# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Debug Logs

For information about managing additional source settings, including debug logging and downloading connector logs, refer to [Managing Additional Settings](<https://documentation.sailpoint.com/saas/help/sources/managing_additional_settings.html>).

## Test Connection Errors

```text
[ ConnectorException ] [ Error details ] aws_default_errorAWS Client creation failed : ull} (requestld: a5213b0b292a457ca37ad344b3721b2f) (requestld: a5213b0b292a457ca37ad344b3721b2f
```

**Resolution 1:** Ensure the role is created in the management account ID, as it is mandatory. The test connection is performed on the created role in the management account, therefore, it will fail if the role is created only in a child AWS account.

**Resolution 2:** In the configuration page, ensure only the **Role Name** is entered, and not the **Role ARN**.

```text
[InsufficientPermissionException] [Possible suggestions] Service account must be present in the management account with the required permissions. [Error details] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: 65fc15e5-7e90-11e8-9d6a-6fc388fd2d28)
```

If Service user is in Member AWS account, Test Connection fails.

**Resolution**: Ensure that the service user is created in the management account with required permission to manage organization entities. If you do not want to manage the Organization entities, remove them from schema.

When configuring a new Amazon Web Services source, the Test Connection fails with the following error message:

```text
sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Your account is not a member of an organization. (Service: AWSOrganizations; Status Code: 400; Error Code: AWSOrganizationsNotInUseException; Request ID: c8d77e54-ec98-11e8-b722-bb0efb7fc919)
```

If Service user is in Member AWS account, Test Connection fails.

**Resolution**: Ensure that the AWS Account is a member of the AWS Organization which must be managed.

When configuring a new Amazon Web Services source, the Test Connection fails with the following error message:

```text
[ Error details ] aws_default_errorError occurred while testing AWS Organizations connectivity
```

**Resolution**: Create Cross Account Roles in each AWS account that you want to manage and attach the appropriate policies to the role. For more information, refer to [Source Configuration Guide](<https://documentation.sailpoint.com/connectors/aws/saas/help/source_config_guide.html>).

For the upgraded sources, if multiple group objects are configured, work item(s) got created while revoking associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through **certification**.

**Resolution:** Remove `NO_PERMISSIONS_PROVISIONING` from the feature string in Source XML.

## Role Not Created Error

```text
[ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the required role is created in the specified AWS accounts and the user has required permissions. [ Error details ] Test connection failed for accounts [list of AWS account IDs] Failure Reason=Access denied (Service: AWSSecurityTokenService)
```

If **Manage All Accounts** is selected, and the provided role is not present in any of the AWS accounts, then the test connection fails .

```text
Exception during aggregation. Reason:openconnector.InvalidRequestException: Aggregation is failed for following AWS Account Ids: [comma separated list of accounts]
```

Aggregation fails

**Resolution:** Ensure the role is created in all the AWS Accounts with the same name and having sufficient permissions.

## Create Account Error

```text
sailpoint.connector.ConnectorException: Access denied (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: f56b8ec5-1e7e-11e9-bab1-d124100fa000)
```

Error while creating an account.

**Resolution**: Ensure that the Account ID or ARN of the AWS Account is correctly mentioned in the Account ID of the account attribute. For example:

```text
arn:aws:organizations::441113549707:account/o-lqs5akk5dy/170915734915
```

## Identity Attribute Error

```text
sailpoint.connector.ConnectorException: Un-supported identity attribute for account
```

**Resolution**: The Account ID must be mapped with the ARN in the attribute schema.

## Throttling Error

Aggregation fails with the following error:

```text
openconnector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Rate exceeded (Service: AmazonIdentityManagement; Status Code: 400; Error Code: Throttling; Request ID: <id>)]
```

**Resolution**: Configure the throttling and set a higher value as per the requirement and allowed API limit.

## Aggregation Error

```text
Exception during aggregation of Object Type InlinePolicy on Application AWSDemo1 [source]. Reason: java.lang.RuntimeException: An error occurred while aggregating Application 'ApplicationName' [source]
```

While performing Entitlement Aggregation when multiple group objects are supported.

