to the Amazon SES SMTP endpoint to send email:1.    Open the Amazon SES console.2.    From the navigation pane, choose Account dashboard.3.    Under Simple Mail Transfer Protocol (SMTP) settings, note the values for SMTP endpoints and Ports. Use the SMTP endpoint and ports to connect to SMTP. For example, if you're in the eu-west-1 AWS Region, note the following:SMTP endpoint: email-smtp.eu-west-1.amazonaws.comPort: 25, 465 or 5874.    Choose Create My SMTP Credentials. Then, proceed with the steps to generate your SMTP credentials.5.    Select the Amazon SES SMTP port that you'll send email from based on the connection method that you want to use (STARTTLS or TLS Wrapper).Important: Amazon Elastic Compute Cloud (Amazon EC2) restricts outbound traffic on port 25 for all EC2 instances by default. If you must use SMTP port 25, you can request to remove this restriction. Or, you can select a different port to send email.6.    Connect to the Amazon SES SMTP endpoint to test the connection over the port that you want to send email from. For example, you can run the telnet command:$ telnet email-smtp.eu-west-1.amazonaws.com 465Connected to email-smtp.eu-west-1.amazonaws.com.7.    After you confirm that the connection to the port is successful, you can start using your operating system's command line to start sending email using the Amazon SES SMTP interface.
Question: How do I resolve the "function not registered" syntax error in Amazon Athena?

When I run a SELECT operation in Amazon Athena, I get a "function not registered" syntax error.

ResolutionIf you try to use a function that Athena doesn't support, then you receive an error that's similar to one of the following messages:"SYNTAX_ERROR: line 1:8: Function function_name not registered""FUNCTION_NOT_FOUND: line 1:8: Function 'function_name' not registered"For a list of functions that Athena supports, see Functions in Amazon Athena. Or, run a SHOW FUNCTIONS statement. See the following partial example of the output:    Function   Return Type     Argument Types   Function Type   Deterministic   Description1    abs        bigint          bigint           scalar          true            absolute value2    abs        decimal(p,s)    decimal(p,s)     scalar          true            absolute value3    abs        double          doubleIf Athena doesn’t support the function that you want to use, then write a user defined function (UDF) in Athena. UDFs allow you to create custom functions to process records or groups of records. A UDF accepts parameters, performs work, and then returns a result. For examples and more information about UDFs, see Querying with user defined functions.

Related informationAmazon Athena UDF Connector (on GitHub)Connect Amazon Athena to your Apache Hive metastore and use user defined functions
Question: "How can I restrict access to AWS resources based on the AWS Region, source IP address, or Amazon VPC?"

I want to restrict access to AWS resources based on the AWS Region, source IP address, or Amazon Virtual Private Cloud (Amazon VPC).

Short descriptionYou can use AWS Identity and Access Management (IAM) identity-based policies and Amazon Simple Storage Service (Amazon S3) bucket policies to deny or control access to AWS resources. You can deny or control access to AWS resources based on conditions such as the AWS Region, source IP, or VPC that the resource is being accessed from.

ResolutionDeny access to AWS resources based on the requested AWS RegionCreate an identity-based policy with the IAM aws:RequestedRegion condition key that denies access to all actions outside the specified Regions.For an example IAM policy and more information, see Deny access based on the requested Region.Deny access to AWS resources based on the source IP addressCreate an identity-based policy with the IAM aws:SourceIp and aws:ViaAWSService condition keys that denies access to all actions outside the specified IP address range. Only public IP addresses or public IP ranges are supported.Note: The aws:SourceIp condition key is always included in the request, except for requests that uses an Amazon VPC endpoint.For an example IAM policy and more information, see Deny access based on the source IP address range.Control access from Amazon VPC with Amazon S3 bucket policiesCreate an Amazon S3 bucket policy with the IAM aws:SourceVpce condition key to restrict access to buckets from specific Amazon VPC endpoints. You can also create an Amazon S3 bucket policy with the IAM aws:SourceVpc condition key to restrict access to buckets from specific Amazon VPCs.For example IAM policies and more information, see Controlling access from VPC endpoints with bucket policies.Note: The aws:SourceVpc or aws:SourceVpce condition key is only included if the requester uses a VPC endpoint to make the request.

Related informationAWS service endpointsAWS global condition context keysVPC endpoints
Question: How do I resolve "Session expired" errors from Amazon Connect?

