VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: How can I simulate a DDoS attack to test Shield Advanced?

I want to run a simulation of a Distributed Denial of Service (DDoS) attack to test the responsiveness of AWS Shield Advanced. How can I do this?Short descriptionAWS Shield Advanced helps you protect your application against DDoS attacks. DDoS attacks occur when attackers use a flood of traffic from multiple sources to attempt to impact the availability of a targeted application. Shield Advanced provides enhanced visibility into DDoS events and attacks. For more information, see Visibility into DDoS events.You can test the responsiveness of AWS Shield Advanced with:A simulated DDoS attack in production traffic with an authorized pre-approved AWS Partner Network (APN) Partner.A simulated DDoS attack using the DDoSDetected metric value set to 1 with the Shield Response Team (SRT).

ResolutionDDoS simulation testing with an AWS Partner Network PartnerAWS DDoS Test Partners are authorized to conduct DDoS simulation test on your behalf without prior approval from AWS. You must agree to the Terms and Conditions for DDoS simulation tests. Your application must be well-architected prior to DDoS simulation testing as described in the AWS Best Practices for DDoS Resiliency whitepaper.Note: Don't perform a DDoS simulation without an approved partner.For more information and to get started, see DDoS Simulation Testing Policy.DDoS simulation testing with the Shield Response TeamShield Advanced provides added support with the Shield Response Team that specializes in testing the DDoS response workflow. You can contact the Shield Response Team to request assistance with running a DDoS simulation. The Shield Response Team will create a simulated DDoS attack and trigger the DDoSDetected metric value to 1 during a specific time period.Before contacting the Shield Response Team to request assistance with running a DDoS simulation, make sure that you have:Completed the steps for your environment in Getting started with AWS Shield Advanced.Completed the steps for configuring access for the Shield Response Team.Reviewed the AWS Best Practices for DDoS Resiliency whitepaper.Completed the steps to add resources to protect and configure protections.Used Amazon CloudWatch to create a DDoS dashboard and set CloudWatch alarms. For instructions, see Monitoring with Amazon CloudWatch.Note: The Shield Response Team won't contact you during DDoS simulation testing to report an attack.

Related informationBest practices for security, identity, & complianceAWS Shield Advanced capabilities and optionsHow can I defend against DDoS attacks with Shield Standard?
Question: How can I troubleshoot the API Gateway error “Execution failed due to configuration error: General SSLEngine problem”?

Amazon API Gateway returned an error for my API request similar to the following:"Execution failed due to configuration error: General SSLEngine problem"ResolutionAPI Gateway API requests perform an SSL handshake on the backend. Successful API Gateway SSL handshakes must include the following requirements:A supported CAThe CA must be supported by API Gateway for HTTP, HTTP proxy, and private integrations. To check the CA fingerprint, run the following OpenSSL command for your operating system:Linuxopenssl x509 -in cert.pem -fingerprint -sha256 -nooutopenssl x509 -in cert.pem -fingerprint -sha1 -nooutWindowsopenssl x509 -noout -fingerprint -sha256 -inform pem -in [certificate-file.crt]openssl x509 -noout -fingerprint -sha1 -inform pem -in [certificate-file.crt]A valid ACM certificate that isn't expiredTo check the expiration date of the certificate, run the following OpenSSL command:openssl x509 -in certificate.crt -text -nooutIn the output, check for the validity timestamp:Validity            Not Before: Apr 29 12:49:02 2020 GMT            Not After : Apr 29 12:49:02 2021 GMTIn this example output, the certificate is valid on April 29, 2020 and expires after April 29, 2021.A valid CA certificateCheck the CA certificate configuration by running the following OpenSSL command:openssl s_client -connect example.com:443 -showcertsValidate that:The subject of the intermediate and certificate matches the issuer of the entity certificate.The subject of the root certificate matches the issuers of the intermediate certificate.The subject and issuer are the same in the root certificate.A certificate that doesn't exceed 2048 bitsCheck the size of the certificate by running the following OpenSSL command:openssl x509 -in badssl-com.pem -text -noout | grep -E '(Public-Key):'Note: The certificate size can't exceed 2048 bits.If your certificate doesn't meet any of these requirements, first update your private CA. Then, reissue a new certificate using AWS Certificate Manager (ACM).

Related informationSet up API Gateway private integrations
Question: Why are my Amazon SQS charges higher than expected?

I was billed a higher charge for Amazon Simple Queue Service (Amazon SQS) than I was expecting based on my usage.-or-I’m hitting the Amazon SQS free tier limit, but I only sent a few messages during the billing period.How can I better understand Amazon SQS charges, and how can I reduce Amazon SQS costs?Short descriptionThe most common cause for a high number of SQS requests are empty receives, which are billed as ReceiveMessage requests that don’t return a message. Amazon SQS charges are based on request volume and data transferred in and out of Amazon SQS. A consumer polling an SQS queue continuously results in empty receives. These empty receives are charged per Amazon SQS pricing even if messages aren’t sent or received from your SQS queue.

