VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How do I enforce using TLS 1.2 or later for my Amazon S3 buckets?

My customers use earlier TLS versions. I want to enforce using a recent TLS version when they access content that’s stored in my Amazon Simple Storage Service (Amazon S3) buckets.

Short descriptionIt's a best practice to use modern encryption protocols for data in transit. To enforce the use of TLS version 1.2 or later for connections to Amazon S3, update your bucket's security policy.Note: If your customers don’t use TLS version 1.2 or later, then they can't access content that's stored in your S3 buckets.

ResolutionUse a resource-based policy that's attached to your bucket to enforce using TLS 1.2 or later for all connections to your S3 buckets.To attach a bucket policy that requires TLS versions 1.2 or later, complete the following steps:Open the Amazon S3 console.Select the bucket from the list.Choose the Permissions tab.Under Bucket Policy, choose Edit.Add a policy to deny access to the encryption protocols that you want to prevent. For example, use the following policy to deny all HTTPS requests that use TLS versions that are earlier than 1.2:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "EnforceTLSv12orHigher",      "Principal": {        "AWS": "*"      },      "Action": ["s3:*"],      "Effect": "Deny",      "Resource": [        "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",        "arn:aws:s3:::DOC-EXAMPLE-BUCKET"      ],      "Condition": {        "NumericLessThan": {          "s3:TlsVersion": 1.2        }      }    }  ]}The preceding policy enforces HTTPS to increase security for your data in transit. If your workload requires HTTP traffic to Amazon S3, then use the preceding policy with the following condition. This condition allows HTTP traffic and blocks HTTPS traffic from TLS versions 1.2 and earlier:"Condition": {        "Bool": {            "aws:SecureTransport": "true"        },        "NumericLessThan": {          "s3:TlsVersion": 1.2        }      }Confirm that you're using modern encryption protocols for S3To test your new policy, use the following example curl command to make HTTPS requests that use a specific legacy protocol:curl https://${BUCKET\_NAME}.s3.us-east-1.amazonaws.com/image.png -v --tlsv1.0 --tls-max 1.0The example curl command returns Access Denied because Amazon S3 detects that your request isn't using TLS version 1.2 or later.Note: By default curl sends an anonymous request. If your bucket is private, then you receive a 403 Access Denied error for any TLS version. When using curl to test, generate an Amazon S3 presigned URL to gain access to your private objects.It's a best practice to use AWS CloudTrail Lake to identify earlier TLS connections to AWS service endpoints. You can configure the CloudTrail Lake event data store to capture management events or data events.
Question: Why am I getting the OptionsRequestDenied error when I upload a file using the Amazon S3 console?

When I upload a file to my Amazon Simple Storage Service (Amazon S3) bucket using the Amazon S3 console, I get the error OptionsRequestDenied.

ResolutionOptionsRequestDenied is a client-side error that might occur when you access your S3 bucket using the Amazon S3 console. Check the following points for your client:Browser extensions: Ad blockers and similar extensions that are installed on a web browser might block traffic from Amazon S3.Firewalls: Any proxies or firewalls on your client might block traffic from Amazon S3.Network connectivity problems: An intermittent network connection problem might interrupt the connection to Amazon S3.Tip: To isolate your client's issue, upload files using an AWS Command Line Interface (AWS CLI) command instead. For example, use aws s3 cp. If you receive errors when you run AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.

Related informationUploading objects
Question: How do I resize my EC2 Windows instance or change the EC2 Windows instance type?

I want to change or add some resources to my Amazon Elastic Compute Cloud (Amazon EC2) Windows instance. How do I change the specifications of my instance?Short descriptionYou can change instance types to do the following:Increase or decrease the number of CPU cores.Increase or decrease the amount of RAM.Enable Amazon Elastic Block Store (Amazon EBS) optimization.Enable enhanced networking.Change GPU cores.

