Perform the following reachability checks from the Cloud Connector console:

• Verify that pkg-repo.zscaler.com is reachable on TCP port 443 by running either telnet pkg-repo.zscaler.com 443 or curl pkg-repo.zscaler.com 443.
• Check whether Cloud Connector received a 500 response from the server indicating that connectivity has succeeded. If the request times out, verify the AWS network configuration (NAT gateway, route table, and internet gateway).
• Run the pkg info | grep certificates command to verify that the certificate bundle is present.
• Run the sudo pkg update command to verify the software update.

Verify the following:

• There is no mismatch with the CloudFormation stack parameters: virtual private cloud (VPC), subnet, and availability zone.
• The provisioning URL field is not empty and is in the correct format.

Verify that the security admin IAM user has the following access:

• Full access to the AWS Management Console.
• Full access to the AWS Secrets Manager.
• Full access to Amazon CloudWatch Events.
• Full access to AWS CloudFormation.
• Full access to AWS Lamda Service.

Create the following policies and roles:

{
                                                                                                                          “Version”: “2012-10-17",
                                                                                                                          “Statement”: [
                                                                                                                            {
                                                                                                                              “Sid”: “VisualEditor0”,
                                                                                                                              “Effect”: “Allow”,
                                                                                                                              “Action”: [
                                                                                                                                “cloudformation:CreateUploadBucket”,
                                                                                                                                “aws-marketplace:ViewSubscriptions”,
                                                                                                                                “cloudformation:ListStacks”,
                                                                                                                                “aws-marketplace:ListBuilds”,
                                                                                                                                “sns:ListTopics”,
                                                                                                                                “s3:CreateBucket”,
                                                                                                                                “aws-marketplace:Subscribe”,
                                                                                                                                “s3:PutObject”,
                                                                                                                                “aws-marketplace:StartBuild”,
                                                                                                                                “ssm:DescribeParameters”,
                                                                                                                                “route53:ListTrafficPolicies”,
                                                                                                                                “route53:GetHostedZoneCount”,
                                                                                                                                “secretsmanager:ListSecrets”
                                                                                                                              ],
                                                                                                                              “Resource”: “*”
                                                                                                                            },
                                                                                                                            {
                                                                                                                              “Sid”: “VisualEditor1”,
                                                                                                                              “Effect”: “Allow”,
                                                                                                                              “Action”: [
                                                                                                                                “logs:ListTagsLogGroup”,
                                                                                                                                “iam:CreateInstanceProfile”,
                                                                                                                                “route53resolver:GetResolverRuleAssociation”,
                                                                                                                                “secretsmanager:DescribeSecret”,
                                                                                                                                “secretsmanager:PutSecretValue”,
                                                                                                                                “route53resolver:ListTagsForResource”,
                                                                                                                                “secretsmanager:CreateSecret”,
                                                                                                                                “iam:RemoveRoleFromInstanceProfile”,
                                                                                                                                “iam:DeletePolicy”,
                                                                                                                                “iam:CreateRole”,
                                                                                                                                “iam:AttachRolePolicy”,
                                                                                                                                “iam:PutRolePolicy”,
                                                                                                                                “ssm:GetParameter”,
                                                                                                                                “iam:AddRoleToInstanceProfile”,
                                                                                                                                “route53resolver:DisassociateResolverRule”,
                                                                                                                                “route53resolver:CreateResolverEndpoint”,
                                                                                                                                “iam:ListInstanceProfilesForRole”,
                                                                                                                                “ssm:DeleteParameter”,
                                                                                                                                “iam:PassRole”,
                                                                                                                                “iam:DetachRolePolicy”,
                                                                                                                                “secretsmanager:GetSecretValue”,
                                                                                                                                “iam:ListAttachedRolePolicies”,
                                                                                                                                “iam:DeleteRolePolicy”,
                                                                                                                                “route53resolver:GetResolverRule”,
                                                                                                                                “route53resolver:DeleteResolverEndpoint”,
                                                                                                                                “iam:DeleteInstanceProfile”,
                                                                                                                                “iam:GetRole”,
                                                                                                                                “iam:GetInstanceProfile”,
                                                                                                                                “logs:DeleteLogGroup”,
                                                                                                                                “route53resolver:DeleteResolverRule”,
                                                                                                                                “route53resolver:AssociateResolverRule”,
                                                                                                                                “iam:DeleteRole”,
                                                                                                                                “ssm:GetParameters”,
                                                                                                                                “route53resolver:GetResolverEndpoint”,
                                                                                                                                “logs:CreateLogGroup”,
                                                                                                                                “ssm:DeleteParameters”,
                                                                                                                                “ssm:PutParameter”,
                                                                                                                                “iam:CreatePolicy”,
                                                                                                                                “route53resolver:ListResolverEndpointIpAddresses”,
                                                                                                                                “iam:ListPolicyVersions”,
                                                                                                                                “ssm:ListTagsForResource”,
                                                                                                                                “iam:GetRolePolicy”,
                                                                                                                                “route53resolver:CreateResolverRule”
                                                                                                                              ],
                                                                                                                              “Resource”: [
                                                                                                                                “arn:aws:ssm:*:awsaccountnumber:parameter/*“,
                                                                                                                                “arn:aws:logs:*:awsaccountnumber:log-group:*“,
                                                                                                                                “arn:aws:iam::awsaccountnumber:instance-profile/*“,
                                                                                                                                “arn:aws:iam::awsaccountnumber:policy/*“,
                                                                                                                                “arn:aws:iam::awsaccountnumber:role/*“,
                                                                                                                                “arn:aws:route53resolver:*:awsaccountnumber:resolver-endpoint/*“,
                                                                                                                                “arn:aws:route53resolver:*:awsaccountnumber:resolver-rule/*“,
                                                                                                                                “arn:aws:secretsmanager:*:awsaccountnumber:secret:*”
                                                                                                                              ]
                                                                                                                            }
                                                                                                                          ]
                                                                                                                        }
                                                                                                                        

