AWS Setup Troubleshooting for Spotto

Most AWS setup problems come from one of three places: the role's trust policy, an explicit deny elsewhere in AWS, or billing export details that don't match what AWS delivers. Start with the notice Spotto shows for the account.

Bash Setup Stops Or Results Need Changes

For Linux, macOS or CloudShell, use the Bash onboarding guide. It shares the setup package and results format with PowerShell and Terraform.

Symptom	Cause	Fix
Missing jq or GNU timeout	The Bash prerequisites are incomplete.	Install jq 1.6+ and GNU timeout. On macOS, brew install jq coreutils supplies jq and gtimeout. AWS CLI v2 and Bash 3.2+ are also required.
Check-only reports changes-required	The role differs from the package; checking makes no changes.	Review with --dry-run, then use --configure and approve. Unattended configuration requires --configure --non-interactive --yes.
The role is verify-only	It has a manager tag other than the exact Setup-SpottoAws (including empty), or CloudFormation stack tags.	Apply through the owning tool. Bash --repair-existing-role and PowerShell -RepairExistingRole cannot adopt it. Matching roles succeed without writes; drift is refused in configure mode.
The script was cancelled	Ctrl+C or TERM interrupted setup.	No further IAM writes are started; an in-flight write may have completed. Rerun a read-only check, then review and configure missing changes. A results file may not have been written.
Results do not match the current company or settings	The setup package is stale or belongs to another company.	Download a fresh package, rerun Bash, PowerShell or Terraform, and paste the complete results into Setup Results JSON. Select Read Setup Results, then Create or Update for live validation.

AWS Role Could Not Be Used

What you're seeing: AWS Role Could Not Be Used, or on the setup page: Check that the IAM role below exists in this account, trusts Spotto with the External ID, and has the required policies. Then retry validation.

Likely causes:

• The role hasn't been deployed in that account yet, or was deployed to a different account.
• The trust policy uses a different External ID or trusted principal than your company's generated instructions.
• The role has a different name or path from the IAM Role ARN in Spotto.
• A resource control policy (RCP) in AWS Organizations denies sts:AssumeRole on the role. SCPs don't block the assume itself, because Spotto's principal is outside your organization, but they can block the reads that follow.

How to fix:

1. In IAM, confirm SpottoReadOnlyRole exists in the account ID shown in Spotto.
2. Compare its trust policy with the one in Review Generated Trust and Permission Policies. The sts:ExternalId value and principal must match exactly. Don't invent an External ID.
3. If you used a custom role name, select Use a Custom Role ARN and enter the exact ARN.
4. Select Retry Validation.

Access Is Denied Even Though The Role Allows It

What you're seeing: Spotto can assume the role, but reports access denied for some reads in an account, or the account fails while others in the organization work.

Likely cause: An SCP, permissions boundary or other explicit deny blocks the read. An IAM Allow on the role can't override an explicit deny, so adding more permissions to the role doesn't help.

See how the role trust and explicit denies interact for the full picture.

How to fix:

1. Ask your AWS governance owner which SCPs apply to that account's organizational unit.
2. Amend the SCP, or its conditions, so the exact SpottoReadOnlyRole ARN can perform read-only calls. Avoid weakening the SCP for other principals.
3. Check for a permissions boundary on the role.
4. Select Retry Validation, or sync the account.

Validation Fails At Region Discovery

What you're seeing: The role works but validation or the first scan fails before collecting anything.

Likely cause: Spotto calls ec2:DescribeRegions to find the account's enabled Regions before scanning. An SCP or explicit deny blocks it.

How to fix: Allow ec2:DescribeRegions for SpottoReadOnlyRole in that account, then retry validation.

Billing Source Needs Attention

What you're seeing: Billing Source Needs Attention, or Billing sources that need attention in AWS Setup Status.

Check these in order. For where each account and value fits, see how Spotto reads a billing export.

1. Export definition: the definition account's role has SpottoBillingExportRead with GetExport on the exact Data Export ARN, or cur:DescribeReportDefinitions for CUR. Regenerate the role instructions after changing the export.
2. Export details match AWS: the bucket, base prefix, Region and name in Spotto match the export's configuration exactly. The prefix must not include the export or report name. See enter export details manually.
3. Guardrail replaced: the storage account's SpottoGuardrails is the version generated after billing was added. The original version denies all S3 object reads.
4. Bucket policy: if another account owns the bucket, its bucket policy allows the storage account's role.
5. KMS key policy: if the files use a customer-managed key, the key policy allows the role kms:Decrypt and kms:DescribeKey. An IAM permission alone isn't enough.

Then select Retry Validation.