**Resolution:** Set the `aggregate_timeout` attribute with a value in milliseconds (300, 1000) using the REST API.

```text
POST <url>/cc/api/source/update/<sourceID>
```

`<url>` : The URL for the customer's SailPoint tenant

`<sourceID`: The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

**Key**: `connector_aggregateTimeout`

**Value**: Enter the time-out value in milliseconds (300, 1000)

**Confirmation**: Search for the "aggregateTimeout" attribute using the endpoint

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Miscellaneous Errors

Tags are not aggregated for Role after upgrade.

**Resolution**: Ensure `updateRole` provisioning policy is configured for the application with the Tags attribute ReadOnly='True'

```text
<Field displayName="con_prov_policy_AWS_Role_Tags" helpKey="help_con_form_AWS_Role_Tags" name="Tags" reviewRequired="true" type="string">
        <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
```

## A timeout error occurs when attempting to connect

**Resolution**: Utilize the API calls to increase the timeout value to 60 seconds:

PATCH https://{tenant}.api.identitynow.com/v3/sources/{id}

Content-Type: application/json-patch+json

Body:

```json
[
{
"op": "add",
"path": "/connectorAttributes/healthCheckTimeout",
"value": 60
}
]
```

## InsufficientPermissionException

**Error**: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: a90d35bd-9832-4211-9e7a-1f966063b642; Proxy: null)

**Resolution**: The service account must be present in the management account with the required permissions.

Permissions should be:

```json
{

    "Statement": [
        {
            "Action": [
                "iam:ListUsers",
                "iam:ListUserTags",
                "iam:ListUserPolicies",
                "iam:ListSigningCertificates",
                "iam:ListServiceSpecificCredentials",
                "iam:ListSSHPublicKeys",
                "iam:ListRoles",
                "iam:ListRoleTags",
                "iam:ListRolePolicies",
                "iam:ListPolicyTags",
                "iam:ListPolicies",
                "iam:ListMFADevices",
                "iam:ListGroupsForUser",
                "iam:ListGroups",
                "iam:ListGroupPolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAccountAliases",
                "iam:ListAccessKeys",
                "iam:GetUserPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:GetLoginProfile",
                "iam:GetGroupPolicy",
                "iam:GetGroup",
                "iam:GetAccessKeyLastUsed"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "SPAggregationPolicy"
        },
        {
            "Action": [
                "organizations:ListTargetsForPolicy",
                "organizations:ListTagsForResource",
                "organizations:ListRoots",
                "organizations:ListPoliciesForTarget",
                "organizations:ListPolicies",
                "organizations:ListParents",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListAccountsForParent",
                "organizations:ListAccounts",
                "organizations:DescribePolicy",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeOrganization",
                "organizations:DescribeAccount"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "SPOrganizationPolicy"
        }
    ],
    "Version": "2012-10-17"
}
```

## Partial Deployment

If the onboarding workflow shows **Partial**, one or more member accounts failed StackSet deployment.

**Resolution**: Follow the below steps:

- In the AWS Console, go to **CloudFormation \> StackSets** and select the SailPoint StackSet.
- Open **Operations** and review the failed operation and error details.
- Open **Stack instances** and filter by **FAILED** to identify affected member accounts and regions.
- Resolve the reported issue and retry the failed deployment. For more information, refer to [SAF AWS Onboarding: Partial StackSet Deployment](<https://community.sailpoint.com/knowledge/SAF-AWS-Onboarding-Partial-StackSet-Deployment>).

> [!NOTE]
>
> A Partial status indicates that the deployment succeeded for some accounts but requires your attention for others.

## Scan Count 0 for IAM Role Dataset Aggregation

```text
https response error StatusCode: 403, RequestID: api error AccessDenied: User: arn:aws:sts::<AWS Account ID>:assumed-role/<Role Name>/ is not authorized to perform: iam:GetAccountAuthorizationDetails on resource: * because no identity-based policy allows the iam:GetAccountAuthorizationDetails action
```

**Resolution**: Add the `iam:GetAccountAuthorizationDetails` permission to the existing policy attached to the role.