Integration Authentication Error

Symptom

An integration shows a red badge with an error like:

"Authentication failed"
"403 Forbidden"
"Insufficient permissions"
"Token expired"

Diagnosis

First, run a connection test:

Go to Settings → Integrations
Click on the failing integration
Click Test Connection
Read the detailed error message — it will usually tell you exactly which permission is missing

AWS: Common Fixes

"No credentials found" or "Unable to assume role"

The IAM Role ARN is wrong or the External ID doesn't match.

Fix:

In AWS IAM, find the role → Trust Relationships
Verify the Principal account ID matches Nexxis's (shown in Settings → Integrations)
Verify the sts:ExternalId condition matches the External ID in Nexxis
Update if needed and re-test

"Access Denied" on specific services

The IAM Role is missing permissions for some services.

Fix: Add the SecurityAudit managed policy, or see Minimal AWS Policy for a scoped policy.

GCP: Common Fixes

"Permission denied" or "403"

The service account doesn't have the Viewer role or the specific API isn't enabled.

Fix:

In GCP IAM, verify the service account has Viewer role at project level
Ensure the following APIs are enabled: Cloud Asset API, Cloud Resource Manager API, Identity and Access Management API

"Service account key expired"

GCP service account keys don't expire by default — this error means the key was manually rotated or deleted.

Fix: Generate a new key and update in Settings → Integrations → GCP → Edit.

Azure: Common Fixes

"AADSTS700016: Application not found"

The Client ID or Tenant ID is wrong.

Fix: Re-copy from Azure Portal → App Registrations → Your App → Overview.

"AADSTS7000215: Invalid client secret"

The client secret expired (Azure secrets expire after 1–2 years).

Fix: In Azure Portal, create a new client secret and update in Nexxis.

Still Failing?

Enable Debug Logging for the integration (Settings → Integrations → Advanced → Debug Mode) and retry. Then contact support with the trace ID shown in the error.