• Investigate the event log for errors.
• Confirm that the user has the correct permissions.
• Verify that Supported Images in the AWS Marketplace terms and conditions were accepted before deploying to the AWS account for the first time. Navigate to the Cloud Connector offering in the AWS Marketplace and accept the terms and conditions.

• Verify Terraform credentials (i.e., Access Key/Secret Key).
• Verify that the user has permissions to create VPC, NAT Gateway, GWLB, IAM, EC2, Elastic IP, Route Tables, Subnets, Security Groups, etc.

Verify the following:

• Registration and policy fetch are working. To verify, run the sudo januscli status command.
• The Cloud Connector instance is up and running within the AWS Management Console.
• The Cloud & Branch Connector Admin Portal can be reached from your VPC/Subnet.
• AWS Secrets Manager has the correct secret credentials in case of a secrets rotation.
• The network is connected. Verify by checking the route tables, NAT gateway, and internet gateway configurations.
• The security group or network ACL is not blocking the Cloud Connector TCP/UDP 443.

Verify the following:

• The service security group is not blocking access to the management interface (TCP/UDP 443) and the network ACL. You can find a list of Zscaler IP addresses here: https://config.zscaler.com
• In the Cloud & Branch Connector Admin Portal, check the ZIA gateway configuration. Ensure that Gateway configuration is set to Auto or Manual (with the proper Data Center set), or in the case of Override, the proper IP Address is input.
• Reachability of the PAC file for pac.<cloudname>.net from the customer's VPC or subnet.

Verify the following:

• The DNS to ec2br.prod.zpath.net is resolvable from the Cloud Connector.
• The connection to TCP/UDP port 443 is allowed in the network ACL. You can find a list of Zscaler IP addresses here: https://config.zscaler.com