Troubleshooting

Consolidated fixes across all clouds. Still stuck? Email contact@venturi.systems with the failing command’s output: onboarding is white-glove.

AWS

Symptom	Most likely cause
Venturi reports “AccessDenied” assuming the role	external_id mismatch: confirm with your onboarding contact.
Venturi reports CUR data is missing	CUR bucket name or prefix doesn’t match terraform.tfvars.
Venturi reports Bedrock data is missing	enable_bedrock_access = false, or Bedrock invocation logging isn’t enabled. See AWS docs.
terraform apply fails on iam:CreateRole	Caller lacks IAM admin. Run as a user with IAMFullAccess or equivalent.

Google Cloud

Symptom	Most likely cause
“unauthorized_client” / “subject not allowed”	wif_allowed_subjects is missing the exact subject Venturi signs with. Exact-string, no wildcards.
BigQuery query returns empty	billing_dataset_id is set but the dataset doesn’t exist or isn’t the billing export. Check bq ls.
Vertex AI logs missing	Cloud Logging exclusion filters are dropping Vertex AI rows before the sink Venturi reads.
terraform apply fails creating the WIF pool	Caller lacks roles/iam.workloadIdentityPoolAdmin. Have an admin grant it, or apply from a CI runner that has it.

Azure

Symptom	Most likely cause
“AADSTS70021” / “no matching federated identity record”	federated_credential_subject mismatch: Venturi’s signing subject doesn’t match the module.
Cost Management returns empty	EA/CSP billing data can require a billing-account, billing-profile, invoice-section, or enrollment scope beyond subscription Reader. Confirm the applicable billing scope during onboarding.
Azure OpenAI usage missing	Inference is going through APIM or an Event Hub; flip the matching enable_* flag and terraform apply.
terraform apply fails on azuread_application	A human caller needs tenant application-registration rights; CI may need Microsoft Graph Application.ReadWrite.OwnedBy with admin consent. Role assignments separately require Owner or User Access Administrator on the subscription.

verify.sh exits non-zero

What happened	Meaning	Do this
An AWS read probe failed (403)	Permission gap: a granted role did not apply	Re-check terraform apply; share the output with Venturi. GCP and Azure positive reads are confirmed during connector activation, not by the current local script.
A write probe succeeded	Security finding: the identity has more than read access	Stop. Do not hand outputs to Venturi; contact your onboarding rep immediately.

Ingestion API

Symptom	Cause
401 Unauthorized	Missing/invalid Authorization: Bearer or X-API-Key.
422 Unprocessable Entity	Payload failed schema validation. Check the required fields (event_id, ingestion_layer, ingestion_timestamp, provider, requested_model) and that estimated_cost_usd is a string.
Event accepted (202) but not in dashboard	Allow ~30s; confirm you’re querying the same tenant/instance.

Proxy

Symptom	Cause
Calls work but aren’t attributed	The proxy records the call but has no identity hint: add the identity header your platform team configured.
Latency concern	The proxy is fail-open on a hard budget; if it’s ever slow it forwards anyway. Report sustained latency to Venturi.

Contact support