VishaalY/solutions-architect-hf-dataset huggingface dataset:
Question: Why am I getting a "WAFInvalidParameterException" error in AWS WAF?

Why am I getting the WAFInvalidParameterException error?Short descriptionIf the operation you are performing has parameters that AWS WAF can't recognize, the operation fails and one of the errors that AWS WAF returns is WAFInvalidParameterException. The most common reasons for this error are:A parameter name or value specified isn't valid.The ARN referenced in the request is from a resource that can't be associated to the web ACL.

ResolutionIf the value of a parameter isn't recognized by AWS WAF, you see the following example error message:An error occurred (WAFInvalidParameterException) when calling the CreateRuleGroup operation: Error reason:<br>The scope is not valid., field: SCOPE_VALUE, parameter: <parameter value>For example, a Scope parameter value that is other than REGIONAL or CLOUDFRONT returns this error.To troubleshoot the error, do the following:identify the parameter that has a value that can't be recognized by AWS WAF.Modify the parameter to a value supported by AWS WAF. For supported values, see AWS WAFV2 API Reference.AWS WAF can be associated with an Amazon CloudFront distribution, Amazon API Gateway REST API, Application Load Balancer, or AWS AppSync GraphQL API. If you try to associate with a different resource type, you see the following example error message:An error occurred (WAFInvalidParameterException) when calling the AssociateWebACL operation: Error reason:<br>The ARN isn't valid. A valid ARN begins with arn: and includes other information separated by colons or slashes., field: RESOURCE_ARN, parameter: <resource arn>To troubleshoot the error, do the following:Identify the parameter that has a value that can't be recognized by AWS WAF.Modify this parameter to a resource supported by AWS WAF.
Question: Why was I charged for AWS Business Support when I have an AWS Activate Portfolio package?

I was charged for my AWS Support plan, even though I signed up for an AWS Activate Portfolio package that includes a credit for AWS Business Support. How can I resolve this issue?ResolutionIf you had an AWS Support subscription other than a Business-level Support plan before you were approved for an AWS Activate Portfolio package, see AWS Premium Support FAQs, and follow the instructions in Q: How do I cancel my AWS Support subscription? to cancel your support subscription. Then, follow the instructions in the welcome email you received from the AWS Activate team.If you can't locate the email from the AWS Activate team, or if you have questions about the AWS Activate program, then contact the AWS Activate team at AWS Activate Contact Us.

Related informationAWS ActivateAWS Support
Question: Why is MFA failing on my AWS Managed Microsoft AD directory or my AD Connector?

I've enabled multi-factor authentication (MFA) on my AWS Directory Service for Microsoft Active Directory (AWS Managed Microsoft AD) directory or AD Connector. However, MFA is failing. How can I troubleshoot this?ResolutionThe security group associated with your AWS Managed Microsoft AD or AD Connector must have a rule that allows outbound traffic on port UDP 1812 to the security group associated with your RADIUS server.Note: If you're using a custom UDP port for MFA authentication, then allow the custom UDP port traffic under the following:Outbound rules on the security group associated with your AWS Managed Microsoft AD or AD Connector.Inbound rules on the Security group associated with your RADIUS server.Verify that port UDP 1812 or your custom UDP port for MFA is allowed under outbound traffic on the AWS Managed Microsoft AD or AD Connector security groupTo find the security group associated with your DNS servers, open the AWS Directory Service console, and note the IP addresses under DNS address.Open the Amazon Elastic Compute Cloud (Amazon EC2) console, and then choose Network Interfaces.In the search field, enter one of the DNS IP addresses found in step 1 and select the checkbox for that interface.Under Details, select the security group listed in Security Groups.Select View outbound rules. Verify that there is a rule allowing outbound traffic on port UPD 1812 for UDP, or your custom UDP port for MFA, to the IP address space or security group associated with your RADIUS EC2 instances.Verify that the secret key for directory services is the same key configured on the RADIUS serverThe RADIUS client and server must use the same shared password or key. Check the RADIUS server logs for further information. The method for checking Radius logs depends on your configuration. Review the documentation for your configuration for instructions on accessing the logs.

Related informationEnable multi-factor authentication for AWS Managed Microsoft ADEnable multi-factor authentication for AD Connector
Question: What's the IP address range for Device Farm?