ResolutionReview the NumberOfEmptyReceives CloudWatch metricTo determine if empty receives are contributing to high Amazon SQS charges, review the Amazon CloudWatch NumberOfEmptyReceives metric for the SQS queue. A high number of empty receives indicates that a consumer is making a high number of ReceiveMessage requests.Verify whether the SQS queue is configured to invoke a Lambda functionWhen an SQS queue is configured to invoke an AWS Lambda function, the Lambda long polls the queue. This means that even if the SQS queue isn't used, a Lambda function invocation results in empty receives and associated charges.Best practices to reduce Amazon SQS costsFollow these best practices to minimize Amazon SQS costs:Remove queues that aren’t neededTo prevent ReceiveMessage requests made to inactive queues, consider deleting SQS queues when they are no longer needed.Scale down consumersHorizontal scaling is used to maximize Amazon SQS queue throughput by increasing the number of both message producers and consumers as your volume requirements increase. Similarly, when the message rate reduces, be sure to scale down the consumers to prevent unnecessary ReceiveMessage requests.Long pollingAmazon SQS long polling helps reduce both costs and empty receives. You can set the ReceiveMessage wait time to a value of up to 20s to activate long polling. You can specify the wait time using either of the following methods:At the queue level, you can configure the ReceiveMessageWaitTimeSeconds queue attribute.At the message level, you can send the ReceiveMessage API call with the ReceiveMessageWaitTime parameter.Note: Setting the ReceiveMessageWaitTime parameter at the message level in the ReceiveMessage API overrides the parameter value configured at the queue level. For a Lambda function invoked using Amazon SQS, Lambda uses long polling to poll a queue.Batch operationsAmazon SQS pricing is based on the number of requests. You can reduce the number of requests, and in turn reduce costs, by batching the message actions. For example, instead of calling the SendMessage API 10 times, a single SendMessageBatch operation can be configured to send 10 messages. Other available batch operation actions include DeleteMessageBatch and ChangeMessageVisibilityBatch.

Related informationReducing Amazon SQS costs
Question: How do I view my software subscriptions on the AWS Marketplace?

How do I see the products I’ve subscribed to through the AWS Marketplace?ResolutionYou can view your active subscriptions in the AWS Marketplace subscription manager by signing in to the AWS Marketplace console, and then choosing Manage subscriptions.

Related informationAWS Marketplace Help and FAQ
Question: How do I install a Let's Encrypt SSL certificate in a Bitnami stack hosted on Lightsail?

I want to install an SSL certificate for my website in an Amazon Lightsail instance with a Bitnami stack. But, I don't know how.

Short descriptionTo install a standard Let's Encrypt SSL certificate for websites that are hosted in a Lightsail instance with a Bitnami stack, use Bitnami's bncert-tool. Examples of these instance blueprints include WordPress, LAMP, Magento, and MEAN. If you have a different instance blueprint or want to install a wildcard certificate (for example, *.example.com), then see one of the following:For standard certificates in Lightsail instances without a Bitnami stack**,** see How do I install a standard Let's Encrypt SSL certificate in a Lightsail instance?For wildcard certificates in Lightsail instances with a Bitnami stack, see How do I install a wildcard Let's Encrypt SSL certificate in a Bitnami stack hosted on Amazon Lightsail?For wildcard certificates in Lightsail instances without a Bitnami stack, see How do I install a wildcard Let's Encrypt SSL certificate in Amazon Lightsail?Before you use the bncert-tool, note the following prerequisites and limitations:Make sure that the domain in the DNS records points to the IP address of your Lightsail instance.Certificate creation for wildcard domains isn't possible using the bncert-tool.The bncert-tool is supported only on 64-bit Linux operating systems. You can't use it with IPv6 addresses or to configure HTTPS certificates for NGINX web servers.

ResolutionBitnami uses the bncert-tool for installing standard Let's Encrypt certificates. Bitnami stacks released after May 10, 2019 include the bncert-tool by default.The bncert-tool automatically performs the following procedures:Configures HTTPS certificates on Bitnami stacks.Creates automatic certificate renewals.Sets up HTTP to HTTPS redirections.Run the following command to launch the Bitnami HTTPS configuration tool:sudo /opt/bitnami/bncert-toolFor more information on using or downloading the HTTPS Configuration Tool, see Learn about the Bitnami HTTPS configuration tool on the Bitnami documentation website.
Question: Why does my Athena query fail with the error "HIVE_PARTITION_SCHEMA_MISMATCH"?

