APN troubleshooting

Find the message or symptom that you see, then follow the fix.

AccessDenied on connect

Symptom: after you click Test connection in the wizard, it shows Verification failed with an access-denied error.

Causes and fixes:

The wrong AWS account. You deployed the connector in an account that is not linked to Partner Central. Deploy it in the linked account. Ask your Partner Central Alliance Lead which account that is.
The wrong policy for the catalog. A Sandbox role needs AWSPartnerCentralSandboxFullAccess. A Production role needs AWSPartnerCentralOpportunityManagement. Check that the catalog you chose on the Deploy module step is the catalog of the stack you deployed.
The wrong ExternalId. Open the role in IAM, then Trust relationships. The sts:ExternalId value must match the wizard exactly, with no spaces.
Missing principal ARNs. Principal.AWS must list every ARN that the wizard shows.
A role you created by hand with an older version of the Manual tab. It has no catalog lock. See Manual (IAM console) connectors.

Catalog lock errors

Symptom: Test connection fails with APN_CATALOG_LOCK_MISSING, APN_CATALOG_LOCK_UNREADABLE, APN_CATALOG_LOCK_INVALID, APN_CATALOG_LOCKED_BY_OTHER_STAGE or APN_CATALOG_LOCKED_BY_OTHER_TENANT. Or the deploy fails with AlreadyExists or ParameterAlreadyExists.

Fix: see One catalog, one tenant for what each code means and what to do.

“This AWS account is already connected to another FlowState tenant”

Cause: an AWS account can be connected to one FlowState tenant only, whatever the catalog.

Fix: disconnect APN in the other tenant, then connect again.

“APN is disconnected” on Submit

Cause: the APN integration of your tenant is disconnected. While it is disconnected, FlowState sends nothing to AWS.

Fix: a tenant owner or admin reconnects APN. See Reconnect. Then click Submit again.

The card shows “APN sync failed”

Symptom: the FlowState card shows APN sync failed, and the deal has a Sync failed or Action needed note. The message comes from AWS and names the field.

Common messages and fixes:

Message mentions	Fix
`Project.Title`	Give the deal a name in HubSpot.
`Customer.Account.AwsAccountId`	The APN AWS Account ID property must be a 12-digit AWS account ID.
`LifeCycle.TargetCloseDate`	Set the close date to a date in the future, or move the deal to a closed stage.
`Customer.Account.Industry`	Choose a valid Industry on the Prepare the Deal for APN tab of the card.
`PrimaryNeedsFromAws`	Choose at least one Partner need from AWS on the Prepare the Deal for APN tab.
`STAGE_UNMAPPED`	Map the deal’s stage. See Deal stage mapping.

After the fix, FlowState tries again at the next change to the deal in HubSpot, or at the next scheduled APN sync. To retry one deal at once, run trigger_apn_sync with the deal ID over MCP.

The card stays at “Not yet sent to AWS”

Cause: nobody has requested a submission for the deal. Setting APN Sync with AWS enabled to Yes on its own does not create an opportunity.

Fix: open the Readiness tab on the card and click Submit to AWS. See Submitting opportunities.

The card stays at “Linked to AWS — not yet submitted for review”

Cause: the opportunity exists in Partner Central, but the submission did not finish. The card shows APN sync failed with the reason. A common reason is a missing role in Partner Central: the user that is linked to the AWS account needs the Alliance Lead role.

Fix:

Ask your Partner Central Alliance Lead to check the roles and the AWS account link.
Open the Readiness tab on the card and click Submit to AWS again.

Many deals are waiting

Symptom: Apps → APN → Overview shows many deals under Pending.

Cause: Partner Central accepts only a small number of changes per second for each partner account. FlowState queues the changes and sends them at the rate AWS allows. No action is needed.

To avoid it: when you turn on APN Sync with AWS enabled for many deals, do it in batches of a few hundred deals.

Sync stops for several deals with the same error

Symptom: several deals show the same APN sync failed error, for example access denied.

FlowState does not send an alert for this. Check Apps → APN → Overview from time to time, or list the deal states with list_apn_sync_state over MCP.

Common causes:

Someone changed the trust policy, so the principal ARNs or the ExternalId no longer match.
The trust policy lists fewer principal ARNs than the wizard shows. See Updating the connector.
Someone deleted the connector role or detached its AWS managed policy.

Fix:

Use CloudTrail or IAM Access Analyzer in your AWS account to find the change.
Deploy the connector again with the values from the wizard. See Updating the connector.
Click Test connection on Settings → Integrations → APN, or run test_apn_connection over MCP, to check the connection.
Retry the deals: run trigger_apn_sync with each deal ID, or wait for the next scheduled APN sync.

The link between each deal and its opportunity is kept, so no work is lost.