Troubleshooting Tip: AWS SDN connector is failing to update dynamic objects

[vschmitt_FTNT]

Description	This article describes the different API endpoints that can lead to a failure in dynamic address update from the awsd process (Aws sdn connector).
Scope	FortiGate, SDN Connector, AWS, IAM, STS.
Solution	To identify the actual error, enable debugging for the awsd process: diagnose debug application awsd -1 diagnose debug enable If there are reachability issues, the following outputs will appear: aws curl failed, 28 awsd sts curl failed 28 awsd reap child pid: 22767 In this case, the STS API endpoint of AWS is not reachable. Note: The awsd process uses curl queries and relies on the DNS server configured on the management port to resolve the FQDN into IP addresses. For proper operation, ensure HTTPS (port 443) access to the following AWS API endpoints: ec2.[region].amazonaws.com sts.[region].amazonaws.com eks.[region].amazonaws.com Tip: The awsd debug output shows which IP address the FQDN resolves to. Perform a telnet test to that IP on port 443 to verify reachability. Ensure that HTTPS access is allowed from AWS.