Billing Is Waiting For Delivery

What you're seeing: The billing source isn't flagged as needing attention, but no cost data appears.

Likely cause: AWS hasn't delivered the first export files yet. New exports can take up to 24 hours.

How to fix: Wait. Spotto checks again on later refreshes and starts importing when files appear. If nothing arrives after 24 hours, check the export's status in AWS Billing and Cost Management, and that its destination matches what you entered in Spotto.

Data Export Discovery Fails

Message	Fix
The AWS Role Could Not Be Assumed	The definition account's role isn't deployed or its trust policy is wrong. See AWS role could not be used.
AWS Export Discovery Permission Is Missing	Apply the definition account's SpottoBillingExportRead policy from its role instructions, then retry.
Exports Could Not Be Discovered	Check the definition role and its ListExports permission, or enter the export manually.
No Data Exports were found for this role.	The export is defined in a different account. Choose the account where the export was created, usually the management account.
The selected export destination could not be read. Check its GetExport permission, then retry or enter the destination manually.	Regenerate and apply the definition role instructions for the selected export ARN, then select Validate Export Destination again.

Manual entry is always available if discovery doesn't work.

Settings Need Validation

What you're seeing: Settings Need Validation or Waiting for Validation, while older data is still visible.

Likely cause: The configuration changed after the last validation. Existing data isn't affected.

How to fix: Open AWS setup and select Retry Validation. If roles need new permissions for the change, apply them first.

Configuration Can't Be Saved

Message	Fix
AWS account ID must contain 12 digits.	Enter the 12-digit ID without dashes or spaces.
Role ARN must be a commercial IAM role ARN for this account.	The custom ARN belongs to a different account, or to GovCloud or China. Use an ARN for the account ID above it.
Add the management account to the AWS accounts list as well.	Add the management account as one of the organization's accounts.
Data Export ARN must belong to the definition role account.	Choose the account in the export ARN as the Export Definition Account.
Enter the configured S3 base prefix without wildcards, empty segments, or leading or trailing slashes.	Remove s3://, the bucket name and any leading or trailing /.
Enter a valid KMS key ARN in the same AWS Region as the S3 bucket.	Use the full key ARN, not an alias, in the bucket's Region.
This AWS account is already in another AWS account or organization for this company.	The account is already in another standalone account or organization in this company. Remove one.
This AWS account is already connected to another company.	Another Spotto company still has this AWS account. Remove it from that company and wait for offboarding to finish, or enter a different account.
AWS Configuration Changed Elsewhere	Someone else saved first, or a removed account is still being offboarded. Select Reload Latest Configuration, wait a few minutes if you just removed an account, and make your change again.

The AWS Option Isn't Shown

What you're seeing: Create in Cloud Accounts opens the Azure setup options with no AWS choice, or the AWS setup page says AWS account onboarding is available only to approved preview customers.

How to fix: AWS isn't enabled for this company, or you can't manage cloud accounts. Check that you're in the right company, then ask Spotto to enable the AWS preview.

Some AWS Data Is Missing

Missing data	Likely cause
Security score, GuardDuty or Inspector findings	The service isn't enabled in that Region, or a read is denied. See AWS security access.
Trusted Advisor checks or AWS Health events	The account's AWS Support plan doesn't include API access. These APIs need a plan such as Business Support+ or Enterprise Support, or a legacy Business or Enterprise On-Ramp plan until it retires.
Compute Optimizer or Cost Optimization Hub recommendations	The account isn't opted in to the service.
Native AWS account name	An SCP or permissions boundary denies account:GetAccountInformation.
Commitments data for the organization	Organization Commitments Planning isn't selected on the management account, or SpottoCommitmentsPlanning hasn't been applied.

Unavailable data is shown as unavailable, not as zero or healthy.

Organization Commitments Completed With Warnings Or Failed

Likely causes: Some member accounts denied Savings Plans or Reserved Instance inventory reads, the management account's role is missing the Cost Explorer actions, or AWS was still generating a Savings Plans recommendation.

How to fix:

1. Check the stage that reported the problem in the account's Details.
2. Apply the current role instructions to the affected accounts. Member accounts need savingsplans:DescribeSavingsPlans and ec2:DescribeReservedInstances; the current generated discovery allowlist includes these reads. An SCP or other explicit deny can still block them.
3. Refresh once more after AWS has finished. Because AWS allows three recommendation calculations a day, Refresh organization commitments is unavailable for 8 hours after a refresh requests one.

Get Help

Contact Spotto support with your company name, the AWS account IDs and any code shown in the notice. Never send access keys, session tokens, policies containing secrets or KMS key material.