ResolutionTo resize your EC2 instance, choose an instance type that meets your CPU, RAM, and feature requirements.Consider the following before resizing your EC2 Windows instance:If you launch instances from Amazon Machine Images (AMIs), install the required drivers for the destination instance type. This needs to be done for custom Windows AMIs and Amazon-provided Windows AMIs created before August 2018. Status checks fail if the instance doesn't have the required drivers.For instances created from AMIs after August 2018 install or upgrade the  required drivers for the destination instance type.Verify that your current instance type is  compatible with the new instance type that you choose.If the current instance has an  instance store volume, any data on the instance store volume is lost when the instance is stopped. Be sure to  back up the data on your instance before you stop the instance.If you're not using an  Elastic IP address, the public IP address is released when you stop the instance.It's a best practice to maintain backups of your instances and data. Consider creating an AMI or  creating snapshots of your EBS volumes before you change the instance type.If your instance is part of an Auto Scaling group,  change the launch configuration to launch the new instance type. On the Copy Launch Configuration page, choose the new instance type.

Related informationStatus checks for your instancesTroubleshoot instance launch issuesHow do I move my EC2 instance to another subnet, Availability Zone, or VPCCreating a launch configurationModify the supported instance types (Change instance types on the same Dedicated Host)
Question: How can I retrieve Secrets Manager secrets using Lambda functions in a Amazon VPC?

My AWS Lambda function configured in an Amazon Virtual Private Cloud (Amazon VPC) can't access AWS Secrets Manager.

Short descriptionLambda functions run in a secure Amazon VPC with access to AWS services and the internet. The Lambda service owns this Amazon VPC, and it isn’t connected to your default Amazon VPC.Lambda functions that are connected to your Amazon VPC can access the internet only when you configure your Amazon VPC to provide access. The network interfaces that Lambda creates within your Amazon VPC use private IP addresses and can’t connect to the internet using an internet gateway.For more information, see Internet and service access for VPC-connected functions.Note: It's a best practice not to place Lambda functions in an Amazon VPC unless the function must access other resources in the Amazon VPC.

ResolutionFollow these steps to verify your Lambda network configuration and permission settings.Lambda network configurationTo allow a Lambda function that's connected to an Amazon VPC to access Secrets Manager, take one of the following actions:Give your function internet access by placing the function in private subnets and routing the outbound traffic to a NAT gateway in a public subnet. The NAT gateway has a public IP address and connects to the internet through the VPC's internet gateway.-or-Set up an Amazon VPC interface endpoint for Secrets Manager. Your Amazon VPC then connects Secrets Manager from your Lambda function without internet access. Make sure that the Amazon VPC endpoint security group allows port 443 inbound traffic from the Lambda security group or IP address range. And, the Lambda security group allows port 443 outbound traffic to the Amazon VPC endpoint security group or IP address range.Note: If you use AWS PrivateLink VPC endpoints, then make sure that you configure the DHCP options with your Amazon VPC for Domain Name System (DNS). For more information, see DNS attributes for your Amazon VPC.Lambda execution role permissionsGrant permissions to the Lambda execution role to access Secrets Manager secrets. Use the GetSecretValue API call to get the Secrets Manager secret. For more information, see Example: Permission to retrieve secret values.(Optional) AWS Key Management Service (AWS KMS) permissionsIf the Secrets Manager secret is encrypted with an AWS KMS customer managed key instead of the managed key aws/secretsmanager, then additional configuration is required. Make sure to allow the Decrypt API action permission as either the Lambda execution role or the AWS KMS key policy.

Related informationHow do I troubleshoot permissions issues with Lambda?
Question: How do I cancel an Amazon EMR step?

I'm trying to cancel an Amazon EMR step. When I run the cancel-steps command, I get the following error: "Cannot cancel the step. It is already RUNNING."Short descriptionThis error affects Amazon EMR versions 5.27.x and earlier. In these release versions, the cancel-steps command cancels pending steps only. To cancel a running step, kill either the application ID (for YARN steps) or the process ID (for non-YARN steps).In Amazon EMR versions 5.28.0 and later, you can use cancel-steps to cancel both pending and running steps. For more information, see Work with steps using the AWS CLI and console.Note: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.