I want to test my company's app using AWS Device Farm, but our internal systems are behind a corporate firewall. I need the IP address range of Device Farm to allow device traffic through.

ResolutionFor mobile devicesIn your internal systems, allow requests from the IP address ranges:54.244.50.32/2799.78.197.0/2915.248.40.40/2954.239.50.200/29Note: This IP CIDR range allows traffic coming from Device Farm devices during mobile automation testing only.For desktop browsersIt's a best practice to use the Amazon Virtual Private Cloud (Amazon VPC) for desktop browser testing. Amazon VPC's Test Grid feature is more secure than an IP allow list, and your VPC will have direct access to your Device Farm resources.Note: If your VPC is located in an AWS Region other than us-west-2, then you must create a VPC in the us-west-2 Region and activate VPC peering.To use an allow list for internet-facing browser testing, make sure to allow requests from the following IP range:100.20.244.10344.225.225.3244.227.49.13335.82.102.6Note: These IPs are stable but not permanent. If you are unable to access Device Farm with these IPs, then they might have changed since the most recent update of documentation.

Related informationAWS Device Farm FAQsAWS IP address rangesWhat is AWS Device Farm?
Question: How do I resolve the ErrorPortAllocation error on my NAT gateway?

I keep getting the ErrorPortAllocation error on my NAT gateway, and several concurrent connections to my destination host are failing. How do I resolve this port allocation error?Short descriptionNAT gateways support up to 55,000 simultaneous connections to each destination. If this threshold is crossed, then new connections to the destination fail and the ErrorPortAllocation metric for the NAT gateway increases in Amazon CloudWatch.To resolve this issue, find the source clients and destinations that are causing these errors. Then, follow the steps in the Resolve port allocations errors Resolution section.Prerequisites:Make sure that the VPC flow log is activated at the VPC level or to the subnets where the NAT gateway is used.Make sure that the VPC flow log is configured to deliver to CloudWatch.

ResolutionFind source clients and their connection destinations1.    Open the CloudWatch console.2.    In the navigation pane, choose Insights.3.    For Log group, choose the log group where the flow logs are recorded.4.    Find where traffic is going:filter (srcAddr like 'NAT gateway Private IP' and dstAddr not like 'xxx.xxx.')| stats count(*) as numaccept by dstAddr| sort numaccept desc| limit 10The results show the destination IP with the greatest number of responses during the time frame when you received the port allocation errors.Note: Replace xxx.xxx. with the first two octets of your VPC CIDR. Also, replace NAT gateway Private IP with the private IP of your NAT gateway.5.    Find the source clients that are sending traffic to the destination:filter (dstAddr like 'Public IP from above filter' and srcAddr like 'xxx.xxx.') | stats sum(bytes) as bytesTransferred by srcAddr, dstAddr| sort bytesTransferred desc| limit 10Note: Replace xxx.xxx. with the first two octets of your VPC CIDR. Also, replace Public IP from above filter with the destination IP that you received from the preceding query.Resolve port allocation errorsCreate a NAT gateway in each Availability Zone, and then distribute your clients across Availability Zones. Route traffic to the internet using a NAT gateway in the same Availability Zone as your client to reduce cross Availability Zone data charges.If you notice an increase in the IdleTimeoutCount metric in CloudWatch, then configure your application or private instance to close idle connections. This lets the NAT gateway allocate the source port to new connections.Limit the number of connections that your clients can make to a single destination.For traffic going to an Amazon Simple Storage Service (Amazon S3) or Amazon DynamoDB public IP address in the same AWS Region, use a gateway VPC endpoint. There are no data processing or hourly charges for using gateway VPC endpoints.

Related informationSample queriesMonitoring NAT gateways using Amazon CloudWatch
Question: How do I troubleshoot problems establishing communication over VPC peering?

I can't establish communication between my Amazon Virtual Private Cloud (Amazon VPC) over VPC peering.

Short descriptionVPC peering network connectivity failures might occur due to incorrect or missing route tables, firewall rules, or DNS (if applicable). To route traffic between VPCs in a peering connection with private IP addresses, the VPCs must be able to communicate with each other. You must allow the VPCs to communicate as if they are in the same network.

