[VMC on AWS] Unable to create a VMware Cloud on AWS cloud account in Cloud Assembly

Products

• VMware Cloud on AWS

Issue/Introduction

This article provides information on how to resolve issues if you are unable to add a VMware Cloud on AWS cloud account in Cloud Assembly.

Symptoms:
When a user attempts to create a VMware Cloud on AWS cloud account in Cloud Assembly, the system is unable to validate user's credential with the following message.

Unable to validate the provided access credentials: Failed to validate credentials. AdapterReference: http://public-cloud-service:9000/provisioning/vmc/endpoint-config-adapter. Error: Error for endpoint type 'nsxp': Failed to validate credentials. AdapterReference: http://private-cloud-gateway:8000/provisioning/nsxp/endpoint-config-adapter. Error: Failed to connect to VMC NSX-T Policy endpoint: java.lang.RuntimeException: Cannot execute request Cloud account: null Task: /provisioning/endpoint-tasks/########-####-####-####-########52d2

Cause

Network traffic between cloud proxy and VMC is not allowed, resulting in an authentication error.

Resolution

Before you add a VMware Cloud on AWS cloud account, you must configure management gateway firewall rules in the VMware Cloud on AWS console to support cloud proxy communication.

1. Allow network traffic to ESXi for HTTPS (TCP 443) services to the discovered IP address of the cloud proxy 
2. Allow network traffic to vCenter for ICMP (All ICMP), SSO (TCP 7444), and HTTPS (TCP 443) services to the discovered IP address of the cloud proxy
3. Allow network traffic to the NSX-T Manager for HTTPS (TCP 443) services to the discovered IP address of the cloud proxy

Additional Information

Configure a basic VMware Cloud on AWS workflow in Cloud Assembly
https://docs.vmware.com/en/VMware-Cloud-Assembly/services/Using-and-Managing/GUID-44A456E2-EC0F-465E-9561-FBA62658032D.html