ResolutionUse one of the following methods to cancel running steps in Amazon EMR versions 5.27.x and earlier.Cancel YARN applications1.    Connect to the master node using SSH.2.    To find the step's application ID, run the following command to list all running applications.yarn application -list3.    Run the following command to kill the application. Replace application_id with your application ID, such as "application_1505786029486_002."Note: This command kills all pending steps in the queue.yarn application -kill application_idCancel non-YARN applications1.    Connect to the master node using SSH.2.    Run the following command to get the process ID (pid). In the following example, replace step_id with your step identifier, such as s-Y9XXXXXXAPMD.ps -ef |grep -i step_idIn the following example output, the process ID is 2366:hadoop    2366  4664  0 16:20 ?        00:00:01 /etc/alternatives/jre/bin/java -Xmx1000m -server -XX:OnOutOfMemoryError=kill -9 %p -Dhadoop.log.dir=/mnt/var/log/hadoop/steps/s-2RNURIK9Z2JUH -Dhadoop.log.file=syslog -Dhadoop.home.dir=/usr/lib/hadoop -Dhadoop.id.str=hadoop -Dhadoop.root.logger=INFO,DRFA -Djava.library.path=:/usr/lib/hadoop-lzo/lib/native:/usr/lib/hadoop/lib/native -Dhadoop.policy.file=hadoop-policy.xml -Djava.net.preferIPv4Stack=true -Djava.io.tmpdir=/mnt/var/lib/hadoop/steps/s-2RNURIK9Z2JUH/tmp -Dhadoop.security.logger=INFO,NullAppender -Dsun.net.inetaddr.ttl=30 org.apache.hadoop.util.RunJar /var/lib/aws/emr/step-runner/hadoop-jars/command-runner.jar bash -c envsubst < /home/hadoop/truffle_suffle.json.template3.    Run the following command to kill the process. Replace 2366 with the process identifier for your step.Note: This command kills all pending steps in the queue.kill -9 2366The status of the step changes from Running to Failed.

Related informationCanceling steps
Question: Why did my storage costs not reduce after I deleted a snapshot of my EBS volume and then deleted the volume itself?

I've tried to reduce my data storage costs by deleting snapshots of my Amazon Elastic Block Store (Amazon EBS) volume. Then, I also deleted the volume. Why am I being charged so much?ResolutionCharges for EBS volumes and for snapshots are managed separately. With EBS volumes, you are charged for the amount of storage that you use. Deleting the EBS volume reduces your charges. You can view the charges from the AWS Billing and Cost Management console and dashboard.Deleting a snapshot might not reduce your data storage costs. When you delete a snapshot, you remove only the data referenced exclusively by that snapshot. If other snapshots reference that snapshot's data, then the referenced data is always preserved. You can view the total cost for snapshots in the AWS Billing and Cost Management console.To view the charges for each snapshot, create cost allocation tags. After you tag the snapshots, you can either view the charges for the snapshot on the Cost Allocation Tags dashboard, or you can generate cost and usage reports.

Related informationWhy am I being charged for EBS when all my instances are stopped?
Question: How do I modify the running mode of my WorkSpace?

I want to use the AutoStop function to put my WorkSpace in suspend mode when I'm not using it.

ResolutionAmazon WorkSpaces can be billed by the month or by the hour, depending on which running mode you choose. The running mode is initially specified when launching a new Workspace. To be billed using the monthly model, leave the running mode as AlwaysOn when you launch the WorkSpace. To be billed using the hourly model, choose AutoStop.To change the running mode after a WorkSpace has launched, follow the directions at Modify the running mode. By default, only system administrators can modify the running mode. However, other users can perform this task if they are given the relevant permissions to manage Workspaces. Follow the directions in Switch the WorkSpace running mode, depending on your client version.Note: Updating the running mode of a WorkSpace from AutoStop to AlwaysOn might result in an overlap in billing between the two billing models. If you plan to transition from AutoStop to AlwaysOn, consider making the change near the end of a month.

Related informationAdminister your WorkSpacesAmazon WorkSpaces FAQs
Question: Why am I receiving a ThrottlingExceptions error when making requests to AWS KMS?

