Adding GA4 Connection to AWS AppFlow

amazon-web-servicesgoogle analyticsgoogle-cloud-platform

I am trying to add an AppFlow connection to an existing GA4 account, GA4 is already up and running and even pushing data to BigQuery.

However, when I try to create the connection in Appflow to start a flow from GA4 to Redshift. I get this error message

An error occured while creating the connection ga4.
Error authenticating to connector: Failed to validate Connection while attempting "ValidateCredentials with CustomConnector" with connector failure The request failed because the service Source Google Analytics 4 returned the following error: Details: Google Analytics 4 returned error message - Request failed with Status Code: 403, Error Reason: Forbidden. (Service: null; Status Code: 400; Error Code: Client; Request ID: null; Proxy: null)

Error Message Screenshot

I have followed this documentation. https://docs.aws.amazon.com/appflow/latest/userguide/connectors-google-analytics-4.html

I was able to create a GA UA connection, but it used a slightly different OAuth Configuration.

My GCP App is set to Production and is External, my Google Analytics API is enabled and the OAuth Web Application creds are created, and the Authorized redirect URIs is set to https://us-east-1.console.aws.amazon.com/appflow/oauth as suggested by the documentation.

When I add the clientID and clientSecret to AppFlow's connection and click connect, I get a google login pop up prompt, and when I login in it asks me to allow amazon.com to access my data and pull data etc, which I do allow, then the pop up disappears and the above error pops up in AWS.

GCP OAuth Configuration

Best Answer

I reached out to AWS Support and they told to enable "Google Analytics ADMIN API" in addition to "Google Analytics API". This resolved the issue.

They did mention they are working to update the documentation to mention that both api's need to be enabled.

Related Solutions

Nginx connection reset

In most cases 400 status in access logs like this:

127.0.0.1 - - [09/Nov/2012:16:01:01 +0000] "-" 400 0 "-" "-"

and the message

... [info] ... client prematurely closed connection while reading client request line ...

in nginx error logs is a result of a browser opening extra connection to nginx and closing it without sending any request into it. It is often seen when client's browser is Chrome and there isn't many resources to load on the page requested.

By itself these messages are harmless and not a problem (and that's why the logging level is info). If you see some problem along with these messages - you may want to elaborate more on the problem you have. If you just see the messages - don't be scared, they are harmless.

Ssh – Can’t SSH into the Instance : Connection via Cloud Identity-Aware Proxy Failed

POSSIBLE CASE 1: You have enabled ufw without proper permissions(I did in my earlier days)

If yes you need to add a startup-script in the instance by adding a metadata(by editing the instance) with key startup-script and value

#! /bin/bash
sudo ufw disable

and now when you hard-reset(reset using the reset button in gcp) your VPS it should be ok. and then when its ok you may remove the metadata.

POSSIBLE CASE 2: You have disabled the default-ssh in gcp vpc firewall

If this is the case, still need not worry, simply add a rule and allow port 22 and if you have trouble adding it then simply add tcp port 22 to a existing firewall rule created by default by GCP.

POSSIBLE CASE 3: You have done some changes in IAM that you lost access to gce.

Warning: If you have not touched IAM , Donot edit the IAM unless you really know what you are doing, else unexpected things may occur.

Make Sure you have your email in IAM with role as owner

Hope it helped.

Last Not-so-magical Technique (Dirty Fix):

Warning: If you tried all the above and also tried your best to fix it by your own, but in case if nothing works then only do this.

Create a new PROJECT in gcp and there you need to link the billing account and start over again fresh and everything will be fine.

I know this one is a horrible fix, and thats true , if nothing works and you start to feel you are having a lot of time wasted then only you should consider this fix.

Related Topic