AWS Connection Health

Diagnose role validity, inventory coverage, export access and sync freshness.

The connection health view should show that STS validation, resource discovery, cost ingestion and recommendation refresh are distinct operations with distinct outcomes.

Connection health checks

Confirm the AWS account identifier, billing scope, selected regions, trusted principal, role validation time and source-specific latest successful jobs. A role can work for inventory yet fail to read a CUR bucket. A missing recommendation can be due to service enrollment rather than a global connection outage.

Permission mismatch

When an API returns AccessDenied, review the specific AWS action and policy scope. Do not broaden the customer role to write permissions to “make sync work.” Use the documented read-only CloudFormation role and the required billing export access.

Security

Never broaden the customer IAM role to include write permissions. The read-only role is a core security guarantee of the CoreFinOps integration model.

Failure recovery

Transient STS failures should be retryable and visible; permanently invalid role trust requires customer action. Retain the last good snapshots and show their age. Disconnecting should stop further authorized collection, but must not imply that AWS resources or IAM roles were deleted.

Operator checklist

Record the failed stage, AWS source/action, job-run ID, error category, last good timestamp, and account/region. Do not paste raw JWTs, ExternalIds or other secrets into support tickets.