Troubleshooting Tip: AWS SDN connector is failing to update dynamic objects

[vschmitt_FTNT]

Description	This article describes the different API endpoints that can lead to a failure in dynamic address update from the awsd process (Aws sdn connector).
Scope	FortiGate, SDN Connector, AWS, IAM, STS.
Solution	To see the actual error, it is necessary to debug the awsd process: diag debug application awsd -1 diag debug en If there are reachability issues, the following outputs will appear: aws curl failed, 28 awsd sts curl failed 28 awsd reap child pid: 22767 In this case, the STS API endpoint of aws is not reachable. Note: The awsd process uses curl queries and will use DNS server from the managment port to resolve the FQDN into IP address. To work, it is necessary to reach the following: Ensure to have access to the following AWS APIs using HTTPS (443): ec2.[region].amazonaws.com sts.[region].amazonaws.com eks.[region].amazonaws.com