AWS b2bi medium security documentation change
Summary
Added section about S3 bucket access issues during transformation with specific guidance on KMS encryption and root user restrictions
Security assessment
Explicitly warns against using root user for StartTransformerJob and provides guidance for KMS key policies, which are security controls related to access management and encryption
Diff
diff --git a/b2bi/latest/userguide/troubleshooting.md b/b2bi/latest/userguide/troubleshooting.md index a8bb15fe7..ad2448140 100644 --- a//b2bi/latest/userguide/troubleshooting.md +++ b//b2bi/latest/userguide/troubleshooting.md @@ -5 +5 @@ -EDI transformation issuesPartnership quota exceededAPI throttling issuesFile size limitationsCommon error codes and solutionsUsing monitoring tools for troubleshootingGetting additional supportTroubleshooting Amazon S3 Bucket IssuesAPI troubleshooting +Output file not createdTransformation S3 access issuesOutput file access issuesConsole sample file issuesGetting additional support @@ -11 +11 @@ This section provides solutions to common issues you might encounter when workin -## EDI transformation issues +## Output file is not created after the input file is placed into an Amazon S3 bucket @@ -13 +13 @@ This section provides solutions to common issues you might encounter when workin -This section covers common issues related to EDI transformations. +If your output file is not being created after placing an input file into an Amazon S3 bucket, follow these troubleshooting steps: @@ -15 +15 @@ This section covers common issues related to EDI transformations. -### Invalid EDI format errors + 1. If you have logs enabled, first check AWS B2B Data Interchange service logs in CloudWatch. Specifically, check the default log group `/aws/vendedlogs/b2bi/default` for general errors and profile log group `/aws/vendedlogs/b2bi/profile/`profile-id`` for profile and partnership specific errors. If logs contain errors, address them. @@ -17,35 +17 @@ This section covers common issues related to EDI transformations. -If you receive errors about invalid EDI format, check the following: - - * Ensure your EDI file follows the correct format for the transaction set you're using. - - * Verify that all required segments and elements are present in your EDI file. - - * Check for proper delimiters in your EDI file. - - * Ensure the file doesn't exceed the maximum size limit of 150 MB. - - - - -### Transformation timeout errors - -If your transformation is timing out, consider the following: - - * Break down large EDI files into smaller batches. - - * Simplify complex transformation logic if possible. - - * Check for infinite loops or inefficient processing in custom transformers. - - - - -## Partnership quota exceeded - -If you receive errors about exceeding partnership quotas, consider the following: - - * Review your current partnership count against the default limit of 700 partnerships per account. - - * Consider consolidating partnerships where appropriate. - - * Request a quota increase if necessary. See [Quotas for AWS B2B Data Interchange](./b2bi-quotas.html) for more information. + 2. Check that the input file is not being misplaced and you are placing it into the correct directory of the Amazon S3 bucket assigned as an input bucket of your trading capability. For inbound use-case the files must be placed in a directory with the `.../`trading-partner-id`/` prefix, and for the outbound use-case they must be placed in a directory with the `.../`trading-capability-id`/`trading-partner-id`/` prefix. @@ -52,0 +19 @@ If you receive errors about exceeding partnership quotas, consider the following + 3. Check that the input bucket is configured to emit EventBridge events. @@ -53,0 +21 @@ If you receive errors about exceeding partnership quotas, consider the following + 1. Go to the Amazon S3 console and select your bucket. @@ -54,0 +23 @@ If you receive errors about exceeding partnership quotas, consider the following + 2. Choose **Properties**. @@ -56 +25 @@ If you receive errors about exceeding partnership quotas, consider the following -## API throttling issues + 3. Scroll down to the **Event Notifications** section and ensure that **Send notifications to Amazon EventBridge for all events in this bucket** configuration is set to **On**. @@ -58 +26,0 @@ If you receive errors about exceeding partnership quotas, consider the following -If you're experiencing API throttling, consider the following approaches: @@ -60 +27,0 @@ If you're experiencing API throttling, consider the following approaches: - * Implement exponential backoff and retry logic in your applications. For example, create a function that automatically retries failed operations with increasing wait times between attempts. @@ -62 +28,0 @@ If you're experiencing API throttling, consider the following approaches: - * Batch your API requests where possible to reduce the number of individual calls. @@ -64 +30 @@ If you're experiencing API throttling, consider the following approaches: - * Distribute your workload more evenly over time rather than sending bursts of requests. +## Transformation fails because of S3 bucket access issues @@ -66 +32 @@ If you're experiencing API throttling, consider the following approaches: - * Consider requesting a quota increase if you consistently hit the inbound transformation request limit of 3 per second. +If your transformation is failing due to S3 bucket access issues, follow these troubleshooting steps: @@ -67,0 +34 @@ If you're experiencing API throttling, consider the following approaches: + 1. Ensure that the S3 bucket policy is configured to allow AWS B2B Data Interchange service to access the S3 bucket. For that follow the documentation steps in [Amazon S3 bucket policies and permissions](./b2bi-prereq.html#buckets-and-permissions). @@ -68,0 +36 @@ If you're experiencing API throttling, consider the following approaches: + 2. If you have SSE-KMS or DSSE-KMS encryption enabled on your input or output bucket, ensure that the key policy in AWS KMS is updated. For that follow the documentation steps in [Amazon S3 bucket policies and permissions](./b2bi-prereq.html#buckets-and-permissions). @@ -69,0 +38 @@ If you're experiencing API throttling, consider the following approaches: + 3. In case S3 bucket issue arises when directly invoking `StartTransformerJob` ensure that the invoking principal (e.g., user, service role) has permissions to access the bucket. Moreover ensure that the user that is invoking `StartTransformerJob` is not the `root` user. @@ -71 +40 @@ If you're experiencing API throttling, consider the following approaches: -## File size limitations + 4. Make sure you are using AWS B2B Data Interchange service in the same region the S3 bucket is created in. @@ -73 +41,0 @@ If you're experiencing API throttling, consider the following approaches: -If you're encountering issues related to file size limitations, consider these solutions: @@ -75 +42,0 @@ If you're encountering issues related to file size limitations, consider these s - * For EDI files exceeding the 150 MB limit, split the file into smaller batches before processing. @@ -77 +43,0 @@ If you're encountering issues related to file size limitations, consider these s - * For output JSON files approaching the 512 MB limit, consider modifying your transformation to produce more compact output. @@ -78,0 +45 @@ If you're encountering issues related to file size limitations, consider these s +## The output file is successfully created but it cannot be accessed @@ -79,0 +47 @@ If you're encountering issues related to file size limitations, consider these s +If your output file is created successfully but cannot be accessed, follow these troubleshooting steps: @@ -80,0 +49 @@ If you're encountering issues related to file size limitations, consider these s + * Ensure that the output S3 bucket does not have ACL enabled. @@ -82 +51 @@ If you're encountering issues related to file size limitations, consider these s -## Common error codes and solutions + 1. Go to the Amazon S3 console and select your bucket. @@ -84 +53 @@ If you're encountering issues related to file size limitations, consider these s -This table provides solutions for common error codes you might encounter when using AWS B2B Data Interchange: + 2. Choose **Permissions**. @@ -86,11 +55 @@ This table provides solutions for common error codes you might encounter when us -Error Code/Message | Solution ----|--- -ValidationException | The input fails to satisfy the constraints specified by the service. Check your request parameters for invalid values, incorrect formats, or missing required fields. Common issues include invalid S3 bucket names, incorrect file formats, or unsupported EDI transaction sets. -ValidationException: Profile limit exceeded | You've reached the limit of 5 profiles per account. Delete unused profiles or request a quota increase. -AccessDeniedException | Check your IAM permissions to ensure you have the necessary access to perform the action. Review the required permissions in the [Identity and access management for AWS B2B Data Interchange](./security-iam.html) section. Ensure your IAM role has permissions to access the S3 buckets specified in your requests. -ResourceNotFoundException | Verify that the resource ID is correct and that the resource exists in your current AWS Region. This can occur when referencing a transformer, profile, or partnership that doesn't exist or has been deleted. -ThrottlingException | Your request was denied due to request throttling. Implement backoff and retry logic with the recommended retry-after value if provided. See API throttling issues for more information. -ConflictException | The request could not be processed due to a conflict with the current state of the resource. This can occur when trying to update or delete a resource that is currently