I received a ThrottlingException error when making requests to AWS Key Management Service (AWS KMS) similar to the following:You have exceeded the rate at which you may call KMS. Reduce the frequency of your calls. (Service: AWSKMS; Status Code: 400; Error Code: ThrottlingException; Request ID: EXAMPLEIDShort descriptionThe ThrottlingException error code indicates that the rate of requests to AWS KMS is exceeding the request quotas for your AWS account. As a result, the AWS KMS service throttles the request.

ResolutionUse the following best practices to troubleshoot ThrottlingException errors:Review AWS KMS usage metrics from the service quotas service to identify the maximum and average rate of requests per second. AWS KMS publishes usage metrics to Amazon CloudWatch for different AWS KMS request quotas. For example, Encrypt and Decrypt operations use shared quotas for cryptographic operations.Reduce the rate of requests and consider using or modifying the backoff and retry logic.For server-side encryption using AWS KMS CMKs (SSE-KMS) with Amazon Simple Storage Service (Amazon S3) buckets, use an S3 Bucket Key. For instructions, see Reducing the cost of SSE-KMS with Amazon S3 Bucket Keys.Use the data key caching feature with the AWS Encryption SDK encryption library. Data key caching reduces the rate of API requests by caching and reusing the data keys for encryption to meet cost and performance requirements.Request an AWS KMS quota increase to exceed the request quota.Create an Amazon CloudWatch alarm to alert you when a utilization percentage is reached before you reach the request quota.

Related informationWhat happens to new or existing objects when I enable default encryption with AWS KMS on my Amazon S3 bucket?Manage your AWS KMS API request rates using Service Quotas and Amazon CloudWatch
Question: How can I create SMTP credentials to use with Amazon SES? How can I authenticate to Amazon SES using SMTP credentials?

I want to create Simple Mail Transfer Protocol (SMTP) credentials that I can use with Amazon Simple Email Service (Amazon SES) SMTP endpoints. Then, I want to authenticate to Amazon SES using the SMTP credentials.

ResolutionTo create credentials for the Amazon SES SMTP interface, follow these steps:Note: The credentials for the Amazon SES SMTP interface are different from the access keys that you create using AWS Identity and Access Management (IAM) for an SMTP user. To rotate your SMTP credentials, you can either create new SMTP credentials or convert your existing secret access key into the Amazon SES SMTP format.Open the Amazon SES console.Important: The IAM user or role that you use to create the SMTP credentials must have permissions for iam:ListUsers, iam:CreateUser, iam:CreateAccessKey, and iam:PutUserPolicy.Because SMTP credentials are Regional, review the AWS Region selector in the navigation bar to confirm that you're in the correct Region.From the navigation pane, under Email Sending, choose SMTP Settings.Choose Create My SMTP Credentials.For IAM User Name, you can accept the default name, or enter a new name.Choose Create.Choose Download Credentials. This is the only time that you can download the SMTP credentials for this user.By default, SMTP users are created with permissions for sending raw messages (ses:SendRawEmail). You can modify the SMTP user's permissions using IAM. For more information on Amazon SES permissions, see Identity and access management in Amazon SES.After you create the SMTP credentials, you can configure the credentials to authenticate to Amazon SES depending on your email-sending method:Using the Amazon SES SMTP interface to send emailSending email through Amazon SES using software packagesSending emails programmatically through the Amazon SES SMTP interfaceIntegrating Amazon SES with your existing email server

Related informationObtaining Amazon SES SMTP credentialsConnecting to an Amazon SES SMTP endpoint
Question: How do I troubleshoot the error “ECS was unable to assume the role” when running the Amazon ECS tasks?

I'm getting the following error when I run my Amazon Elastic Container Service (Amazon ECS)/AWS Fargate tasks:ECS was unable to assume the role 'arn:aws:iam::xxxxxxxxxxxx:role/yyyyyyyy' that was provided for this task. Please verify that the role being passed has the proper trust relationship and permissions and that your IAM user has permissions to pass this role.

