Connection errors
When a connection fails, the Integrations page shows a banner with the reason underneath. The title is Couldn't start the connection for AWS and That didn't work for the other providers. Find the reason in your provider's table below.
Any provider
| What you see | Cause | Fix |
|---|---|---|
| Failed to fetch, Load failed or NetworkError when attempting to fetch resource. | Your browser lost the connection to CloudYali | Check your network, VPN or proxy, and try again |
| You are signed out when you select Connect | Your session expired, or, for Azure, the credentials are wrong (see Azure) | Sign in again and check the values |
| The account could not be removed. Nothing has changed — try again in a moment. | Every failed Remove shows this. Besides a passing error, it appears when the connection is already gone, or when a Cursor connection is removed by someone without the admin role | Reload the page. For Cursor, ask a CloudYali admin |
| Couldn't load connection status | CloudYali could not check which integrations you have connected. The Connected tab stays blank | Reload the page |
| Couldn't load AWS connections, or another provider's name | That provider's list could not be read. Other sections are unaffected | Reload the page |
| The Databricks or Microsoft Teams button is greyed out | Neither can be connected from the console yet | Contact support@cloudyali.io |
AWS
Before you continue
| What you see | Cause | Fix |
|---|---|---|
| An AWS account ID is exactly 12 digits. | The account or payer ID is not 12 digits | Use the 12-digit account ID |
| A root organization ID looks like r-a1b2 — "r-" followed by 4 to 32 lowercase letters or digits. | The root ID is not in that form | Copy the root ID from AWS Organizations |
| Continue stays greyed out | The name is shorter than 3 characters, or a field is invalid | Correct the field the console marks |
When you start the connection
| What you see | Cause | Fix |
|---|---|---|
| AWS cloud account is already registered | The account is already connected to this CloudYali account | Find it on the Connected tab |
| Free tier cloud account limit reached, Please upgrade subscription to add more cloud accounts | The free plan connects up to 3 AWS accounts | Upgrade your plan, or remove an account you no longer need |
| free tier account limit reached, please upgrade your plan | Despite the wording, your CloudYali subscription has ended | Contact support@cloudyali.io to renew it |
| Please upgrade subscription to add account | You are in the demo account | Sign up for your own CloudYali account |
| internal Error, or a message from AWS | CloudYali could not prepare the connection | Try again; contact support if it repeats |
While CloudYali waits for the role
| What you see | Cause | Fix |
|---|---|---|
| Waiting for AWS to confirm the role for more than 10 minutes | The stack failed; it was created from an older link; or the account is connected to another CloudYali account | Open the stack's Events tab in CloudFormation for the reason |
| CloudYali could not assume the role | The stack's ExternalId parameter was changed, or the stack was created more than 3 days after the link | Delete the stack, then start a new connection |
| Couldn't check the connection status | CloudYali could not read the connection's progress; it keeps trying | Reopen the panel later, or check the Connected tab |
| CloudYali cannot tell whether this worked | CloudYali has no record of the attempt | Check the Connected tab before trying again |
| Member accounts cannot be confirmed here | Expected for an AWS Organization: member accounts report through the StackSet | Check the StackSet's stack instances in CloudFormation |
In CloudFormation
| Stack event | Cause | Fix |
|---|---|---|
| AWS Cloud account is already onboarded in CloudYali | The account is connected to another CloudYali account | Remove it there first, or contact support |
| invalid job state. Please re-initiate the account onboarding flow | The stack was created from an older link, replaced by a newer connection | Delete the stack, then use the newest link |
Google Cloud
In the form
| What you see | Cause | Fix |
|---|---|---|
| Use dataset_name.table_name — one dataset and one table, separated by a dot. | The path has a project prefix or the wrong number of parts | Enter dataset.table only |
| That is a console URL. CloudYali needs the table path — dataset_name.table_name. | A link was pasted | Enter dataset.table only |
| Billing export tables usually start with gcp_billing_export_. | The table name looks unusual. The form lets you continue, but CloudYali rejects the table | Use the export's table, whose name starts with gcp_billing_export_ |
| Service account keys are .json files. or That file is not valid JSON. | The wrong file was picked | Pick the key's .json file, or download it again |
| That JSON is not a service account key | The file is another kind of JSON, such as an OAuth client | Create a key for a service account |
| That key file is missing … | The file is incomplete | Download the key again |
| This key belongs to project …, not … | A note: the key's project differs from the project ID you typed | Check it is the key you meant |
When you connect
| What you see | Cause | Fix |
|---|---|---|
| … does not appear to be a GCP billing export table | The table name does not start with gcp_billing_export_resource_v1_ or gcp_billing_export_v1_ | Copy the export's table name from BigQuery |
| Dataset … not found in project … | The dataset is not in the project ID you typed | Enter the project that holds the billing dataset |
| Table … not found in dataset … | The table name is wrong, or the export has not written any data yet | Check the table name in BigQuery |
| Service account does not have permission to access dataset … or … table … | The service account lacks BigQuery Data Viewer | Grant BigQuery Data Viewer on the dataset or its project |
| BigQuery API is not enabled | The BigQuery API is off | Turn it on in the project, then connect |
| failed to validate BigQuery billing access | The key was revoked or deleted, the BigQuery API is off, or Google took too long | Check the key is active and the API is on, then try again |
| Service account does not have the required Cloud Asset Viewer role | You chose This project only, and the account lacks Cloud Asset Viewer on the project | Grant Cloud Asset Viewer on the project |