in use by another operation or when creating a resource that already exists. -InternalServerException | An unexpected error occurred during processing of your request. This is a server-side error. Wait for the recommended retry-after period if provided, then retry your request. If the issue persists, contact AWS Support. -ServiceQuotaExceededException | Your request would cause a service quota to be exceeded. The error message includes details about the affected resource and quota. Review your current usage against the service quotas and request an increase if necessary. -InvalidEDIFormatException | Check your EDI file format against the specifications for your transaction set. See Invalid EDI format errors for details. + 3. Scroll down to the **Object Ownership** section and ensure that it says that ACLs are disabled. @@ -98 +56,0 @@ InvalidEDIFormatException | Check your EDI file format against the specification -## Using monitoring tools for troubleshooting @@ -100 +57,0 @@ InvalidEDIFormatException | Check your EDI file format against the specification -Leverage AWS B2B Data Interchange monitoring capabilities to help identify and resolve issues: @@ -102 +58,0 @@ Leverage AWS B2B Data Interchange monitoring capabilities to help identify and r - * Use CloudWatch Logs to review detailed logs of your AWS B2B Data Interchange operations. Look for error patterns or recurring issues. @@ -104 +60 @@ Leverage AWS B2B Data Interchange monitoring capabilities to help identify and r - * Set up CloudWatch Alarms to be notified of potential issues before they impact your business operations. +## Attaching sample files fails when creating a transformer in the console under root user @@ -106 +62 @@ Leverage AWS B2B Data Interchange monitoring capabilities to help identify and r - * Use EventBridge to view whether or not transformation or acknowledgement events succeeded. See [Managing AWS B2B Data Interchange events using Amazon EventBridge](./eventbridge.html) for more information. +If attaching sample files fails when creating a transformer in the console, follow these troubleshooting steps: @@ -108 +64 @@ Leverage AWS B2B Data Interchange monitoring capabilities to help identify and r - * Review CloudTrail logs to audit API calls and identify potential security or configuration issues. + 1. Avoid using a root user to configure AWS B2B Data Interchange and specifically attach sample files in console. @@ -109,0 +66 @@ Leverage AWS B2B Data Interchange monitoring capabilities to help identify and r + 2. Instead create a regular IAM user with necessary AWS B2B Data Interchange and Amazon S3 permissions. For that follow the documentation steps in [Prerequisites for using AWS B2B Data Interchange](./b2bi-prereq.html). @@ -113 +69,0 @@ Leverage AWS B2B Data Interchange monitoring capabilities to help identify and r -For more information on monitoring, see [Monitoring AWS B2B Data Interchange](./monitoring-overview.html). @@ -119,2 +74,0 @@ If you're unable to resolve an issue using the troubleshooting information in th - * [AWS re:Post](https://repost.aws/) – Search for answers or ask questions about AWS B2B Data Interchange. - @@ -141,185 +94,0 @@ When contacting support, be prepared to provide: -## Troubleshooting Amazon S3 Bucket Issues - -If you're experiencing issues with your S3 bucket, such as files not being processed after upload, follow these troubleshooting steps: - -### Event Notification Configuration - -**Problem:** Bucket's event notifications are not enabled. - -**Solution:** Verify that event notifications are properly configured for your bucket. - - 1. Go to the Amazon S3 console and select your bucket. - - 2. Choose **Properties**. - - 3. Scroll down to the **Event Notifications** section and ensure notifications are set up correctly. - - - - -### Bucket Policy - -**Problem:** The bucket's resource-based policy is not correct. - -**Solution:** Review and update your bucket policy. - - 1. In the Amazon S3 console, select your bucket and choose **Permissions**. - - 2. Check the **Bucket Policy** section and ensure it grants necessary permissions. - - - - -### Encryption and KMS Key Policy - -**Problem:** The bucket is AWS Key Management Service key encrypted, and the KMS key's resource-based policy is not correct. - -**Solution:** Verify AWS KMS key policy. - - 1. Go to the AWS Key Management Service console. - - 2. Select the key used for bucket encryption. - - 3. Review the key policy and ensure it allows necessary actions for intended users/roles. - - - - -### ACL and Object Ownership - -**Problem:** Buckets with ACLs enabled and object owner is the object creator. - -**Solution:** Check ACL settings and object ownership. - - 1. In the Amazon S3 console, go to your bucket's **Permissions** tab. - - 2. Review **Object Ownership** settings and adjust if necessary. - - 3. Consider disabling ACLs if not required for your use case. - - - - -### Region Mismatch