Troubleshoot AWS CloudTrail Errors

AWS_FILE_READ_FORBIDDEN

Meaning

The Expel role in your AWS environment does not have permission to read the CloudTrail log file.

Steps to Fix

You will need to make sure the s3:GetObject permission is properly applied.

1. Log in to your AWS instance.
2. Navigate to your IAM service.
3. View your Expel role. This may be named "ExpelAssumeRole".
4. Examine the policy applied to the role. This may be named "expel-aws-CloudTrail-CloudTrail-manager-policy".
5. Check that the s3:GetObject permission is set to Allow and also has the correct S3 bucket resource ARN applied.

Read about applying permissions to policies (AWS)

Example JSON (formatting can vary):

{
            "Action": "s3:GetObject",
            "Effect": "Allow",
            "Resource": "insert S3 Key arn here"
       	},

1. Save your changes.
2. Wait a few minutes for the system to refresh, then check for the error again.

If you still see the error after the refresh is complete, contact Support. Be sure to document all the steps you tried, and list the error specifically.

AWS_FILE_DECRYPT_FORBIDDEN

Meaning

The Expel role within your AWS environment does not have permission to decrypt the CloudTrail log file.

Steps to Fix

You will need to apply the correct permission to the Expel role.

1. Log in to your AWS instance.
2. Navigate to your IAM service.
3. View your Expel role. This may be named "ExpelAssumeRole".
4. Examine the policy applied to the role. This may be named "expel-aws-CloudTrail-CloudTrail-manager-policy".
5. View the permissions policy. Make sure the kms:Decrypt permission is set to Allow and that the resource contains the correct KMS Key ARN for your policy.

Read about the KMS Key ARN

Example JSON:

{
            "Action": "kms:Decrypt",
            "Effect": "Allow",
            "Resource": "insert KMS Key ARN here"
       	},

1. Save your changes.
2. Wait a few minutes for the system to refresh, then check for the error again.

If you still see the error after the refresh is complete, contact Support. Be sure to document all the steps you tried, and list the error specifically.

AWS_INVALID_JSON

Meaning

The CloudTrail log file is not in JSON format.

Steps to Fix

You need to verify the format of your CloudTrail log records.

1. Log in to your AWS instance.
2. Navigate to your S3 service.
3. Open the bucket containing the CloudTrail logs.

This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. Read about working with CloudTrail log files

1. Find the relevant logs within the bucket and make sure they are in JSON format.

If the format is correct and you are otherwise unable to determine the source of your issue, contact Support. Be sure to document all the steps you tried, and list the error specifically.

AWS_NON_TAR_FILE

Meaning

The CloudTrail log file is not in the targ.gz format.

Steps to Fix

You need to confirm the S3 bucket contains compressed JSON files with the .gz file extension.

1. Log in to your AWS instance.
2. Navigate to your S3 service.
3. Open the bucket containing the CloudTrail logs. This is the bucket you selected when you set up CloudTrail.

This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. Read about working with CloudTrail log files

1. Find the relevant logs within the bucket and make sure they are in the proper format. If they are in the wrong format, view AWS documentation (linked above) for help getting your log files into the tar.gz format.

If the format is correct and you are otherwise unable to determine the source of your issue, contact Support. Be sure to document all the steps you tried, and list the error specifically.

AWS_NO_RECORDS_IN_S3_FILE

Meaning

No records were found in the S3 file. This error is caused by a configuration of CloudTrail that is not compatible with how Expel reads logs.

Steps to Fix

You need to confirm the CloudTrail is writing logs to the correct S3 log bucket.

1. Log in to your AWS instance.
2. Navigate to your S3 service.
3. Open the bucket containing the CloudTrail logs.

This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. Read about working with CloudTrail log files

1. Look in the folders and make sure they are not empty. If they are empty, check your CloudTrail configuration.

If you are unable to determine the source of your issue, contact Support. Be sure to document all the steps you tried, and list the error specifically.

AWS_LOG_FILE_NOT_FOUND

Meaning

No log file was found in the S3 bucket.

Steps to Fix

You need to confirm the CloudTrail is writing logs to the correct S3 log bucket.

1. Log in to your AWS instance.
2. Navigate to your S3 service.
3. Open the bucket containing the CloudTrail logs.

This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. Read about working with CloudTrail log files

1. Look in the folders and make sure they are not empty. If they are empty, do the following:

   • Make sure the notification service is connected to the correct S3 log bucket.
   • Check your CloudTrail configuration.
   • Check if the log file was deleted. Expel cannot delete your log files, so a deletion would have happened on the AWS account owner's side. Check with your AWS console and team to determine why this happened.

If you are unable to determine the source of your issue, contact Support. Be sure to document all the steps you tried, and list the error specifically.

Botocore.exceptions.ClientError

Full Error

Botocore.exceptions.ClientError: An Error Occurred (AccessDenied) When Calling the AssumeRole Operation: User: arn:aws:iam::012205512454:user/ExpelCloudService Is Not Authorized to Perform: sts:AssumeRole on Resource: arn:aws:iam::*****:role/ExpelCloudTrailAccessRole

Meaning

Expel does not have permission to use the AssumeRole.

Steps to fix:

1. Log in to your AWS instance.
2. Navigate to your IAM service.
3. View your Expel role. This may be named "ExpelAssumeRole".
4. Examine the policy applied to the role. This may be named "expel-aws-CloudTrail-CloudTrail-manager-policy".
5. Verify the trust policy exists, in case it was omitted during configuration.

   1. If the trust policy does not exist, create the policy using the JSON code below.
   2. If the trust policy exists, make sure it has the correct Workbench GUID as the sts:ExternalId.

The trust policy should look like this:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::111111111:user/ExpelCloudService"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "INSERT ORGANIZATION GUID"
                }
            }
        }
    ]
}

1. Wait a few minutes for the system to refresh, then check for the error again.

If you still see the error after the refresh is complete, contact Support. Be sure to document all the steps you tried, and list the error specifically.