ResolutionYou get this error because of one or more of the following reasons:The task execution AWS Identity and Access Management (IAM) role or task role specified in the task definition doesn't exist.The task execution IAM role or task role specified in the task definition doesn't have the correct trusted relationship policy.Verify that the task execution role or task role existsTo check if the task execution role or task role defined in the task definition exists using the console, do the following:Open the IAM console.Choose Roles.Search the list of roles for the task execution role or task role that you included in the task definition.To check if the task execution role or task role exists using AWS Command Line Interface (AWS CLI), run the following command:Note: This command retrieves information about the specified IAM role.aws iam get-role --role-name example-task-execution-roleNote: If you receive errors when running AWS CLI commands, make sure that you’re using the most recent version of the AWS CLI.If the role doesn't exist, then you get the following error:An error occurred (NoSuchEntity) when calling the GetRole operation: The role with name example-task-execution-role cannot be found.If the role doesn't exist, consider doing either of the following:Update the task definition to use the correct IAM role for the task.Create an IAM role with the same name as the role specified in the task definition.Verify if the task execution role or task role in the task definition has the correct trusted relationship policyBe sure that the trusted relationship policy for the role allows the service ecs-tasks.amazonaws.com. This is required for the Amazon ECS task to assume the specified IAM role.To check the trust relationship policy and update as needed, do the following:1.    Open the IAM console.2.    In the navigation pane, choose Roles.3.    Search the list of roles for the task execution role or task role that you included in your task definition.4.    Choose the role.5.    Choose Trust relationships.6.    Verify if the trust relationship for the role contains the following policy:{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "",      "Effect": "Allow",      "Principal": {        "Service": "ecs-tasks.amazonaws.com"      },      "Action": "sts:AssumeRole"    }  ]}7.    If the trust relationship matches the policy, choose Cancel. Otherwise, choose Edit trust relationship.8.    Copy the preceding policy into the Policy Document window, and then choose Update Trust Policy.

Related informationIAM roles for tasksAmazon ECS task execution IAM roleTroubleshooting Amazon Elastic Container Service identity and access
Question: How can I check the integrity of an object uploaded to Amazon S3?

I want to upload an object to an Amazon Simple Storage Service (Amazon S3) bucket. Additionally, I want to verify the integrity of the uploaded object. How can I do that?Short descriptionFollow these steps to verify the integrity of uploaded objects using the Content-MD5 header:Note: When you use the Content-MD5 header, Amazon S3 checks the object against the provided Content-MD5 value. If the values do not match, you receive an error.1.    Calculate the Content-MD5 value of the object.2.    Verify the integrity of the uploaded object by passing the Content-MD5 value as a request header during the object upload.

ResolutionCalculate the Content-MD5 value of the objectWindows OSIf you're using a Windows operating system, you can use the Get-FileHash cmdlet from Microsoft PowerShell Utility to calculate MD5 digest, like this:Get-FileHash \path\to\file -algorithm MD5 | Format-ListNote: The Get-FileHash cmdlet is available with Microsoft PowerShell Utility version 4.0 and later.Here's an example output:Algorithm : MD5Hash      : C9A5A6878D97B48CC965C1E41859F034Path      : \path\to\fileThen, apply base64-encoding to the calculated MD5 digest to get the required Content-MD5 value:$hashString ='C9A5A6878D97B48CC965C1E41859F034'$hashByteArray = [byte[]] ($hashString -replace '..', '0x$&,' -split ',' -ne '')$ContentMD5 = [System.Convert]::ToBase64String($hashByteArray)Echo $ContentMD5yaWmh42XtIzJZcHkGFnwNA==In this example, the output of Echo $ContentMD5, ("yaWmh42XtIzJZcHkGFnwNA=="), is the required Content-MD5 value.Linux OSIf you're using a Linux operating system, run the following OpenSSL command to obtain the Content-MD5 value of your file:openssl md5 -binary PATH/TO/FILE | base64Verify the integrity of the uploaded objectWhen you use PutObject to upload objects to Amazon S3, pass the Content-MD5 value as a request header. Amazon S3 checks the object against the provided Content-MD5 value. If the values do not match, you receive an error.The Content-MD5 request header can also be used with the S3 UploadPart API.

Related informationCommon request headersS3 error responses