Skip to main content

Troubleshooting

This section covers common issues you may encounter while using Prism and provides step-by-step solutions. Select the category that best matches the problem you are experiencing.

Troubleshooting by Category​

Login Issues​

Problems with logging in to any Prism portal, including authentication errors, SSO redirect failures, and session timeouts.

Common symptoms:

  • "Authentication Required" screen appears
  • SSO redirect loop or failure
  • "Access Denied" after successful login
  • Password login fails at /init
  • Token expired errors

SSO Configuration​

Issues with setting up or managing identity provider integrations, including Google OAuth, Microsoft OAuth, and custom OIDC providers.

Common symptoms:

  • Identity provider not redirecting properly
  • "Invalid client" errors
  • Users not appearing after SSO login
  • OIDC endpoint URL errors

Permission Errors​

Problems with role-based access, missing features in the Admin Portal, and changes not taking effect in AWS.

Common symptoms:

  • Cannot see expected admin features
  • Cannot create assignments
  • Changes not reflected in AWS after saving
  • Errors when deleting accounts

JIT Request Issues​

Problems with requesting, approving, or managing Just-In-Time access sessions.

Common symptoms:

  • Requests stuck in pending status
  • "No accounts available" when requesting access
  • Custom permission set validation failures
  • Sessions expiring unexpectedly
  • Unable to approve requests

CloudTrail Setup Issues​

Problems with creating, configuring, or managing CloudTrail trails.

Common symptoms:

  • Trail creation failures
  • S3 bucket creation errors
  • Partial account failures
  • Unable to delete trails or remove accounts

Policy Management Issues​

Problems with managing AWS Organizations policies, OUs, and organization structure.

Common symptoms:

  • Policy type shows as "Disabled"
  • "Max policies exceeded" error when attaching
  • Cannot delete a policy (targets still attached)
  • OU deletion fails (OU not empty)
  • Organization tree not loading in hierarchy view

Security Hub Issues​

Problems with enabling Security Hub engines (CSPM, GuardDuty, Macie, Inspector, Detective, IAM Access Analyzer, Firewall Manager), member enrollment, AWS Config recorders, and findings refresh.

Common symptoms:

  • Accounts stuck in "failed" enrollment phase
  • Standards show "No data yet" or 0% compliance
  • GuardDuty "Enter root emails" dialog or resolution timeout when adding many accounts
  • Detective accounts reporting VERIFICATION_FAILED minutes after enrollment succeeded
  • Detective accounts accepted into the behavior graph but not ingesting
  • Access Analyzer findings about your own organization's accounts that look like false positives
  • Access Analyzer reporting that an analyzer already existed in the account
  • Access Analyzer analyzer status showing FAILED
  • Partial-failure banner persists after setup
  • Empty Organization Services sidebar even though you have access
  • Findings dashboard shows "Last refresh: never"

VPC IPAM Issues​

Problems with the VPC IPAM address inventory, pools and allocations, account enrollment, teardown, and IPAM billing. VPC IPAM is a networking capability rather than a security one, so its problems are a different set from the engines above and have their own page.

Common symptoms:

  • The address inventory is empty after enabling, with every account showing as enabled
  • A newly added member account reaches "enabled" but its resources do not appear
  • A pool cannot be deleted, and teardown reports it as blocked
  • Deprovisioning a pool CIDR fails with failed-deprovision
  • The entire IPAM bill lands on one AWS account
  • Utilization is blank for an IPv6 pool or prefix
  • Only four member accounts can be enrolled

General Troubleshooting Steps​

Before diving into specific troubleshooting pages, try these general steps:

  1. Refresh the page, Some issues are resolved by a simple browser refresh.
  2. Clear browser cache and cookies, Stale session data can cause unexpected behavior.
  3. Try a different browser, Rule out browser-specific issues.
  4. Check your role, Many features are restricted by role. Verify you have the required access level for the feature you are trying to use.
  5. Contact your administrator, If you are a non-admin user, your organization's Prism admin may need to adjust your configuration.

Getting Help​

If the troubleshooting guides in this section do not resolve your issue, contact CloudKeeper support with the following information:

  • Your organization's realm name
  • The portal you were using (Admin Portal, JIT Access Portal, or Organization Services), and within it, CloudTrail, Security Hub, VPC IPAM, or StackSets
  • The steps you took that led to the issue
  • Any error messages displayed (exact text or screenshots)
  • The browser and operating system you are using