Troubleshooting
If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.
For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:
- SailPoint Identity Services Documentation
- SailPoint Support Knowledge Base
- SailPoint Developer Community
Debug Logs
For information about managing additional source settings, including debug logging and downloading connector logs, refer to Managing Additional Settings.
Test Connection Errors
[ ConnectorException ] [ Error details ] aws_default_errorAWS Client creation failed : ull} (requestld: a5213b0b292a457ca37ad344b3721b2f) (requestld: a5213b0b292a457ca37ad344b3721b2f
Resolution 1: Ensure the role is created in the management account ID, as it is mandatory. The test connection is performed on the created role in the management account, therefore, it will fail if the role is created only in a child AWS account.
Resolution 2: In the configuration page, ensure only the Role Name is entered, and not the Role ARN.
[InsufficientPermissionException] [Possible suggestions] Service account must be present in the management account with the required permissions. [Error details] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: 65fc15e5-7e90-11e8-9d6a-6fc388fd2d28)
If Service user is in Member AWS account, Test Connection fails.
Resolution: Ensure that the service user is created in the management account with required permission to manage organization entities. If you do not want to manage the Organization entities, remove them from schema.
When configuring a new Amazon Web Services source, the Test Connection fails with the following error message:
sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Your account is not a member of an organization. (Service: AWSOrganizations; Status Code: 400; Error Code: AWSOrganizationsNotInUseException; Request ID: c8d77e54-ec98-11e8-b722-bb0efb7fc919)
If Service user is in Member AWS account, Test Connection fails.
Resolution: Ensure that the AWS Account is a member of the AWS Organization which must be managed.
When configuring a new Amazon Web Services source, the Test Connection fails with the following error message:
Resolution: Create Cross Account Roles in each AWS account that you want to manage and attach the appropriate policies to the role. For more information, refer to Source Configuration Guide.
For the upgraded sources, if multiple group objects are configured, work item(s) got created while revoking associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through certification.
Resolution: Remove NO_PERMISSIONS_PROVISIONING from the feature string in Source XML.
Role Not Created Error
[ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the required role is created in the specified AWS accounts and the user has required permissions. [ Error details ] Test connection failed for accounts [list of AWS account IDs] Failure Reason=Access denied (Service: AWSSecurityTokenService)
If Manage All Accounts is selected, and the provided role is not present in any of the AWS accounts, then the test connection fails .
Exception during aggregation. Reason:openconnector.InvalidRequestException: Aggregation is failed for following AWS Account Ids: [comma separated list of accounts]
Aggregation fails
Resolution: Ensure the role is created in all the AWS Accounts with the same name and having sufficient permissions.
Create Account Error
sailpoint.connector.ConnectorException: Access denied (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: f56b8ec5-1e7e-11e9-bab1-d124100fa000)
Error while creating an account.
Resolution: Ensure that the Account ID or ARN of the AWS Account is correctly mentioned in the Account ID of the account attribute. For example:
Identity Attribute Error
Resolution: The Account ID must be mapped with the ARN in the attribute schema.
Throttling Error
Aggregation fails with the following error:
openconnector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Rate exceeded (Service: AmazonIdentityManagement; Status Code: 400; Error Code: Throttling; Request ID: <id>)]
Resolution: Configure the throttling and set a higher value as per the requirement and allowed API limit.
Aggregation Error
Exception during aggregation of Object Type InlinePolicy on Application AWSDemo1 [source]. Reason: java.lang.RuntimeException: An error occurred while aggregating Application 'ApplicationName' [source]
While performing Entitlement Aggregation when multiple group objects are supported.
Resolution: Set the aggregate_timeout attribute with a value in milliseconds (300, 1000) using the REST API.
<url> : The URL for the customer's SailPoint tenant
<sourceID: The Source ID (number) obtained through the UI
In the body of the POST, use form-data as follows:
Key: connector_aggregateTimeout
Value: Enter the time-out value in milliseconds (300, 1000)
Confirmation: Search for the "aggregateTimeout" attribute using the endpoint
Note
For more information on SailPoint's REST APIs, refer to Best Practices: REST API Authentication and REST API - Update Source (Partial) in the SailPoint Developer Community.