ResolutionVerify that the VPC peering connection is in the Active state.Update your route tables for your VPC peering connection. Verify that the correct routes exist for connections to the IP address range of your peered VPCs through the appropriate peering ID.Verify that an ALLOW rule exists in the network access control (network ACL) table for the required traffic.Verify that the security group rules allow network traffic between the peered VPCs.To use a domain name to reach a destination in the peer VPC, see Why can't I resolve domain names over my VPC peering connection?To verify that a source or destination doesn't reject the required traffic, use VPC Flow Logs. This rejection might occur due to the missing rules under security groups or network ACLs of the source or destination.

Related informationVPC peering basics
Question: How can I add Oracle Enterprise Manager Database Control or Database Express to an Amazon RDS Oracle DB instance?

How can I add Oracle Enterprise Manager Database Control or Database Express to an Amazon Relational Database Service (Amazon RDS) Oracle DB instance?Short DescriptionUse the Oracle Enterprise Manager (OEM) Option Group to configure OEM Database Control or Database Express based on the following versions of Amazon RDS Oracle:Oracle Enterprise Manager Database Express for Oracle 19c, Oracle 18c, and Oracle 12cOracle Enterprise Manager 11g Database Control for Oracle 11gFor more information, see Oracle Enterprise Manager Database Express.

ResolutionOpen the Amazon RDS console in the same AWS Region as your DB instance.Choose Databases from the navigation pane, and then choose your DB instance.Choose Option groups from the navigation pane. Then, create an option group, if you don't already have an option group that is associated to your DB instance.Confirm that the option group uses the Oracle EE or Standard engine, and then choose one of the supported major DB engine versions, such as 12.1.After you create the option group, select the new option group, and then choose Add option.From the Add option page, choose OEM from the Option name dropdown list.Choose the DB engine version, such as 12.1.0.2, from the Version dropdown list.Confirm that your Amazon Virtual Private Cloud (Amazon VPC) is configured to allow inbound access to the OEM port.From the Security Groups list, select the VPC or DB security groups that you want to enable.Note: You might see that the DB security group is different from the VPC or Amazon Elastic Compute Cloud (Amazon EC2) security group. This is because a DB instance on an EC2 Classic instance might use a DB security group, but DB instances on a VPC use the VPC/EC2 security group.Select Apply Immediately, and choose Add Option.Note: If you add the OEM option for an Oracle 11g DB instance, then there is no outage, and you don't need to restart your DB instance. If you add the OEM option for an Oracle 19c, Oracle 18c, or Oracle 12c DB instance, then a brief outage occurs while your DB instance is automatically restarted.Associate this option group with the DB instance by modifying your DB instance.After you enable the OEM option, you can use either Database Control or Database Express from your web browser. The URL of the OEM option includes the Amazon RDS endpoint and OEM port. For example, https://mydb.f9rbfa893tft.us-east-1.rds.amazonaws.com:5500/em for Oracle 19c, Oracle 18c, or Oracle 12c DB instances or https://mydb.f9rbfa893tft.us-east-1.rds.amazonaws.com:1158/em for Oracle 11g.After the page loads, enter the master user name and master password for your DB instance.You are now ready to manage your Oracle databases.Related InformationOracle on Amazon RDS
Question: How do I troubleshoot keyboard issues when using Amazon WorkSpaces?

My keyboard isn't responding or I have keyboard issues when using Amazon WorkSpaces. How can I fix this?ResolutionTo troubleshoot keyboard issues when using Amazon WorkSpaces, follow these steps:Note: If you are using macOS Catalina 10.15, see Amazon WorkSpaces macOS client application.Confirm that the keyboard works as expected when using local machine to rule out an issue with the keyboard hardware.Verify that you are using the latest Amazon WorkSpaces client.Reboot the WorkSpace from the Amazon WorkSpaces console.Disable any secure keyboard features in your antivirus software settings.Note: Secure keyboard configuration prevents other applications on your computer or the network from detecting and recording what you type in a particular application. Review the documentation for your antivirus software for instructions on how to disable secure keyboard.Disable any custom key remapping applications.If you're using an international keyboard for a Windows WorkSpace, verify that the keyboard layout on the WorkSpace and the client match. To verify and change keyboard language settings for Windows, see Manage the input and display language settings in Windows 10 on the Microsoft website. To verify and change keyboard language settings for macOS, see Type in another language on your Mac with input sources on the Apple website.macOS only: If enabled, the Secure Keyboard Entry option on macOS can prevent the Amazon WorkSpaces client from receiving input from the operating system. To disable Secure Keyboard Entry on macOS, follow these steps:Open a Terminal window.On the menu bar, choose Terminal, then clear Secure Keyboard Entry.If you've completed the above troubleshooting steps and haven't resolved the issue, contact AWS Support for assistance.

