Skip to Content
IntegrationsAPNUpdating the connector

Updating the APN connector

Sometimes FlowState changes the connector template. A connector that you deployed before such a change keeps its old version until you deploy it again. This page lists the changes that need action, and how to update.

Changes that need action

Deployed beforeWhat changedWhat happens if you do not update
29 September 2026The connector creates a catalog lock, and the role can read it. The template has two new parameters: TenantId and FlowstateStage (OpenTofu: tenant_id and flowstate_stage).APN sync keeps running. But a new connection or connection test fails with APN_CATALOG_LOCK_MISSING or APN_CATALOG_LOCK_UNREADABLE.
23 August 2026The trust policy lists one more FlowState principal, used by the MCP server.The MCP tools enable_apn_integration and test_apn_connection fail with AccessDenied. The FlowState web app keeps working.

To see which version you have, open IAM → Roles → FlowStateAPNConnector<Catalog> in your AWS account:

  • Trust relationships: compare the ARNs under Principal.AWS with the list in the wizard. If yours is shorter, update.
  • Permissions: if there is no ReadCatalogLock policy, update.

Update the connector

Deploy the same connector again, in the same way as before. The role, its ARN, the ExternalId and the catalog stay the same. APN sync is not interrupted, and you do not need to reconnect.

To see the current values, go to Settings → Integrations → APN and click Show connector values: the ExternalId, your tenant ID and FlowState stage, the catalog lock and every FlowState principal with what it does. You need the tenant owner or admin role. Over MCP, get_apn_onboarding_artifacts returns the same values. To get a new CloudFormation link or OpenTofu snippet, open the wizard: add /connect to the page address in your browser, and read the Deploy module step. Do not click Test connection in the wizard, because it connects again.

CloudFormation

  1. In the AWS console, go to CloudFormation in us-east-1 and select your APN connector stack.
  2. Click Update, choose to replace the current template, and enter the address of the current apn-connector.yaml template. The wizard’s Launch in AWS Console link contains this address after templateURL=.
  3. Keep the existing parameter values. Set FlowstatePrincipalArns, TenantId and FlowstateStage to the values from the wizard.
  4. Select the IAM check box and finish the update.

Result: the stack status is UPDATE_COMPLETE. The update adds the catalog lock and the ReadCatalogLock policy, and replaces the principal list.

OpenTofu with the published module

  1. In your module block, set flowstate_principal_arns, tenant_id and flowstate_stage to the values from the wizard. flowstate_principal_arns is a list.
  2. Run tofu init -upgrade && tofu apply.

-upgrade is required: it downloads the current module. A plain tofu init keeps the old copy, and tofu apply then reports no changes.

A role you created by hand

Compare it with the values on the Manual tab of the wizard, and change what differs: the principal ARNs in the trust policy, the catalog lock, the inline policies and the EventBridge rule. See Manual (IAM console) connectors.

Check the connection

After the update, run test_apn_connection over MCP. It returns success and your AWS Partner account ID.

If the update fails with AlreadyExists or ParameterAlreadyExists, two connectors in your account claim the same catalog. Contact FlowState support before you change anything. One of the two connections must be disconnected, and we confirm with you which one.

Trust policyDisconnecting