AWS connector in Defender

Hello @Nadoda, Rijens (CA)

Hey! If your AWS account is showing as connected in Defender for Cloud but you can’t see resources in Inventory after ~30 hours, it’s usually down to one of the onboarding/streaming delays or a connector configuration/permissions issue.

Here are the most relevant things to check based on Defender for Cloud’s cloud connector troubleshooting guidance:

1) Wait for recommendation/inventory streaming delays

Even after onboarding, resources typically appear only after the first security recommendations have streamed in.

• AWS recommendations can take ~10 minutes to stream into Microsoft Defender for Cloud after onboarding.
• If AWS Security Hub was enabled recently, recommendations can take up to a day to stream into Security Hub (then onward).
• If AWS Config rules were enabled recently, recommendations can take up to a day to stream.
• For Inventory specifically: Inventory can take up to 12 hours to refresh from the first recommendation triggered on that resource.

Since you’re at ~30 hours, you may be past the normal delay window—so it’s worth checking connector health and CloudFormation/permissions.

2) Confirm the correct Defender plan is enabled in Defender for Cloud

If you don’t see expected data, make sure the subscription has the right Defender plan enabled:

• Defender for Cloud should have the Servers plan enabled (and you may have “CSPM/foundational CSPM” enabled depending on your setup).
• If the Servers plan isn’t enabled, you can end up with missing inventory/recommendation data.

Also verify permissions:

• The user role on the subscription should be Owner, Contributor, or Security Admin.

3) Check for AWS EC2 onboarding path issues (SSM / Arc dependencies)

If you expect EC2 instances to show up, ensure they’re eligible for onboarding:

• Verify the AWS Systems Manager Agent (SSM) is configured and running.
• Ensure you’re using supported OS versions.
• Verify SPN permissions: the user who created the SPN needs the Owner role (this is a common cause of “connected but no resources showing”).

4) Refresh timing tied to recommendations (not just “connected”)

A key detail: resources with recommendations are what appear in Inventory.

So if recommendations aren’t being produced/ingested from AWS, inventory may remain empty even though the connector says “connected”.

5) Look for CloudFormation / StackSet mismatch (common “no data” cause)

There is a known issue where the StackSet name in AWS doesn’t match what Defender expects.

If you see problems like “Invalid StackSet when onboarding AWS account”, fix it by:

1. Check the StackSet name in AWS (CloudFormation > StackSets > StackSet name).
2. In Defender for Cloud, go to Environment settings and open the connector.
3. Go through Select plans → Next: Configure access.
4. Update the StackSet name to the correct one that exists in AWS.
5. If the StackSet doesn’t exist, rerun the CloudFormation template only for the StackSet portion.

Follow-up questions (so we can pinpoint the exact cause)

1. In Defender for Cloud, what does the AWS connector show under Environment settings—are there any errors or “service principal validation” messages?
2. Is AWS Security Hub and/or AWS Config already enabled before onboarding, or were they enabled right around the same time?
3. In Defender for Cloud, is the Servers plan enabled on the subscription where you onboarded the AWS connector?
4. Are the AWS resources you expect primarily EC2 instances? If yes, do those instances have SSM Agent running?
5. Did onboarding use a management account connector, and does the StackSet name in AWS match the one in the Defender connector settings?

References (documentation)

• Microsoft Defender for Cloud - Troubleshoot cloud connectors (missing inventory/recommendations, streaming delays, permissions, SSM/Arc prerequisites, StackSet mismatch, SPN permissions, etc.) https://learn.microsoft.com/azure/defender-for-cloud/troubleshooting-guide#troubleshooting-the-native-multicloud-connector
• Defender for Cloud - Connect AWS accounts to Microsoft Defender for Cloud (onboarding context) https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-aws
• Defender for Cloud - Quickstart for AWS onboarding https://learn.microsoft.com/azure/defender-for-cloud/quickstart-onboard-aws?pivots=env-settings
• Cloud connectors Q&A / troubleshooting (native multicloud connector issues) https://learn.microsoft.com/azure/defender-for-cloud/troubleshooting-guide#troubleshooting-the-native-multicloud-connector

If you can answer the follow-up questions above (especially connector errors, whether Security Hub/Config were enabled recently, and whether you’re expecting EC2 instances with SSM), we can narrow it down quickly.

Note: This content was drafted with the help of an AI system.

Hello @Nadoda, Rijens (CA) Following up to see if the above provided information was helpful. If you have any further queries do let us know.

Hi Rukmini,

thanks for your response.

Could you please confirm is it is mandatory to enable AWS Security Hub? (If AWS Security Hub was enabled recently, recommendations can take up to a day to stream into Security Hub (then onward).)

To let you know I have only enabled **"**Foundational CSPM".

Thanks

Regards,

Rijens

@Nadoda, Rijens (CA)

In order to onboard an AWS account with Foundational CSPM, AWS Security Hub is not required. However, because Defender for Cloud uses AWS Config data for resource discovery and posture assessments, AWS Config must be enabled and actively recording resources. Please confirm that AWS Config is enabled and that the CloudFormation deployment was successful and error-free if Inventory is still empty after more than 30 hours.

Could you verify that the AWS account and recording resources have AWS Config enabled?

Hello @Nadoda, Rijens (CA)

Following up to see if the above provided information was helpful. If you have any further queries do let us know.