Related informationAmazon WorkSpaces Windows client applicationAmazon WorkSpaces Linux client application
Question: "How do I resolve the error: "The following parameters are not defined for the specified group: xxx, xxx" when I upgrade the engine version of my RDS cluster using CloudFormation?"

When I try to upgrade the engine version of my Amazon Relational Database Service (Amazon RDS) cluster using AWS CloudFormation, I get the following error: "The following parameters are not defined for the specified group: xxx, xxx."Short descriptionWhen you upgrade an Amazon RDS DB cluster or instance that uses a custom parameter group, you receive an error if you updateThe EngineVersion property for AWS::RDS::DBCluster or AWS::RDS::DBInstance-or-The Family property for DBClusterParameterGroup or DBParameterGroupFor example, in the following template, updating the EngineVersion property from 5.7.37 to 8.0.28 in the DBInstance resource causes the stack update to fail. The stack update also fails when you update the Family property from MySQL5.7 to MySQL8.0 in the DBParameterGroup resource.Parameters:  DBName:    Default: MyDatabase    Description: The database name    Type: String  DBUser:    NoEcho: 'true'    Description: The database admin account username    Type: String  DBPassword:    NoEcho: 'true'    Description: The database admin account password    Type: StringResources:  MyDB:    Type: 'AWS::RDS::DBInstance'    Properties:      DBName: !Ref DBName      AllocatedStorage: '5'      DBInstanceClass: db.t2.small      Engine: MySQL      EngineVersion: 5.7.37       MasterUsername: !Ref DBUser      MasterUserPassword: !Ref DBPassword      DBParameterGroupName: !Ref MyRDSParamGroup      AllowMajorVersionUpgrade: true  MyRDSParamGroup:    Type: 'AWS::RDS::DBParameterGroup'    Properties:      Family: MySQL5.7      Description: CloudFormation Sample Database Parameter Group      Parameters:        autocommit: '1'        general_log: '1'        old_passwords: '0'Note: There are other scenarios that can cause this error message. The steps in the following Resolution section apply only to the preceding scenario.

ResolutionThe following sets of steps are two ways that you can resolve the error: "The following parameters are not defined for the specified group: xxx, xxx."Note: Applying a parameter group to a DB instance might initiate an instance reboot. During the reboot, there is a database outage.Add a new ParameterGroup resource to the stack template with the new Family value and keep the old ParameterGroup resource in the template.Reference the new ParameterGroup resource in AWS::RDS::DBCluster or AWS::RDS::DBInstance, and update the EngineVersion property to the new version.Note: If you're performing a major version upgrade, then you must set the AllowMajorVersionUpgrade property to true.Update the stack with the updated template.After the stack is updated, remove the previous ParameterGroup resource from the stack template.-or-Change the LogicalResourceID of the ParameterGroup resource.Reference the new LogicalResourceID in the AWS::RDS::DBCluster or AWS::RDS::DBInstance.
Question: "I added tags to my AWS resources, but my IAM policy isn't working. Which AWS services support authorization-based tags?"

My resources are tagged with the correct tag key and value, but my AWS Identity and Access Management (IAM) policy isn't evaluating the tags on my resources.

Short descriptionIAM policies can use the global condition key aws:ResourceTag to control access based on the resource's tag key and value. Not all AWS services support tag authorization. Some AWS resources, such as AWS Lambda functions and Amazon Simple Queue Service (Amazon SQS) queues, can be tagged. However, these tags can't be used in an IAM policy to control access to the resources. For a list of AWS services that support tag-based authorization, see AWS services that work with IAM.

