Run the following command to verify the connector status is UP:
diagnose sys sdn status
By default, the 'update-interval' setting under the AWS connector is 30 seconds. If changes are made to the asset in AWS, review the address object to determine if the change is reflected after 30 seconds.
Go to Policy & Objects -> Addresses. Hover over the Fabric Connector Address associated with the AWS SDN connector.
If it is not updated, collect the following debug log outputs:
diagnose debug disable
diagnose debug reset
diagnose debug application awsd -1
diagnose debug console timestamp enable
diagnose debug enable
A common error is 'AWS curl response err, 403', which highlights the credentials being used to poll the connector do not have sufficient access, as highlighted in the FortiGate debug output example below.
aws curl response err, 403
{"message":"User:xxx:aws:xxx::111111111:assumed-role/<Admin_role_name>/role_session_2026060511111 is not authorized to perform: eks:ListClusters on resource: arn:aws:eks:us-east-1:11111111111:cluster/* because no identity-based policy allows the eks:ListClusters action"}
2026-06-05 10:27:48 awsd sdn connector AWS_SDN get EKS cluster list failed
2026-06-05 10:27:48 awsd sdn connector AWS_SDN list EKS cluster failed
2026-06-05 10:27:48 awsd sdn connector AWS_SDN start updating IP addresses
2026-06-05 10:27:48 awsd checking firewall address object AWS_SDN_GROUP1, vd 2
2026-06-05 10:27:48 awsd checking firewall address object AWS_SDN_GROUP2, vd 2
2026-06-05 10:27:48 awsd checking firewall address object SDN_WORKSPACE_GROUP3, vd 2
2026-06-05 10:27:48 awsd sdn connector AWS_SDN finish updating IP addresses
Related article:
Troubleshooting Tip: AWS SDN connector showing down | 
