AWS monitors query every region configured on the AWS connection. If one region cannot be reached or will not accept the connection's credentials, the entire monitor fails, even when every other region is healthy.
Symptoms.
Monitors show a Connection Error after a scheduled run, then clear when refreshed manually.
Error messages include ExpiredToken, UnrecognizedClientException: The security token included in the request is invalid, or a query timeout.
Other monitors on the same AWS connection run normally.
1. Opt-in regions.
Some AWS regions, such as Asia Pacific (Taipei) ap-east-2 and Asia Pacific (Hong Kong) ap-east-1, are opt-in regions. By default, AWS does not accept session tokens from the global STS endpoint in opt-in regions, even when the region is enabled on the account.
To allow session tokens in all regions:
Sign in to the AWS Management Console as an administrator.
Open the IAM console.
In the left navigation, select Account settings.
Under Security Token Service (STS), find Session tokens from the STS global endpoint and select Edit.
Change the setting from Valid only in AWS Regions enabled by default to Valid in all AWS Regions, then select Save.
Note: This setting applies per AWS account. Repeat it in each connected AWS account that has the opt-in region on its connection. It takes effect for newly issued tokens.
If an AWS account does not use the opt-in region, create a support ticket or email support@thoropass.com to have the region removed from that connection instead.
2. Unavailable regions.
AWS has reported the Middle East (Bahrain) region, me-south-1, as unavailable. Monitors that query an unavailable region will wait until the request times out, which will appear as connection errors across many AWS monitors.
To resolve unavailable region errors:
Create a support ticket or email support@thoropass.com to request that we remove the region from the AWS connection.
After the next scheduled run, the affected monitors will return results.
Note: S3 monitors will remain in Connection Error while S3 buckets exist in an unavailable region, because AWS has to reach a bucket in its own region to read its settings. You can provide manual evidence for those monitors.