AWS SAAS Connector (Direct Connection) – "credentialsMap" is null on Test Connection

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Connector: Amazon Web Services – SaaS Connectivity, Direct Connection mode

Setup:
Created an IAM role in AWS with trust to SailPoint’s commercial account (874540850173/ciem_universal), External ID condition, and policies for Bedrock agent discovery, aggregation, and organizations. AWS Organizations is enabled. Configured the ISC source with the role name, region (us-east-1), and management account ID.

Errors:

  1. Test Connection fails with:
    “credentialsMap” is null

  2. AWS Account Settings page fails with:
    “Failed to get config options for key: cloudScope”
    — the accounts dropdown never loads

Everything on the AWS side is verified correct via CLI. Fresh source on a partner demo tenant.

Has anyone run into this? Is there something that needs to be enabled on the backend for Direct Connection mode?

image
image1414×834 75.4 KB

image
image1447×498 26.5 KB

2

This is a partner demo tenant vs a customer tenant so the account numbers needed in the aws policies had to be setup differently to get working vs the default aws configuration.

3

@DerekHackbardt Thanks for the update!

4

Hi Ambuj,

The role must be created in the management account ID, since the test connection is run against the role in the management account.

Please check the configuration has only role name entered correctly.

check if it is existing in the management account first ,check the roleName field and verify the external ID.

After correcting the above details re-run the test connection.

If it still fails refer the below document link.

5

Root cause identified and resolved.

This was a partner/demo tenant, not a customer production tenant. The AWS IAM role trust policy was originally configured using the standard commercial/customer SailPoint AWS principal from the public AWS SaaS connector setup guidance.

Derek from the SailPoint team helped identify that partner/demo tenants require a different SailPoint AWS trusted principal than the standard commercial/customer tenant configuration.

After updating the IAM role trust relationship to use the partner/demo SailPoint principal provided by SailPoint, the AWS SaaS connector Test Connection succeeded. We also validated successful STS AssumeRole events in AWS CloudTrail and confirmed that the AWS account list populated in the source.

Conclusion: this was an environment-specific trusted principal mismatch between customer/commercial tenants and partner/demo tenants.

Thanks to Derek from SailPoint for helping identify and resolve the issue.