I get a "Session expired" error message when I try to open the Amazon Connect Contact Control Panel (CCP). Why am I receiving this error, and how do I resolve the issue?Short descriptionIf you're using SAML 2.0 with Amazon Connect and your session expires, Amazon Connect returns the following error:Session expiredYour session has expired. Please log in again to continue. Sessions expire after 12 hours.To resolve the error, you must log out of your identity provider (IdP), and then log back in to Amazon Connect through your IdP.Note: Amazon Connect sessions expire 12 hours after a user logs in. After 12 hours, users are automatically logged out. For more information, see SAML user logging in and session duration.Resolution1.    Log out of your IdP.2.    Log in to Amazon Connect through your IdP.Important: When you use SAML in Amazon Connect, you can't use the AWS Management Console link to log in. You must log in through your IdP.Your new Amazon Connect session will be active for 12 hours, unless you log out before then.
Question: How do I troubleshoot connection problems between an AWS VPN endpoint and a policy-based VPN?

I'm using a policy-based virtual private network (VPN) to connect to my AWS Virtual Private Network (AWS VPN) endpoint in Amazon Virtual Private Cloud (Amazon VPC). I'm experiencing problems, such as packet loss, intermittent or no connectivity, and general network instability, and want to troubleshoot these issues.

Short descriptionWhen you use a policy-based VPN connection to connect to an AWS VPN endpoint, AWS limits the number of security associations to a single pair. The single pair includes one inbound and one outbound security association.Policy-based VPNs with more than one pair of security associations will drop existing connections when new connections with different security associations initiate. This behavior indicates that a new VPN connection has interrupted an existing one.

ResolutionLimit the number of encryption domains (networks) with access to your VPC. If you have more than one encryption domain behind your VPN's customer gateway, then configure them to use a single security association. To check if multiple security associations exist for your customer gateway, see the Troubleshooting your customer gateway device.Configure your customer gateway to allow any network behind the customer gateway (0.0.0.0/0) with a destination of your VPC Classless Inter-Domain Routing (CIDR) to pass through the VPN tunnel. This configuration uses a single security association, which improves tunnel stability. This configuration also allows networks that aren't defined in the policy to access the VPC.If possible, implement a traffic filter on your customer gateway to block unwanted traffic to your VPC. Configure security groups to specify what traffic can reach your instances. Also configure network access control lists (network ACLs) to block unwanted traffic to subnets.

Related informationWhy is IKE (phase 1 of my VPN tunnel) failing in Amazon VPC?Why is IPsec/Phase 2 for AWS Site-to-Site VPN failing to establish a connection?
Question: How can I improve the speed of an AWS DMS task that has LOB data?

My AWS Database Migration Service (AWS DMS) migration task is slow. How can I improve the speed of an AWS DMS task that has large object (LOB) data?Short DescriptionAWS DMS offers the following options when migrating LOB data:Full LOB modeLimited LOB modeInline LOB mode

ResolutionFull LOB modeWhen using Full LOB mode, AWS DMS migrates LOBs regardless of their size. Because AWS DMS doesn't know the size of the LOB data that needs to be migrated, AWS DMS migrates LOBs one at a time. This can slow down your task. Although the migration is slower, the advantage is that data isn't truncated. To improve the performance of a task that uses Full LOB mode with multiple tables, identify the size of the largest LOB in your database. Then, you can use Limited LOB mode if the size of the largest LOB size isn't more than a few megabytes.If you have LOBs that are larger than a few megabytes, then you can create a separate AWS DMS task with Full LOB mode. It's a best practice to create the separate task on a new replication instance to migrate these tables alone.Limited LOB modeWhen using Limited LOB mode, you specify the maximum size of LOB column data. This allows AWS DMS to pre-allocate resources and apply the LOBs in bulk. If the size of the LOB columns exceeds the size that you specified in the task, then AWS DMS truncates the data. AWS DMS then sends warnings to the AWS DMS log file. Using Limited LOB mode improves performance, but before you run the task, you must identify the maximum LOB size of the data on the source. Then, you must specify the Max LOB size parameter when using Limited LOB mode. It's a best practice to be sure that you have enough memory allocated to the replication instance to handle the task.Inline LOB modeWhen using Inline LOB mode, you can migrate LOBs without truncating data or slowing your task performance, by replicating both small and large LOBs. First, specify a value for the InlineLobMaxSize parameter, which is available only when Full LOB mode is set to true. The AWS DMS task transfers the small LOBs inline, which is more efficient. Then, AWS DMS migrates LOBs that are larger than the specified size in Full LOB mode by performing a lookup from the source table. However, Inline LOB mode works only during the full load phase.Important: You must set the InlineLobMaxSize when you specify the task settings for your task. {  "TargetMetadata": {    "TargetSchema": "abc",    "SupportLobs": true,    "FullLobMode": true,    "LobChunkSize": 64,    "LimitedSizeLobMode": false,    "LobMaxSize": 0,    "InlineLobMaxSize": 32,    "LoadMaxFileSize": 0,    "ParallelLoadThreads": 0,    "ParallelLoadBufferSize": 0,    "BatchApplyEnabled": false,    "TaskRecoveryTableEnabled": false,    "ParallelLoadQueuesPerThread": 0,    "ParallelApplyThreads": 0,    "ParallelApplyBufferSize": 0,    "ParallelApplyQueuesPerThread": 0  }Related InformationMigrating Large Binary Objects (LOBs)Target Metadata Task SettingsBest Practices for AWS Database Migration Service
Question: How do I troubleshoot connection errors when I set up input data for an Amazon SageMaker Ground Truth labeling job?

