> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/troubleshoot-aws-errors.md).

# Troubleshoot AWS Onboarding Errors

Use this troubleshooting guide to find tips to identify, detect, and remediate any issues that may arise during or after the onboarding process.

## Troubleshoot EventBridge Errors

In cases where you configured EventBridge successfully and created all the rules required for ingestion, however, the rules were accidentally deleted, or you enabled a region in your account that Prisma Cloud already supported, **Review Status** will display errors across the regions.

To resolve this error you need to update the EventBridge CFT as follows:

1. Click the **View** icon next to the AWS account or organization you want to update.
2. Click **Misconfigurations**.
3. Click **Edit** under **Near Real-Time Visibility**.
4. Click **Download EventBridge CFT** and follow the steps in your AWS console to renable the rules.

   <figure><img src="/files/XMyXGKOAHxE7rsCN7EQ3" alt="aws eventbridge cft1"><figcaption></figcaption></figure>
5. Return to the Prisma Cloud console.
6. **Review Status** to ensure a **Successful** message displays for each region.
7. Click **Save**.
8. Click **Status** located next to **Misconfigurations** and scroll down to the **Security Capabilities and Permissions** section to verify the status of **Audit Logs**.

## Troubleshoot ExternalId Errors for a Standalone AWS Account

If you created the AWS IAM role using static S3 templates, onboarded the account on Prisma Cloud with a custom ExternalId, the following error may display under **Review Status**:

<figure><img src="/files/RQrTHxWYLruXSKcflikb" alt="aws ts error message 2"><figcaption></figcaption></figure>

Make sure to **Save** the account before you follow the steps listed below to resolve the errors.

**Use any one of the following methods to resolve this error:**

1. **Method 1**

   If you are an AWS Cloud Administrator who does not have access to Prisma Cloud APIs, download and run the CFT template again:

   1. Click the **Edit** icon for the onboarded AWS cloud account.
   2. Click **Configure Account**.
   3. **Download IAM Role CFT**.
   4. Follow the **Steps** to create new stack or update existing stack.
   5. Navigate to **Review Status** page to verify the status.
   6. Click **Save**.
2. **Method 2**

   If you are a Prisma Cloud Administrator who does not have AWS Administrator access, update the externalId used in **Create IAM Role** using [Update Cloud Account API](https://pan.dev/prisma-cloud/api/cspm/update-cloud-account/#request-body-to-update-an-aws-account/).

   Example:

   `{ curl --location --request PUT 'https://api3.prismacloud.io/cloud/aws/123456789012 \ --header 'Connection: keep-alive' \ --header 'sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="91", "Chromium";v="91"' \ --header 'x-redlock-auth: <token>' \ --header 'sec-ch-ua-mobile: ?0' \ --header 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json, text/plain, /' \ --data-raw '{ "accountId": "123456789012", "accountType": "account", "enabled": true, "externalId": "4fc24939-8fab-4978-a4e1-403095713870", "groupIds": [], "name": "AWS Account", "protectionMode": "MONITOR", "roleArn": "arn:aws:iam::123456789012:role/PrismaCloudReadOnlyRole" }' }`
3. **Method 3**

   If you are an AWS Cloud Administrator who does not have access to Prisma Cloud APIs, manually update the Prisma Cloud generated ExternalId in the existing IAM role trust relationship in your AWS console:

   1. Click the **Edit** icon for the onboarded AWS cloud account.
   2. Click **Configure Account**.
   3. **Download IAM Role CFT**.
   4. Open the downloaded CFT in a text editor, search for `sts:ExternalId` and **Copy** the value.

      <figure><img src="/files/3BL36Sbo4TUzcM4k19GC" alt="aws ts extid 1"><figcaption></figcaption></figure>
   5. Copy the updated **ExternalId** in **Trust relationships** of existing IAM role in AWS.

      <figure><img src="/files/hLFBwlMqz5wIaQaW2VJv" alt="aws ts extid 2"><figcaption></figcaption></figure>
   6. Wait for 10-15 seconds for the changes to take effect.
   7. **Review Status** to verify the cloud account status is green or amber.
   8. Click **Save**.

## Troubleshoot ExternalId Errors for an AWS Organization

* If you created the AWS IAM role using static s3 templates for Organization management account and member accounts via stackset using separate templates, onboarded the organization on Prisma Cloud with a custom ExternalId, the following error may display under **Review Status**:

<figure><img src="/files/RQrTHxWYLruXSKcflikb" alt="aws ts error message 2"><figcaption></figcaption></figure>

* If the member accounts display an incorrect ExternalId or missing Trust relationship for Prisma Cloud in the provided Role:
  * The ExternalId for member role names may be incorrect, or
  * You used an old template while onboarding in Prisma Cloud, and the memberRoleName is not in the correct `<masterRoleName>-member` format.