When I run my Amazon Athena query on a partitioned table, the query fails with the error "HIVE_PARTITION_SCHEMA_MISMATCH."Short descriptionWhen you run a query on an Athena partitioned table, Athena validates the table schema and the schema of its partitions in the AWS Glue Data Catalog. The validation compares the column data types in order and makes sure that the column data types match for the columns that overlap. A new partition usually inherits the schema of the associated table. However, certain scenarios can cause the schemas to differ over time. When the data type for a column in the partition schema does not match the corresponding column data type in the table schema, your query fails with the error "HIVE_PARTITION_SCHEMA_MISMATCH."You can resolve this error with either of the following approaches:If you used an AWS Glue crawler to create the table, then configure the AWS Glue crawler to update the partition schema.If you created the table manually, then use an Athena data definition language (DDL) statement to drop the affected partition and recreate the partition.

ResolutionConfigure the AWS Glue crawler to update the partition schemaOpen the AWS Glue console.On the navigation pane, choose Crawlers.Select the crawler that you want to configure.Choose Action, and then choose Edit crawler.Choose Next until you navigate to the Choose the crawler's output page.Expand Configuration options.Select Update all new and existing partitions with metadata from the table.Choose Next, and then choose Finish to save the crawler configuration.On the Crawlers page, select the crawler that you edited.Choose Run crawler. When you run the crawler, the partitions inherit the table schema.Use an Athena DDL statement to drop the affected partition and recreate the dropped partitionOpen the Amazon Athena console.On the Query editor tab, run the ALTER TABLE DROP PARTITION command to drop the affected partition.Run the ALTER TABLE ADD PARTITION command to recreate the dropped partition.Note: If your table uses Hive-compatible partitions, you can run the MSCK REPAIR TABLE command to recreate the dropped partition.

Related informationSyncing partition schema to avoid "HIVE_PARTITION_SCHEMA_MISMATCH"Setting crawler configuration options on the AWS Glue console
Question: Why is AWS WAF blocking my request or responding with a 403 Forbidden error?

How do I identify the AWS WAF rule that is blocking my request or responding with a 403 Forbidden error?Short descriptionIf a request matches an AWS WAF rule that is set to Block, then by default AWS WAF returns a 403 Forbidden error. If you set up Custom responses for block actions, then AWS WAF returns your configured response.To troubleshoot a 403 Forbidden error:Identify the AWS WAF rule or rule group that's blocking the request.Make changes to the identified rule to allow your request.

ResolutionIdentify the AWS WAF rule or rule group that blocked the requestThere are two options to identify the AWS WAF rule or rule group that's blocking the request.Option 1: sampled requestsIf request sampling is turned on and your request was blocked within the past three hours, view a sample of web requests for blocked requests.Note: If it's been more than three hours since your request was blocked, you can re-send the same request to generate new sampled request.Use the Sampled requests table to identify which rule or rule group blocked the request:Identify the request using the Source IP and URI columns.Identify the rule or rule group that matched the request, using the Metric name column. If the request was blocked by a rule group, use the Rule inside rule group column to identify the rule.Using the Action column, confirm that the identified rule is set to Block.Note the rule or rule group that blocked the request. Then, proceed to Make changes to the AWS WAF rule to allow your request.Option 2: AWS WAF logsIf AWS WAF logging is turned on, you can analyze the logs to find the rule or rule group that blocked the request.View your AWS WAF logs.Identify the blocked request in the logs.View the terminatingRuleId field to identify which AWS WAF rule or rule group that blocked the request.Note the rule or rule group that blocked the request. Then, proceed to Make changes to the AWS WAF rule to allow your request.Note: If you don’t have AWS WAF logging turned on at the time of your request, you must first turn on AWS WAF logging. Then, reproduce the request to identify the rule blocking the request in the AWS WAF logs. For more information, see How do I turn on AWS WAF logging and send logs to CloudWatch, Amazon S3, or Kinesis Data Firehose?Make changes to the AWS WAF rule to allow your requestAfter identifying the rule or rule group that blocked the request, make appropriate changes to the rule or rule group so the specific request is allowed.If the blocking rule is an AWS Managed Rule, you must customize the behavior of the rule to allow your identified request. For instructions on customizing AWS Managed Rules, see How to customize behavior of AWS Managed Rules for AWS WAF.If the blocking rule is a custom rule, update your rule parameters using a rule statement so the request is allowed by the custom rule.
Question: Why did I receive the IAM error "AWS was not able to validate the provided access credentials" in some AWS Regions?

I assumed an AWS Identity and Access Management (IAM) role and my API call returned an error similar to the following:"An error occurred (AuthFailure) when calling the DescribeInstances operation: AWS was not able to validate the provided access credentials."Short descriptionThe AWS Security Token Service (AWS STS) supports an updated version of session tokens, version 2. New AWS Regions (for example, Bahrain) are not enabled by default and only accept the updated version of session tokens. This error can occur if version 1 session tokens are used to make a request to service endpoints in an AWS Region that are not enabled by default. For more information, see Managing AWS STS in an AWS Region.