I want to troubleshoot connection errors when I try to set up input data for an Amazon SageMaker Ground Truth labeling job.

ResolutionWhen you have connection issues with SageMaker Ground Truth, you might get an error similar to the following:Connection error: There was an issue with your input data setup. Ground Truth could not setup a connection with your dataset in S3. Please check your input data setup and try again, or use the manual data setup option. Network Failure Request id: <request_id>This error usually occurs because your AWS Identity and Access Management (IAM) role doesn't have the permissions that are required for setting up the input data.To troubleshoot this error, be sure that the role that you're using has the following policies attached:AmazonSageMakerFullAccessAmazon Simple Storage Service (Amazon S3) read and write accessIssues with SageMaker accessIf the IAM role that you're using doesn't have the AmazonSageMakerFullAccess policy attached, then attach the following Ground Truth actions to the policy:groundtruthlabeling:DescribeConsoleJobgroundtruthlabeling:ListDatasetObjectsgroundtruthlabeling:RunFilterOrSampleManifestJobgroundtruthlabeling:RunGenerateManifestByCrawlingJobFor more information, see Permissions.Issues with Amazon S3 accessBe sure that the IAM role includes the required permissions to access the input data files in the Amazon S3 bucket. For more information, see S3: Allows read and write access to objects in an S3 bucket.Issues with cross-account accessIf the data that you are setting up is in another account, then be sure that the execution role account has cross-account access to the S3 objects. For more information, see How can I provide cross-account access to objects that are in Amazon S3 buckets?Issues with service control policiesBe sure that the service control policies applied at the organization level don't restrict actions on the member account. For example, even if the execution role has the required permissions attached, an explicit DENY on all groundtruthlabeling actions restricts the connection and results in a connection error. For more information, see SCP effects on permissions.
Question: "How can I download and share AWS Artifact documents with regulators and auditors, or with others in my company?"

How can I download and share AWS Artifact documents?Short descriptionYou can share AWS Artifact compliance documents (also known as audit artifacts or reports) with regulators, auditors, or with others in your company. You can use these documents as evidence of AWS security controls. You can also download AWS Artifact documents with the AWS Management Console.

ResolutionTo share AWS Artifact documents, you can either download the reports or provide permissions to the reports.Important: Share AWS Artifact documents only with those you trust. AWS Artifact reports have a unique, traceable watermark that's specific to you. Don't email reports or share online. Instead, use a secure authenticated sharing service with auditing capabilities, such as Amazon WorkDocs.Download AWS Artifact documentsTo download AWS Artifact documents, sign in to the AWS Artifact console with your AWS account. Then, follow the instructions for Downloading reports in AWS Artifact.Note: If you don't have an AWS account already, you must create one. For instructions, see Getting started with AWS Artifact.Provide permission to AWS Artifact documentsCreate an AWS Identity and Access Management (IAM) user. Then, provide IAM permissions to access AWS Artifact documents. For instructions, see Create IAM users and grant them access to AWS Artifact.Note: It's a best practice to grant the IAM user least privilege access to AWS Artifact documents.You can restrict access to AWS Artifact document types to specific user accounts. For instructions, see Identity and access management in AWS Artifact.AWS Artifact documents must be kept secure and might require a nondisclosure agreement (NDA). For more information, see Securing Your documents.

Related informationAWS Artifact FAQs