Troubleshooting
Fixes for the most common connection and scan issues.
| Symptom | Likely cause & fix |
|---|---|
| “Verification failed” when pasting the Role ARN | External ID mismatch, or the stack isn’t finished. Confirm the stack is CREATE_COMPLETE and was created from the quick-create link. If you built the role manually, re-check the sts:ExternalId condition character-for-character. |
| Role ARN rejected as invalid | Copy the value from the stack’s Outputs tab (RoleArn), not the Resources tab. |
| Organization members not appearing | StackSets trusted access not enabled, or deployed outside the management/delegated-admin account. Enable trusted access (Organizations → Services → CloudFormation StackSets), then update the stack. Check the StackSet’s operation status for per-account errors. |
| Scan shows a Failed badge | Role deleted, trust policy edited, or permissions narrowed after connecting. Hover the badge for the exact error; re-deploy the stack to restore the role. |
| Scan succeeds but a service shows nothing | Detector disabled on the Rules page, or an SCP blocks that service’s Describe*/List*calls in that account. A single blocked service never fails the whole scan — it’s skipped and logged. |
| New AWS region shows no findings | Regions are re-discovered on every scan — run a new scan after opting in. |
Still stuck? Contact help@stalesweep.com with the scan’s timestamp and the account alias — never share your External ID or Role ARN publicly.