    <figure><img src="/files/O7Q4yN8usB7Y4u74q4aX" alt="aws ts extid 7"><figcaption></figcaption></figure>

Make sure to **Save** the account before you follow the steps listed below to resolve the errors.

**Use any one of the following methods to resolve this error:**

1. **Method 1**

   If you are an AWS Cloud Administrator who does not have access to Prisma Cloud APIs, download and run the CFT template again:

   1. Click the **Edit** icon for the onboarded AWS organization.
   2. Click **Configure Account**.
   3. **Download IAM Role CFT**.
   4. Follow the **Steps** to create new stack or update existing stack.
   5. Navigate to **Review Status** page to verify the status.
   6. Click **Save**.
2. **Method 2**

   If you are a Prisma Cloud Administrator who does not have AWS Administrator access, update the externalId, memberExternalId, memberRoleName, and roleArn used in **Create IAM Role** using [Update Cloud Account API](https://pan.dev/prisma-cloud/api/cspm/update-cloud-account/#request-body-to-update-an-aws-org-account):

   * externalId and roleArn - Management account IAM role
   * memberExternalId and memberRoleName - Member accounts IAM role (created using stackset)

     Example:

     `{ curl --location --request PUT 'https://api3.prismacloud.io/cloud/aws/123456789012' \ --header 'Connection: keep-alive' \ --header 'sec-ch-ua: " Not;A Brand";v="99", "Google Chrome";v="97", "Chromium";v="97"' \ --header 'x-redlock-auth: <token>' \ --header 'sec-ch-ua-mobile: ?0' \ --header 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36' \ --header 'Content-Type: application/json' \ --header 'Accept: application/json, text/plain, /' \ --header 'Sec-Fetch-Site: same-site' \ --header 'Sec-Fetch-Mode: cors' \ --header 'Sec-Fetch-Dest: empty' \ --header 'Accept-Language: en-GB,en-US;q=0.9,en;q=0.8' \ --data-raw '{ "accountId": "123456789012'", "accountType": "organization", "enabled": true, "externalId": "a1ea8fe3-85d8-4ed9-93da-02d68670bc61", "memberExternalId": "a1ea8fe3-85d8-4ed9-93da-02d68670bc61", "memberRoleName": "PrismaCloudOrgMemberReadWriteRole", "memberRoleStatus": true, "name": "AWS ORG", "protectionMode": "MONITOR_AND_PROTECT", "roleArn": "arn:aws:iam::123456789012':role/PrismaCloudReadWriteRole" }' }`
3. **Method 3**

   If you are an AWS Cloud Administrator who does not have access to Prisma Cloud APIs, manually update the Prisma Cloud generated ExternalId in the existing IAM role trust relationship in your AWS console:

   1. Click the **Edit** icon for the onboarded AWS organization.
   2. Click **Configure Account**.
   3. **Download IAM Role CFT**.
   4. Open the downloaded CFT in a text editor, search for `sts:ExternalId`. There will be one externalId for the Management role and another for member accounts roles. Locate the externalId inside the PrismaCloudRole mapping.

      <figure><img src="/files/dDuieTaPJMSwJHeunr0S" alt="aws ts extid 3"><figcaption></figcaption></figure>
   5. Copy the updated **ExternalId** in **Trust relationships** of existing Management account IAM role in AWS.

      <figure><img src="/files/L6Qfh4HLbFnB1jqU9ur6" alt="aws ts extid 4"><figcaption></figcaption></figure>
   6. Locate the memberExternalID in the downloaded template.

      <figure><img src="/files/wGx0j0gBe7NJruoDPbg4" alt="aws ts extid 5"><figcaption></figcaption></figure>
   7. Copy the updated **memberExternalId** in **Trust relationships** of all existing member accounts IAM role in AWS.

      <figure><img src="/files/McWfgWuMjtC9233WfAjx" alt="aws ts extid 6"><figcaption></figcaption></figure>
   8. Wait for 10-15 seconds for the changes to take effect.
   9. **Review Status** to verify the cloud account status is green or amber.
   10. Click **Save**.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.prismacloud.io/content-collections/connect/connect-cloud-accounts/onboard-aws/troubleshoot-aws-errors.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.