Integration Authentication Error

Symptom

An integration shows a red badge with an error like:

• "Authentication failed"
• "403 Forbidden"
• "Insufficient permissions"
• "Token expired"

---

Diagnosis

First, run a connection test:

1. Go to Settings → Integrations
2. Click on the failing integration
3. Click Test Connection
4. Read the detailed error message — it will usually tell you exactly which permission is missing

---

AWS: Common Fixes

"No credentials found" or "Unable to assume role"

The IAM Role ARN is wrong or the External ID doesn't match.

Fix:

1. In AWS IAM, find the role → Trust Relationships
2. Verify the Principal account ID matches Nexxis's (shown in Settings → Integrations)
3. Verify the sts:ExternalId condition matches the External ID in Nexxis
4. Update if needed and re-test

"Access Denied" on specific services

The IAM Role is missing permissions for some services.

Fix: Add the SecurityAudit managed policy, or see Minimal AWS Policy for a scoped policy.

---

GCP: Common Fixes

"Permission denied" or "403"

The service account doesn't have the Viewer role or the specific API isn't enabled.

Fix:

1. In GCP IAM, verify the service account has Viewer role at project level
2. Ensure the following APIs are enabled: Cloud Asset API, Cloud Resource Manager API, Identity and Access Management API

"Service account key expired"

GCP service account keys don't expire by default — this error means the key was manually rotated or deleted.

Fix: Generate a new key and update in Settings → Integrations → GCP → Edit.

---

Azure: Common Fixes

"AADSTS700016: Application not found"

The Client ID or Tenant ID is wrong.

Fix: Re-copy from Azure Portal → App Registrations → Your App → Overview.

"AADSTS7000215: Invalid client secret"

The client secret expired (Azure secrets expire after 1–2 years).

Fix: In Azure Portal, create a new client secret and update in Nexxis.

---

Still Failing?

Enable Debug Logging for the integration (Settings → Integrations → Advanced → Debug Mode) and retry. Then contact support with the trace ID shown in the error.