Miscellaneous Errors
Tags are not aggregated for Role after upgrade.
Resolution: Ensure updateRole provisioning policy is configured for the application with the Tags attribute ReadOnly='True'
<Field displayName="con_prov_policy_AWS_Role_Tags" helpKey="help_con_form_AWS_Role_Tags" name="Tags" reviewRequired="true" type="string">
<Attributes>
<Map>
<entry key="readOnly" value="true"/>
</Map>
</Attributes>
</Field>
A timeout error occurs when attempting to connect
Resolution: Utilize the API calls to increase the timeout value to 60 seconds:
PATCH https://{tenant}.api.identitynow.com/v3/sources/{id}
Content-Type: application/json-patch+json
Body:
InsufficientPermissionException
Error: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: a90d35bd-9832-4211-9e7a-1f966063b642; Proxy: null)
Resolution: The service account must be present in the management account with the required permissions.
Permissions should be:
{
"Statement": [
{
"Action": [
"iam:ListUsers",
"iam:ListUserTags",
"iam:ListUserPolicies",
"iam:ListSigningCertificates",
"iam:ListServiceSpecificCredentials",
"iam:ListSSHPublicKeys",
"iam:ListRoles",
"iam:ListRoleTags",
"iam:ListRolePolicies",
"iam:ListPolicyTags",
"iam:ListPolicies",
"iam:ListMFADevices",
"iam:ListGroupsForUser",
"iam:ListGroups",
"iam:ListGroupPolicies",
"iam:ListEntitiesForPolicy",
"iam:ListAttachedUserPolicies",
"iam:ListAttachedRolePolicies",
"iam:ListAttachedGroupPolicies",
"iam:ListAccountAliases",
"iam:ListAccessKeys",
"iam:GetUserPolicy",
"iam:GetUser",
"iam:GetRolePolicy",
"iam:GetRole",
"iam:GetPolicyVersion",
"iam:GetPolicy",
"iam:GetLoginProfile",
"iam:GetGroupPolicy",
"iam:GetGroup",
"iam:GetAccessKeyLastUsed"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "SPAggregationPolicy"
},
{
"Action": [
"organizations:ListTargetsForPolicy",
"organizations:ListTagsForResource",
"organizations:ListRoots",
"organizations:ListPoliciesForTarget",
"organizations:ListPolicies",
"organizations:ListParents",
"organizations:ListOrganizationalUnitsForParent",
"organizations:ListAccountsForParent",
"organizations:ListAccounts",
"organizations:DescribePolicy",
"organizations:DescribeOrganizationalUnit",
"organizations:DescribeOrganization",
"organizations:DescribeAccount"
],
"Effect": "Allow",
"Resource": "*",
"Sid": "SPOrganizationPolicy"
}
],
"Version": "2012-10-17"
}
Partial Deployment
If the onboarding workflow shows Partial, one or more member accounts failed StackSet deployment.
Resolution: Follow the below steps:
- In the AWS Console, go to CloudFormation > StackSets and select the SailPoint StackSet.
- Open Operations and review the failed operation and error details.
- Open Stack instances and filter by FAILED to identify affected member accounts and regions.
- Resolve the reported issue and retry the failed deployment. For more information, refer to SAF AWS Onboarding: Partial StackSet Deployment.
Note
A Partial status indicates that the deployment succeeded for some accounts but requires your attention for others.
Scan Count 0 for IAM Role Dataset Aggregation
https response error StatusCode: 403, RequestID: api error AccessDenied: User: arn:aws:sts::<AWS Account ID>:assumed-role/<Role Name>/ is not authorized to perform: iam:GetAccountAuthorizationDetails on resource: * because no identity-based policy allows the iam:GetAccountAuthorizationDetails action
Resolution: Add the iam:GetAccountAuthorizationDetails permission to the existing policy attached to the role.
Documentation Feedback
Feedback is provided as an informational resource only and does not form part of SailPoint’s official product documentation. SailPoint does not warrant or make any guarantees about the feedback (including without limitation as to its accuracy, relevance, or reliability). All feedback is subject to the terms set forth at https://developer.sailpoint.com/discuss/tos.