# Troubleshooting

Solutions for common issues with authentication, scanning, issue creation, and commands.

Common problems and how to solve them.

## See what the scan did

Every run writes a **job summary** (open the workflow run and scroll down) with the number of findings per rule, which ones get issues on your plan, and the estimated savings.

For more detail, set `LEFTSIZE_DEBUG` on the scan step and run the workflow again:

```yaml
- name: Run LeftSize Scan
  id: leftsize
  uses: leftsize/leftsize-action@v1
  env:
    LEFTSIZE_DEBUG: true
  with:
    # ...
```

This logs Cloud Custodian's output, including which rules failed (for example because of a missing permission), and the LeftSize API's response. `verbose: true` adds more logging but doesn't show these.

## Scan workflow fails

### Authentication error (Azure)

**Symptom**: the Azure Login step fails with "AADSTS700016", "AADSTS70021" or a "federated credential" error.

1. **Federated credential doesn't match.** The organization, repository and branch in the federated credential must match the workflow run exactly. Scheduled runs use the default branch.
2. **Wrong secret values.** `AZURE_CLIENT_ID_MAIN` must be the Application (client) ID, not the Object ID. `AZURE_TENANT_ID` is the Directory (tenant) ID.
3. **App Registration deleted or disabled.** Check that it still exists in Microsoft Entra ID.

### Authentication error (AWS)

**Symptom**: the AWS Login step fails with "Not authorized to perform sts:AssumeRoleWithWebIdentity".

1. **Trust policy doesn't match.** The `sub` condition must match the run, for example `repo:YOUR_ORG/YOUR_REPO:ref:refs/heads/main` for the default branch.
2. **OIDC provider missing.** Check that the GitHub Actions OIDC provider exists in IAM > Identity providers.
3. **Wrong role ARN.** `AWS_ROLE_ARN_MAIN` must be the full ARN, for example `arn:aws:iam::123456789012:role/LeftSize-GitHub-Action`.
4. **Missing permission.** The workflow needs `permissions: id-token: write`.

### The scan step fails before scanning

The action checks its inputs first and stops with an error if one is wrong:

- `Invalid installation-id format`: `LEFTSIZE_INSTALLATION_ID` must be a number.
- `Invalid repository-token format`: `LEFTSIZE_REPOSITORY_TOKEN` must be the GUID from onboarding.
- `Invalid AWS region(s)`: `AWS_REGIONS` must be region names such as `eu-west-1`, or `all`.
- `Unknown policy category`: `include-policies` accepts `cost-optimization`, `deprecation`, `governance` and `security`.

### No findings after a successful scan

- Your infrastructure has nothing the rules flag.
- The scan looked at the wrong place. On AWS, only the regions in `AWS_REGIONS` are scanned (the login region if it's empty). On Azure, only the subscription the login step signs in to is scanned.
- Metrics haven't built up yet. Usage rules look at the last 7 or 14 days of CloudWatch or Azure Monitor data, and most cost rules skip recently created resources.
- Permissions are missing. Rules that can't read what they need find nothing. Use `LEFTSIZE_DEBUG` to see which rules failed.

### The summary shows `findings-submitted: false`

- **The scan found nothing.** With zero findings there is nothing to send, so this is normal.
- **The repository limit is reached.** The job summary shows "Repository Limit Reached" and the workflow doesn't fail. See [Repository limit reached](#repository-limit-reached).
- **The daily submission limit is reached.** An installation can send 20 scan results per day (UTC), across all its repositories and matrix jobs. Further runs that day fail with "Daily submission limit of 20 reached". Run scans once a day, as the generated workflow does.
- **The LeftSize API couldn't be reached or rejected the request.** Then the scan step fails. Check that `LEFTSIZE_INSTALLATION_ID` and `LEFTSIZE_REPOSITORY_TOKEN` are set for this repository, and run the workflow again.

## Issue-related problems

### No issues created after a scan

- **Free plan and a paid rule.** On the Free plan, only cost optimization rules get issues. The job summary lists the other findings under "Team Findings".
- **Issues are turned off.** Enable them under Settings > General > Features > Issues. Findings are stored in the meantime, and issues appear after the next scan.
- **The issue was closed before.** LeftSize doesn't reopen a closed issue or open a new one for the same rule and scope (except after a snooze). Search the closed issues to find it.
- **Processing takes a moment.** Issues appear a minute or two after the scan finishes.

### An issue is still open after I fixed the resources

LeftSize doesn't close issues itself. Close the issue when you've fixed the resources. If you fixed only some of them, the next scan updates the issue to list the rest.

### A snoozed issue came back

That's how snooze works. After the snooze period, the next scan that still finds the problem reopens the issue. To dismiss it for good, use `@leftsize ignore`.

### Two issues for what looks like the same problem

Issues are grouped by rule and scope. The same rule in two Azure resource groups, two AWS regions or two accounts gives two issues.

### Commands not responding

1. Commands only work on issues LeftSize created.
2. Only newly posted comments count. Editing a comment doesn't run its command again.
3. Only the first `@leftsize` command in a comment runs.
4. Allow a few seconds for the reply.
5. Check the syntax in [Commands](commands.md).

## Plan and billing

### Repository limit reached

The Free plan covers 3 repositories and Team covers 10. A repository counts once it has sent scan results. When an extra repository runs a scan, the job summary shows "Repository Limit Reached" and its findings aren't stored. Repositories that were already scanned keep working.

To scan more repositories, see [leftsize.com/#pricing](https://leftsize.com/#pricing) and email [hi@leftsize.com](mailto:hi@leftsize.com) to upgrade.

## Getting help

If your problem isn't covered here:

1. Check the [FAQ](faq.md)
2. Use the **Need help?** form on this site, or email [support@leftsize.com](mailto:support@leftsize.com)
3. Open an issue in [LeftSize/leftsize-action](https://github.com/LeftSize/leftsize-action/issues) for bugs in the action