Aws Cloud account status shows the error "Authentication failed. Invalid External ID or Prisma Cloud account not found in Trusted entities"

• Prisma Cloud
• Amazon web services (Aws)
• Onboarding
• Cloud Accounts

1. Invalid External ID
2. Prisma Cloud account not found in Trusted entities
3. Invalid Role Name
4. Invalid Role ARN

Resolution steps are for different Cloud setup/environments. Follow steps based on your Cloud Account error. i.e if a cloud status error appears on AWS ORG Master account then follow "Resolution steps if cloud account error shows only on AWS ORG Master Account"

• Resolution steps if cloud account error shows only on AWS ORG Master Account
• Resolution steps if cloud account error shows only on AWS ORG Member's Cloud Accounts
• Resolution steps if cloud account error shows only on Single AWS Cloud Account

Resolution steps if cloud account error shows only on AWS ORG Master Account:

If this error appears on AWS ORG Master Account, follow the below steps:

1. Login to AWS Root/Management account
2. Go to IAM > Roles > Select your role for PrismaCloud
3. Make sure AWS Master Role ARN is matching as entered in Prisma Cloud
4. IAM > Roles > Select your role for PrismaCloud > Trust relationships
5. Make sure AWS Master External ID is matching as entered in Prisma Cloud
6. Make sure Prisma Cloud account found in Trusted entities

• AWS Public Cloud: "arn:aws:iam::188619942792:root"
• AWS GovCloud: "arn:aws-us-gov:iam::342570144056:root"
• China AWS: "arn:aws-cn:iam::211784309483:root"

• Follow the Step 1 to 4 in the Docs

1. Go to Prisma Cloud Console > Settings > Cloud Accounts
2. Click on Edit button under Action on your Cloud Account

3. Click on Pencil button to Edit Cloud Account  
4. Complete Information from step Overview to Status on Edit Cloud Account page > Done
5. If you still see same error, It may take 24 hours to update the status.

1. Login to AWS member account
2. Go to IAM > Roles > Select your role for PrismaCloud
3. Make sure Master Role Name is matching and ending with -member as entered in Prisma Cloud

• AWS Public Cloud: "arn:aws:iam::188619942792:root"
• AWS GovCloud: "arn:aws-us-gov:iam::342570144056:root"
• China AWS: "arn:aws-cn:iam::211784309483:root"

• Follow the Step 2 in the Docs

1. Go to Prisma Cloud Console > Settings > Cloud Accounts
2. Click on Edit button under Action on your Cloud Account

3. Click on Pencil button to Edit Cloud Account  
4. Complete Information from step Overview to Status on Edit Cloud Account page > Done
5. If you still see same error, It may take 24 hours to update the status.
    

 

Resolution steps if cloud account error shows only on Single AWS Cloud Account:

If this error appears on AWS Account, follow the below steps:

1. Login to AWS Root account
2. Go to IAM > Roles > Select your role for PrismaCloud
3. Make sure Role ARN is matching as entered in Prisma Cloud
4. IAM > Roles > Select your role for PrismaCloud > Trust relationships
5. Make sure External ID is matching as entered in Prisma Cloud
6. Make sure Prisma Cloud account found in Trusted entities

Following are the example of Prisma Cloud Account in Trusted entities

• AWS Public Cloud: "arn:aws:iam::188619942792:root"
• AWS GovCloud: "arn:aws-us-gov:iam::342570144056:root"
• China AWS: "arn:aws-cn:iam::211784309483:root"

If you find any incorrect information, please rerun CloudFormation > Stacks in AWS Root account

• Follow the Step-1 to 4 in the Docs

After following the above Step 1 to 4

1. Go to Prisma Cloud Console > Settings > Cloud Accounts
2. Click on Edit button under Action on your Cloud Account

3. Click on Pencil button to Edit Cloud Account  
4. Complete Information from step Overview to Status on Edit Cloud Account page > Done
5. If you still see same error, It may take 24 hours to update the status.