ResolutionIf an AWS service doesn't support tag-based authorization, then check the actions, resources, and condition keys for the service to see the resource-level permissions and condition keys that are supported in IAM policies. Some AWS services, such as Overview of managing access in Amazon SQS and Identity-based IAM policies for AWS Lambda, have documentation that contains example IAM policies.Some Lambda actions, such as DeleteFunction and PublishVersion, can be restricted to a specific Lambda function by using resource-level permissions. Attaching this example IAM policy to an IAM user allows these Lambda actions, but only on a single Lambda function.Note: Edit the IAM policy to include your own Lambda function ARN.{  "Version": "2012-10-17",  "Statement": [    {      "Sid": "AllowActionsOnSpecificFunction",      "Effect": "Allow",      "Action": [        "lambda:DeleteFunction",        "lambda:PublishVersion"      ],      "Resource": "arn:aws:lambda:us-west-2:123456789012:function:my-function"    }  ]}Related informationHow can I restrict access to a specific IAM role session using an IAM identity-based policy?How do I create an IAM policy for tag-based restriction with the PrincipalTag, ResourceTag, RequestTag and TagKeys condition keys?
Question: How do I launch an Amazon RDS database instance that's covered by the AWS Free Tier?

I want to launch an Amazon Relational Database Service (Amazon RDS) DB instance that's covered entirely by the AWS Free Tier.

Short descriptionThe Amazon RDS Free Tier allows you to experiment with Amazon RDS for free.Important: To avoid unnecessary charges, read the Amazon RDS Free Tier offering before launching any Amazon RDS resources.

ResolutionOpen the Amazon RDS console.In the navigation bar, select your Region from the Region selector.In the Create database section, choose Create database.For the Choose a database creation method section, choose Standard create.In the Engine options section, select one of the following engine types: MySQL or MariaDB or PostgreSQL.Important: The Free Tier doesn't cover RDS DB instances launched with Amazon Aurora, Amazon RDS for Microsoft SQL Server, or Oracle database engines.For Templates, select Free tier.In the Settings section, enter the DB instance identifier, Master username, and Master password.For DB instance class, Storage, Connectivity, and Database authentication, select the options that are best for your use case, or leave the default configurations.Note: Database authentication options are available only if you select MySQL.Important: In the Storage section, clear Enable storage autoscaling to avoid incurring charges.In the Additional configuration section, for Initial database name, enter a name for your database. For all other configuration details, choose the options that are best for your use case, or leave the default settings.Important: For Backup, clear Enable automatic backups to avoid incurring storage fees for retaining backups of your Amazon RDS instance.Review the Estimated monthly costs, and then choose Create database.

Related informationAmazon RDS FAQsAmazon RDSAWS Free Usage Tier FAQs
Question: How do I troubleshoot high CPU utilization on an Amazon ECS task on Fargate?

I want to find out why the CPU utilization is high on my Amazon Elastic Container Service (Amazon ECS) tasks on AWS Fargate.

ResolutionTroubleshoot high CPU utilization for Fargate tasks that are part of a serviceUse Amazon CloudWatch metrics to view service-level CPU utilization.Check if there is an ongoing deployment in the Amazon ECS service. During a deployment, there are more tasks running and the aggregate CPU utilization of the Amazon ECS service increases. After a deployment is complete, aggregate CPU utilization should decrease.If there isn't an ongoing deployment, then check the following:Check your application logs to see if your tasks are performing CPU-intensive operations. The logs are exported to various destinations, depending on your logging driver. If you're using the awslogs driver, then the logs are exported to CloudWatch. The CPU-intensive operation varies according to the application being deployed in the Fargate task.Check for an increase in incoming traffic to your Amazon ECS service by viewing the CloudWatch metrics of your load balancer. If there is increased traffic to your tasks, consider using Auto Scaling to increase the desired number of tasks running in the service. This allows incoming traffic to be distributed to a higher number of tasks, which can reduce the overall CPU utilization of your tasks.Troubleshoot high CPU utilization for standalone Fargate tasksTo view task-level metrics through performance logs, you must enable CloudWatch Container Insights. For more information, see Introducing Amazon CloudWatch Container Insights for Amazon ECS.If your application's containers must perform CPU-intensive workloads, then consider upgrading to a larger task size that includes more vCPU and memory. For more information, see AWS Fargate Pricing.