# Troubleshooting

If you encounter any of the following issues or errors, SailPoint recommends that you follow the guidance provided below to resolve the error before contacting SailPoint Support.

For issues or errors that are not addressed in this connector guide, refer to the following resources for troubleshooting information:

- [SailPoint Identity Services Documentation](<https://documentation.sailpoint.com/saas/help/index.html>)
- [SailPoint Support Knowledge Base](<https://support.sailpoint.com/csm?id=kb_view2&amp;kb_id=05ff44289f011200550bf7b6077fcfa3>)
- [SailPoint Developer Community](<https://developer.sailpoint.com/>)

## Test Connection Errors

```text
aws_default_errorAWS Client creation failed : Cannot invoke "software.amazon.awssdk.services.iam.IamClient.getUser()" because "iamClient" is null").
```

**Resolution**: Disable the `CONUMSHIAN_9288_USE_AWS_SDK_V2` feature flag for the respected org.

```text
Failed to connect to service endpoint.
```

**Resolution**: The VA on the EC2 instance must have secure tunneling turned off.

```text
[ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the AWS Management Account ID is correctly configured. [ Error details ] Management Account ID must be configured when "Manage All Accounts" is checked or AWS organization entities needs to be managed.
```

For IAMRole Authentication, if **Manage All Accounts** is selected or if the included AWS Account IDs are mentioned, then the test connection fails.

**Resolution**: Provide 'Management Account ID' on the configuration settings page (Management Account ID is root AWS Account ID).

```text
[ InsufficientPermissionException ] [ Possible suggestions ] Service account must be present in management account with the required permissions. [ Error details ] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: <actual alpha-numerical request ID>)
```

If **Manage All Accounts** is selected, and the service account is in any of the member AWS accounts, test connection fails.

**Resolution**: Ensure the service account is created in the management AWS account with required permissions.

```text
[InsufficientPermissionException] [Possible suggestions] Service account must be present in the management account with the required permissions. [Error details] Test Connection Failed: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: 65fc15e5-7e90-11e8-9d6a-6fc388fd2d28)
```

If Service user is in Member AWS account, Test Connection fails.

**Resolution**: Ensure that the service user is created in the management account with required permission to manage organization entities. If you do not want to manage the Organization entities, remove them from schema.

When configuring a new Amazon Web Services source, the Test Connection fails with the following error message:

```text
sailpoint.connector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Your account is not a member of an organization. (Service: AWSOrganizations; Status Code: 400; Error Code: AWSOrganizationsNotInUseException; Request ID: c8d77e54-ec98-11e8-b722-bb0efb7fc919)
```

If Service user is in Member AWS account, Test Connection fails.

**Resolution**: Ensure that the AWS Account is a member of the AWS Organization which must be managed.

For the upgraded sources, if multiple group objects are configured, work item(s) got created while revoking associated AWS Managed Policies, Customer Managed Policies, and Inline Policies from the user through **certification**.

**Resolution:** Remove `NO_PERMISSIONS_PROVISIONING` from the feature string in Source XML.

## Role Not Created Error

```text
[ InvalidConfigurationException ] [ Possible suggestions ] Ensure that the required role is created in the specified AWS accounts and the user has required permissions. [ Error details ] Test connection failed for accounts [list of AWS account IDs] Failure Reason=Access denied (Service: AWSSecurityTokenService)
```

If **Manage All Accounts** is selected, and the provided role is not present in any of the AWS accounts, then the test connection fails .

```text
Exception during aggregation. Reason:openconnector.InvalidRequestException: Aggregation is failed for following AWS Account Ids: [comma separated list of accounts]
```

Aggregation fails

**Resolution:** Ensure the role is created in all the AWS Accounts with the same name and having sufficient permissions.

## AWS Account IDs Error

```text
[ InvalidConfigurationException ] [ Error details ] "Include AWS Account IDs" must be empty if "Manage All Accounts" is checked.
```

**Include AWS Account IDs** is populated and the **Manage All Accounts** checkbox is selected.

**Resolution:** The **Include AWS Account IDs** list must be empty if the **Manage All Accounts** checkbox is selected .

## Exclude AWS Accounts Error

```text
[ InvalidConfigurationException ] [ Error details ] Either "Manage All Accounts" is checked (with or without "Exclude AWS Account IDs") or "Include AWS Account IDs" must be populated.
```

**Exclude AWS Account Ids** is populated and **Manage All Accounts** checkbox is not selected.

**Resolution:** Select the **Manage All Accounts** checkbox if **Exclude AWS Account IDs** is populated.

## Manage All Accounts Error

```text
[ InvalidConfigurationException ] [ Error details ] Either "Manage All Accounts" is checked (with or without "Exclude AWS Account IDs") or "Include AWS Account IDs" must be populated.
```

**Manage All Accounts** is not selected and both the **Include AWS Account IDs** list and **Exclude AWS Account IDs** list are empty.

**Resolution:** Either **Manage All Accounts** (with or without **Exclude AWS Account IDs**) or **Include AWS Account IDs** must be populated.

## Create Account or Add Entitlement Error

```text
sailpoint.connector.ConnectorException: Invalid provisioning request. Attribute AWS Account does not match the entitlement requested : arn:aws:iam::<AWS Account ID>:group/<IAM Group Name>
```

If the IAM groups present in access profile do not belong to the AWS Account in which the IAM User needs to be created, then create account or add entitlement fails.

**Resolution**: Ensure that the access profile contains the IAM Groups as entitlements of the same AWS Account in which the IAM User needs to be created.

