This article describes the different API endpoints that can lead to a failure in dynamic address update from the awsd process (Aws sdn connector).
Scope
FortiGate, SDN Connector, AWS, IAM, STS.
Solution
To see the actual error, it is necessary to debug the awsd process:
diag debug application awsd -1 diag debug en
If there are reachability issues, the following outputs will appear:
aws curl failed, 28 awsd sts curl failed 28 awsd reap child pid: 22767
In this case, the STS API endpoint of aws is not reachable.
Note: The awsd process uses curl queries and will use DNS server from the managment port to resolve the FQDN into IP address.
To work, it is necessary to reach the following:
Ensure to have access to the following AWS APIs using HTTPS (443):
ec2.[region].amazonaws.com sts.[region].amazonaws.com eks.[region].amazonaws.com