Scan failed errors on cloud accounts
Scan failed errors on AWS accounts
The scan account could not be accessed due to an invalid or missing IAM role, or an incorrect trust relationship.
Recommended remediation
Verify that the CloudFormation stack and associated IAM role exist and are properly configured. If either is missing, follow the steps in Onboarding an AWS account to create a new CloudFormation stack and update the scan account configuration with the new IAM Role ARN.
Verification steps
Sign in to the AWS Management Console.
Go to CloudFormation > Stacks.
Locate the CloudFormation stack created during the onboarding.
Verify that the stack exists and is in a valid state (for example, CREATE_COMPLETE or UPDATE_COMPLETE).
Open the stack and go to the Resources tab.
Locate the AWS IAM role (AWS::IAM::Role) and click its Physical ID to open the role in IAM.
Verify that the IAM role still exists.
Review the role configuration.
Remediation steps
If the CloudFormation stack or IAM role no longer exists, follow these steps to restore the connection:
Refer to the AWS onboarding guide to create a new CloudFormation stack.
Once the stack has been successfully created, go to the Resources tab.
Locate the newly created IAM role (AWS::IAM::Role) and copy its Role ARN.
In the Cloud Security console, go to Configuration > Scan Configuration.
Click the Edit button for the account where the scan failed.
Update the Account ARN role.
Click Save Changes.
Retry the scan to verify that the connection has been restored.
Scan failed errors on Azure accounts
The scan account could not be accessed due to an invalid or missing application registration, an expired or invalid client secret, or an incorrect application configuration.
Recommended remediation
Verify that the application registration associated with the scan account exists and that its client secret is valid and active. If the client secret has expired or is invalid, generate a new client secret and update the scan account configuration. If the application registration no longer exists, disable the scan account and follow the steps in Create a new Azure AD application to create a new application and establish a new connection.
Verification steps
Sign in to the Azure portal.
Go to App registrations.
Locate the application created during the onboarding.
Verify that the application registration still exists.
Open the application and verify that the Application (Client) ID and Directory (Tenant) ID match the scan account configuration.
Go to Certificates and secrets.
Under the Client secrets tab, verify that the client secret associated with the scan account exists and has not expired.
Remediation steps
If the client secret has expired, is missing, or needs to be replaced, follow these steps to restore the connection:
From the Client secrets tab of the associated application, click New client secret.
Enter an easily identifiable description in the Description field.
Set Expires to 24 months.
Click Add and copy the newly generated Client secret value.
In the Cloud Security console, go to Configuration > Scan Configuration.
Click the Edit button for the account where the scan failed.
Under the Application section, click go to the Integrations page.
Update the Client Secret field using the new Client Secret value.
Click Save Changes.
Retry the scan to verify that the connection has been restored.
Scan failed errors on GCP accounts
The scan account could not be accessed due to an invalid, disabled, or missing service account or its associated credentials.
Recommended remediation
Verify that the service account and its associated service account key exist and are active. If the service account key is invalid or no longer exists, generate a new JSON key and update the scan account configuration with the new credentials.
Verification steps
Sign in to the Google Cloud Console.
Go to IAM & Admin > Service Accounts.
Locate the service account created during the onboarding.
Verify that the service account exists and is enabled.
Click the service account and go to the Keys tab.
Verify that the JSON key associated with the scan account exists and is active.
Note
If the service account no longer exists, refer to Onboarding a Google Cloud Platform (GCP) Project to create a new service account and configure its credentials.
Remediation steps
If the service account key no longer exists, is disabled, or needs to be replaced, follow these steps to restore the connection:
From the Keys tab of the associated service account, click Add Key, then Create new key.
Select JSON as the key type.
Click Create to generate and download the new JSON key file.
In the Cloud Security console, go to Configuration > Scan Configuration.
Click the Edit button for the account where the scan failed.
Update the API Credentials using the new key.
Click Save Changes.
Retry the scan to verify that the connection has been restored.
Scan failed errors on Alibaba Cloud accounts
The scan account could not be accessed due to invalid, disabled, or deleted AccessKey credentials.
Recommended remediation
Verify that the AccessKey pair associated with the scan account exists and is active.
Verification steps
Sign in to the Alibaba Cloud Management Console.
Go to Resource and Access Management (RAM) > RAM Users.
Locate the RAM user associated with the scan account.
Select the RAM user and go to the Credentials tab.
Under the AccessKey section, verify that the configured AccessKey ID exists, and that its status is Active (enabled).
Note
If the associated RAM user no longer exists, refer to Onboarding an Alibaba Cloud account to create a new RAM user.
Remediation steps
If the AccessKey pair no longer exists, is disabled, or needs to be replaced, follow these steps to restore the connection:
From the AccessKey section, click Create AccessKey.
Select Third-party Service.
Click Continue, then download or copy the new AccessKey Pair.
In the Cloud Security console, go to Configuration > Scan Configuration.
Click the Edit button for the account where the scan failed.
Update the AccessKey ID and AccessKey Secret using the new AccessKey Pair.
Click Save Changes.
Retry the scan to verify that the connection has been restored.