## Aggregation time-out error

```text
java.lang.RuntimeException: java.lang.InterruptedException: Timeout waiting for response
```

```text
Exception during aggregation. Reason: java.lang.RuntimeException: An error occurred while aggregating Application <Source Name> [source-<Source ID>]
```

You may see this error while performing account aggregation or entitlement aggregation.

**Resolution:** Set the `aggregateTimeout` attribute using the REST API. Enter the time-out value in milliseconds.

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Create Account Error

```text
sailpoint.connector.ConnectorException: Access denied (Service: AWSSecurityTokenService; Status Code: 403; Error Code: AccessDenied; Request ID: f56b8ec5-1e7e-11e9-bab1-d124100fa000)
```

Error while creating an account.

**Resolution**: Ensure that the Account ID or ARN of the AWS Account is correctly mentioned in the Account ID of the account attribute. For example:

```text
arn:aws:organizations::441113549707:account/o-lqs5akk5dy/170915734915
```

## Identity Attribute Error

```text
sailpoint.connector.ConnectorException: Un-supported identity attribute for account
```

**Resolution**: The Account ID must be mapped with the ARN in the attribute schema.

## Throttling Error

Aggregation fails with the following error:

```text
openconnector.ConnectionFailedException: [ ConnectionFailedException ] [ Error details ] Rate exceeded (Service: AmazonIdentityManagement; Status Code: 400; Error Code: Throttling; Request ID: <id>)]
```

**Resolution**: Configure the throttling and set a higher value as per the requirement and allowed API limit.

## Aggregation Error

```text
Exception during aggregation of Object Type InlinePolicy on Application AWSDemo1 [source]. Reason: java.lang.RuntimeException: An error occurred while aggregating Application 'ApplicationName' [source]
```

While performing Entitlement Aggregation when multiple group objects are supported.

**Resolution:** Set the `aggregate_timeout` attribute with a value in milliseconds (300, 1000) using the REST API.

```text
POST <url>/cc/api/source/update/<sourceID>
```

`<url>` : The URL for the customer's SailPoint tenant

`<sourceID`: The Source ID (number) obtained through the UI

In the body of the POST, use form-data as follows:

**Key**: `connector_aggregateTimeout`

**Value**: Enter the time-out value in milliseconds (300, 1000)

**Confirmation**: Search for the "aggregateTimeout" attribute using the endpoint

> [!NOTE]
>
> For more information on SailPoint's REST APIs, refer to [Best Practices: REST API Authentication](<https://developer.sailpoint.com/docs/api/authentication/>) and [REST API - Update Source (Partial)](<https://developer.sailpoint.com/docs/api/update-source-v-1/>) in the SailPoint Developer Community.

## Miscellaneous Errors

Tags are not aggregated for Role after upgrade.

**Resolution**: Ensure `updateRole` provisioning policy is configured for the application with the Tags attribute ReadOnly='True'

```text
<Field displayName="con_prov_policy_AWS_Role_Tags" helpKey="help_con_form_AWS_Role_Tags" name="Tags" reviewRequired="true" type="string">
        <Attributes>
            <Map>
              <entry key="readOnly" value="true"/>
            </Map>
          </Attributes>
        </Field>
```

## A timeout error occurs when attempting to connect

**Resolution**: Utilize the API calls to increase the timeout value to 60 seconds:

PATCH https://{tenant}.api.identitynow.com/v3/sources/{id}

Content-Type: application/json-patch+json

Body:

```json
[
{
"op": "add",
"path": "/connectorAttributes/healthCheckTimeout",
"value": 60
}
]
```

## InsufficientPermissionException

**Error**: You don't have permissions to access this resource. (Service: AWSOrganizations; Status Code: 400; Error Code: AccessDeniedException; Request ID: a90d35bd-9832-4211-9e7a-1f966063b642; Proxy: null)

**Resolution**: The service account must be present in the management account with the required permissions.

Permissions should be:

```json
{

    "Statement": [
        {
            "Action": [
                "iam:ListUsers",
                "iam:ListUserTags",
                "iam:ListUserPolicies",
                "iam:ListSigningCertificates",
                "iam:ListServiceSpecificCredentials",
                "iam:ListSSHPublicKeys",
                "iam:ListRoles",
                "iam:ListRoleTags",
                "iam:ListRolePolicies",
                "iam:ListPolicyTags",
                "iam:ListPolicies",
                "iam:ListMFADevices",
                "iam:ListGroupsForUser",
                "iam:ListGroups",
                "iam:ListGroupPolicies",
                "iam:ListEntitiesForPolicy",
                "iam:ListAttachedUserPolicies",
                "iam:ListAttachedRolePolicies",
                "iam:ListAttachedGroupPolicies",
                "iam:ListAccountAliases",
                "iam:ListAccessKeys",
                "iam:GetUserPolicy",
                "iam:GetUser",
                "iam:GetRolePolicy",
                "iam:GetRole",
                "iam:GetPolicyVersion",
                "iam:GetPolicy",
                "iam:GetLoginProfile",
                "iam:GetGroupPolicy",
                "iam:GetGroup",
                "iam:GetAccessKeyLastUsed"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "SPAggregationPolicy"
        },
        {
            "Action": [
                "organizations:ListTargetsForPolicy",
                "organizations:ListTagsForResource",
                "organizations:ListRoots",
                "organizations:ListPoliciesForTarget",
                "organizations:ListPolicies",
                "organizations:ListParents",
                "organizations:ListOrganizationalUnitsForParent",
                "organizations:ListAccountsForParent",
                "organizations:ListAccounts",
                "organizations:DescribePolicy",
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeOrganization",
                "organizations:DescribeAccount"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "SPOrganizationPolicy"
        }
    ],
    "Version": "2012-10-17"
}
```