| Service account does not have Cloud Asset Viewer role at organization level | The account lacks Cloud Asset Viewer on the organization | Grant it on the organization, or choose This project only |
| Cloud Asset API is not enabled | The Cloud Asset API is off | Turn it on, then connect |
| failed to validate GCP access or failed to validate GCP organization access | Google returned an unexpected error, or took too long | Try again; contact support if it repeats |
| Connected — but for this project only | You chose the organization, but CloudYali could not see it: the account lacks Browser on the organization, or the project has no organization | Grant Browser on the organization and connect again. A project with no organization stays project-only |
Azure
| What you see | Cause | Fix |
|---|---|---|
| A subscription ID is a GUID, and the same for the tenant and client IDs | The value is not a GUID | Copy the ID from the Azure portal |
| Storage account names are 3–24 characters, lowercase letters and numbers only. | The name has other characters | Use the storage account name from the export |
| You are signed out of CloudYali when you select Connect | The tenant ID, client ID or client secret is wrong: often the secret's ID pasted instead of its value, an expired secret, or an app in another tenant | Sign in again, check the three values, and connect again |
| Invalid storage_container_name | The container name breaks Azure's rules: 3 to 63 lowercase letters, numbers and single hyphens | Use the container named in the export |
| Storage account not found | No storage account has that name | Use the name from the export |
| Storage container not found | The container does not exist in that storage account | Use the container named in the export |
| Missing Storage Blob Data Reader role | The service principal cannot read the storage account: the role is missing or still applying, or the storage account's network rules block access | Assign Storage Blob Data Reader on the storage account and wait 5 to 10 minutes; check its networking settings |
| Cannot read the Cost Management export location | CloudYali could not open the storage account | Contact support |
| Failed to store credentials | CloudYali could not save the secret | Try again later |
| Failed to create account | The subscription is already connected, in this or another CloudYali account, or was connected and removed | Check the Connected tab. Do not retry a subscription that is already connected: retrying replaces its stored credentials. Otherwise contact support |
Anthropic and OpenAI
| What you see | Cause | Fix |
|---|---|---|
| That does not look like an Anthropic key — they start with sk-ant- | The key is incomplete or not an Anthropic key | Copy the whole Admin API key |
| Admin keys start with sk-admin-. A project key will not work here. | An OpenAI project or user key was pasted | Create an admin key |
| Failed to validate API key with Anthropic or … with OpenAI | The key is not an admin key, was revoked, or is not in an organization; or the provider is down | Create an admin key in the organization; if it is correct, try again later |
| An account for organization '…' is already connected | That organization is already connected to this CloudYali account | Find it on the Connected tab |
| Give this connection a name or Keep the name to 100 characters or fewer | The name is empty or too long | Enter a name of 1 to 100 characters |
| Service is temporarily unavailable. Please try again later. or Failed to create account | CloudYali could not store the key or save the connection | Try again; contact support if it repeats |
Cursor
| What you see | Cause | Fix |
|---|---|---|
| A Cursor team Admin API key starts with crsr_ … | Part of the key is missing | Copy the whole key; older keys that start with key_ also work |
| Only admins can manage Cursor integrations. | Your CloudYali role is not admin | Ask a CloudYali admin to connect the team or replace the key |
| Cursor rejected this API key. | A personal or revoked key | Create a team Admin API key in the Cursor dashboard |
| This key cannot call the Cursor Admin API. | The key lacks the admin:* scope | Create a team key with the admin:* scope |
| Cursor refused this key because the Admin API is not available on this team's plan. | Your Cursor plan has no Admin API | Change your Cursor plan |
| This API key is already connected as "…". | The key is already connected to this CloudYali account | Find that team on the Connected tab |
| A Cursor account with this name is already connected. | The name is taken | Choose another name |
| This API key is already connected. | When replacing a key: another connection already uses it | Use another key |
| Cursor is rate-limiting requests for this key. Try again in a minute. | Cursor limited the requests | Wait a minute and try again |
| Could not reach Cursor to validate the key. Try again shortly. | Cursor did not answer in time | Try again |
| Cursor account not found. | When replacing a key: the connection was removed | Reload the page |
| Secure key storage is unavailable. Please try again later. or Something went wrong. Please try again. | CloudYali could not store the key or save the connection | Try again; contact support if it repeats |
Fastly
| What you see | Cause | Fix |
|---|---|---|
| A Fastly API token is at least 32 characters — check you copied all of it. | Part of the token is missing | Copy the whole token |
| That name is already in use | Another Fastly connection has that name; Connect stays greyed out | Choose another name |
| Failed to validate API key with Fastly. | The token lacks Global:Read scope or the Billing role, or was revoked; or Fastly is down | Create a token with Global:Read and the Billing role; if it is correct, try again later |
| Internal server error or Failed to create account in database | CloudYali could not store the token or save the connection | Try again; contact support if it repeats |
Give each Fastly connection a clearly different name: two names that differ only in spaces or
punctuation, such as Prod EU and prod-eu, are treated as the same, and the second replaces the first
one's token.
Still stuck
Email support@cloudyali.io with the provider, the step you were on, the message as shown, and the time. Do not send keys, secrets or key files.
Related
Was this page helpful?