Skip to main content

Illumio Segmentation for the Cloud User Guide

AWS Provisioning Troubleshooting Tips

Having trouble provisioning policy? Use these troubleshooting tips to resolve your provisioning errors.

Security Group Rule Quota Reached

The security group has reached the maximum number of inbound or outbound rules allowed by AWS. Illumio cannot provision additional rules.

  1. In the AWS Management Console, open Service Quotas and select Amazon VPC.

  2. Locate the quota named Inbound or outbound rules per security group.

  3. Select the quota and click Request quota increase.

  4. Enter a new value that accommodates the rules Illumio needs to provision, and submit the request.

    Alternatively, open EC2 > Security Groups, select the affected security group, and remove unused rules.

  5. In the Illumio Console, retry provisioning for the affected rules.

Network ACL Rule Quota Reached

The network ACL has reached the maximum number of rules allowed by AWS. The default limit is 20 rules per direction, and the quota applies separately to inbound and outbound entries.

  1. In the AWS Management Console, open Service Quotas and select Amazon VPC.

  2. Locate the quota named Rules per network ACL.

  3. Select the quota and click Request quota increase.

  4. Enter a new value up to the AWS maximum of 40 rules per direction, and submit the request.

    Note

    Raising this quota lowers network performance. AWS recommends staying at or below 20 rules per direction.

    Alternatively, open VPC > Network ACLs, select the affected network ACL, and consolidate or delete unused entries.

  5. Consider moving finer-grained rules to a security group, which supports a higher rule count.

  6. In the Illumio Console, retry provisioning for the affected rules.

Insufficient Permissions to Modify Security Groups

The Illumio IAM role does not have the permissions required to create or modify security group rules in this account.

Illumio recommends updating the permissions. For instructions, see Updating AWS permissions on the Assume Role.

If additional permissions are missing, go to the AWS Management console and follow these steps:

  1. In the AWS Management Console, go to IAM > Roles.

  2. Search for and select IllumioCloudIntegrationRole.

  3. Open the Permissions tab and select the Illumio enforcement policy.

  4. Verify the policy allows the following actions on the affected resources:

    • ec2:AuthorizeSecurityGroupIngress

    • ec2:AuthorizeSecurityGroupEgress

    • ec2:CreateTags

    • ec2:RevokeSecurityGroupIngress

    • ec2:RevokeSecurityGroupEgress

    • ec2:DescribeSecurityGroups

  5. Add any missing actions and save the policy.

  6. Confirm that no Service Control Policy (SCP) denies these actions for the role.

  7. In the Illumio Console, retry provisioning for the affected rules.

Insufficient Permissions to Modify Network ACLs

The Illumio IAM role does not have the permissions required to create, replace, or delete network ACL entries in this account.

Illumio recommends updating the permissions. For instructions see Updating AWS permissions on the Assume Role.

If additional permissions are missing, go to the AWS Management console and follow these steps:

  1. In the AWS Management Console, go to IAM > Roles.

  2. Search for and select IllumioCloudIntegrationRole.

  3. Open the Permissions tab and select the Illumio enforcement policy.

  4. Verify the policy allows the following actions on the affected resources:

    • ec2:CreateNetworkAclEntry

    • ec2:CreateTags

    • ec2:ReplaceNetworkAclEntry

    • ec2:DeleteNetworkAclEntry

    • ec2:DescribeNetworkAcls

  5. Add any missing actions and save the policy.

  6. Confirm that no Service Control Policy (SCP) denies these actions for the role.

  7. In the Illumio Console, retry provisioning for the affected rules.