ResolutionSession tokens obtained from Regional AWS STS endpoint are of version 2 and valid in all AWS Regions. As a best practice, it is recommended to use Regional STS endpoints. Using an endpoint that is geographically closer to your application reduces latency and provides better response times.Use one of the following methods to resolve this issue.Obtain tokens from a Regional endpointThe following example command uses AWS SDK for Python (Boto3).Note:Replace your-region, AccountID, and RoleName as per your environment.Setting the endpoint_url is required to configure the STS client for the Regional endpoint.# Replace existing code to create STS client with the followingsts_client = boto3.client('sts', region_name='your-region', endpoint_url='https://sts.your-region.amazonaws.com')Include region and endpoint url options in the existing bash script/command to use regional endpoints.aws sts assume-role --role-arn arn:aws:iam::AccountID:role/RoleName --role-session-name RoleName --region your-region --endpoint-url https://sts.your-region.amazonaws.comChange Region compatibility of session tokens for global endpointBy default, the AWS STS calls to the global endpoint issues session tokens which are of version 1. Version 1 tokens are only valid in AWS Regions that are enabled by default. However, you can also configure the STS global endpoint to issue tokens in version 2 that can be used in all AWS Regions.For instructions, see change the Region compatibility of session tokens for the global endpoint.Important: Version 2 tokens include more characters than version 1. This might affect the existing systems where you temporarily store tokens.

Related informationAWS Security Token Service (STS) now supports enabling the global STS endpoint to issue session tokens compatible with all AWS RegionsRegions and endpoints
Question: What are the differences between data events and management events in CloudTrail?

I want to understand the differences between data events and management events in AWS CloudTrail. How are the two types of CloudTrail events different?ResolutionCloudTrail data eventsCloudTrail data events (also known as "data plane operations") show the resource operations performed on or within a resource in your AWS account. These operations are often high-volume activities.Example data eventsAmazon Simple Storage Service (Amazon S3) object-level API activity (for example, GetObject, DeleteObject, and PutObject API operations)AWS Lambda function invocation activity (for example, InvokeFunction API operations)Amazon DynamoDB object-level API activity on tables (for example, PutItem, DeleteItem, and UpdateItem API operations)Viewing data eventsBy default, trails don't log data events, and data events aren't viewable in CloudTrail Event history. To activate data event logging, you must explicitly add the supported resources or resource types to a trail.For instructions to activate data event logging, see Logging data events for trails.For instructions to view data events, see Getting and viewing your CloudTrail log files.Note: Additional charges apply for logging data events. For more information, see AWS CloudTrail pricing.CloudTrail management eventsCloudTrail management events (also known as "control plane operations") show management operations that are performed on resources in your AWS account.Example management eventsCreating an Amazon Simple Storage Service (Amazon S3) bucketCreating and managing AWS Identity and Access Management (IAM) resourcesRegistering devicesConfiguring routing table rulesSetting up loggingViewing management eventsBy default, trails log management events across AWS services and is available for free. You can review and download the most recent 90-day history of your account's management events using CloudTrail Event history or the LookupEvents API.For more information, see Logging management events for trails.Note: You can deliver one copy of your ongoing management events to Amazon S3 for free by creating trails. Creating trails lets you store events in Amazon S3 for up to 90 days. Additional copies of management events incur a charge. For more information, see AWS CloudTrail pricing.To view CloudTrail data events and management events stored in your Amazon S3 bucket after 90 daysYou can use Amazon Athena to view CloudTrail data events and management events stored in your Amazon S3 bucket.For instructions, see How do I automatically create tables in Amazon Athena to search through AWS CloudTrail logs? Also, Creating the table for CloudTrail logs in Athena using manual partitioning.

Related informationHow CloudTrail worksCloudTrail supported services and integrationsHow do I use CloudTrail to review what API calls and actions have occurred in my AWS account?
Question: How do AWS Support plans work in an organization in AWS Organizations?

I'm joining or creating an organization in AWS Organizations. How does this affect my AWS Support plan?ResolutionAWS Support plans are account-specific, so each account in an organization has its own AWS Support plan.The AWS Support plan on the payer account of an organization doesn't automatically apply to member accounts in the organization.Note: Enterprise On-Ramp and Enterprise Support plans have the option to include multiple accounts in an aggregated monthly billing.When a member account with an AWS Support plan is added to an organization, the following happens automatically:The AWS Support plan on the member account is temporarily canceled.A prorated refund is issued to the member account for the remainder of the month.In a few minutes, the AWS Support plan is automatically reactivated on the member account.A new monthly bill is generated on the organization's consolidated bill.

Related informationAWS Support FAQsAWS Support Plan Pricing