> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/a-c-integrations/amazon-aws/aws-cloudtrail/troubleshoot-aws-cloudtrail-errors.md). # Troubleshoot AWS CloudTrail Errors ## AWS\_FILE\_READ\_FORBIDDEN **Meaning** The Expel role in your AWS environment does not have permission to read the CloudTrail log file. **Steps to Fix** You will need to make sure the `s3:GetObject` permission is properly applied. 1. Log in to your AWS instance. 2. Navigate to your IAM service. 3. View your Expel role. This may be named "ExpelAssumeRole". 4. Examine the policy applied to the role. This may be named "expel-aws-CloudTrail-CloudTrail-manager-policy". 5. Check that the `s3:GetObject` permission is set to `Allow` and also has the correct S3 bucket resource ARN applied. {% hint style="info" %} [Read about applying permissions to policies (AWS)](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html) {% endhint %} Example JSON (formatting can vary): ``` {             "Action": "s3:GetObject",             "Effect": "Allow",             "Resource": "insert S3 Key arn here"         }, ``` 6. Save your changes. 7. Wait a few minutes for the system to refresh, then check for the error again. If you still see the error after the refresh is complete, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. ## AWS\_FILE\_DECRYPT\_FORBIDDEN **Meaning** The Expel role within your AWS environment does not have permission to decrypt the CloudTrail log file. **Steps to Fix** You will need to apply the correct permission to the Expel role. 1. Log in to your AWS instance. 2. Navigate to your IAM service. 3. View your Expel role. This may be named "ExpelAssumeRole". 4. Examine the policy applied to the role. This may be named "expel-aws-CloudTrail-CloudTrail-manager-policy". 5. View the permissions policy. Make sure the `kms:Decrypt` permission is set to `Allow` and that the resource contains the correct KMS Key ARN for your policy. {% hint style="info" %} [Read about the KMS Key ARN](https://docs.aws.amazon.com/kms/latest/developerguide/find-cmk-id-arn.html) {% endhint %} Example JSON: ``` { "Action": "kms:Decrypt", "Effect": "Allow", "Resource": "insert KMS Key ARN here" }, ``` 6. Save your changes. 7. Wait a few minutes for the system to refresh, then check for the error again. If you still see the error after the refresh is complete, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. ## AWS\_INVALID\_JSON **Meaning** The CloudTrail log file is not in JSON format. **Steps to Fix** You need to verify the format of your CloudTrail log records. 1. Log in to your AWS instance. 2. Navigate to your S3 service. 3. Open the bucket containing the CloudTrail logs. {% hint style="info" %} This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. [Read about working with CloudTrail log files](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-working-with-log-files.html) {% endhint %} 4. Find the relevant logs within the bucket and make sure they are in JSON format. If the format is correct and you are otherwise unable to determine the source of your issue, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. ## AWS\_NON\_TAR\_FILE **Meaning** The CloudTrail log file is not in the targ.gz format. **Steps to Fix** You need to confirm the S3 bucket contains compressed JSON files with the .gz file extension. 1. Log in to your AWS instance. 2. Navigate to your S3 service. 3. Open the bucket containing the CloudTrail logs.\ This is the bucket you selected when you set up CloudTrail. {% hint style="info" %} This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. [Read about working with CloudTrail log files](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-working-with-log-files.html) {% endhint %} 4. Find the relevant logs within the bucket and make sure they are in the proper format. If they are in the wrong format, view AWS documentation (linked above) for help getting your log files into the tar.gz format. If the format is correct and you are otherwise unable to determine the source of your issue, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. ## AWS\_NO\_RECORDS\_IN\_S3\_FILE **Meaning** No records were found in the S3 file. This error is caused by a configuration of CloudTrail that is not compatible with how Expel reads logs. **Steps to Fix** You need to confirm the CloudTrail is writing logs to the correct S3 log bucket. 1. Log in to your AWS instance. 2. Navigate to your S3 service. 3. Open the bucket containing the CloudTrail logs. {% hint style="info" %} This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. [Read about working with CloudTrail log files](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-working-with-log-files.html) {% endhint %} 4. Look in the folders and make sure they are not empty. If they are empty, check your CloudTrail configuration. If you are unable to determine the source of your issue, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. ## AWS\_LOG\_FILE\_NOT\_FOUND **Meaning** No log file was found in the S3 bucket. **Steps to Fix** You need to confirm the CloudTrail is writing logs to the correct S3 log bucket. 1. Log in to your AWS instance. 2. Navigate to your S3 service. 3. Open the bucket containing the CloudTrail logs. {% hint style="info" %} This is the bucket you selected when you set up CloudTrail. If you do not know it, navigate to your CloudTrail service on the CloudTrail service dashboard. Under general details, view the Trail log location. This shows the S3 bucket containing your CloudTrail logs. [Read about working with CloudTrail log files](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-working-with-log-files.html) {% endhint %} 4. Look in the folders and make sure they are not empty. If they are empty, do the following: * Make sure the notification service is connected to the correct S3 log bucket. * Check your CloudTrail configuration.
* Check if the log file was deleted. *Expel cannot delete your log files, so a deletion would have happened on the AWS account owner's side. Check with your AWS console and team to determine why this happened.* If you are unable to determine the source of your issue, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. ## Botocore.exceptions.ClientError **Full Error** `Botocore.exceptions.ClientError: An Error Occurred (AccessDenied) When Calling the AssumeRole Operation: User: arn:aws:iam::012205512454:user/ExpelCloudService Is Not Authorized to Perform: sts:AssumeRole on Resource: arn:aws:iam::*****:role/ExpelCloudTrailAccessRole` **Meaning** Expel does not have permission to use the AssumeRole. Steps to fix: 1. Log in to your AWS instance. 2. Navigate to your IAM service. 3. View your Expel role. This may be named "ExpelAssumeRole". 4. Examine the policy applied to the role. This may be named "expel-aws-CloudTrail-CloudTrail-manager-policy". 5. Verify the trust policy exists, in case it was omitted during configuration. 1. If the trust policy does not exist, create the policy using the JSON code below. 2. If the trust policy exists, make sure it has the correct [Workbench GUID](#user-content-fn-1)[^1] as the `sts:ExternalId`. The trust policy should look like this: ``` { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::111111111:user/ExpelCloudService" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "sts:ExternalId": "INSERT ORGANIZATION GUID" } } } ] } ``` 6. Wait a few minutes for the system to refresh, then check for the error again. If you still see the error after the refresh is complete, [contact Support](/support/how-to-reach-us.md). Be sure to document all the steps you tried, and list the error specifically. [^1]: * [Log in to Workbench](https://workbench.expel.io/auth/login?orig=%2F). * Go to **Organization Settings > My Organization**. * On the organization's page, look for the Organization GUID and select the **Copy** button to copy the GUID. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.expel.io/connect-your-technology/a-c-integrations/amazon-aws/aws-cloudtrail/troubleshoot-aws-cloudtrail-errors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.