AWS Interaction with SalesForce Failing

Question

I am working with a process that was created by someone else.  10/04/2025 at 1:00am eastern, something happened to the process and it is failing.  I am not intimately familiar with the process so any assistance or direction would be appreciated.

AWS appears to be using OAuth to connect to SalesForce.
In Salesforce, the User Login associated with the process is showing Remote Access 2.0, OAuth Client Credentials, Unknown Exception: 1832.  Integration logs in SalesForce show no attempted runs of the code from AWS.  Last successful connection and run was 10/4/2025 at 00:45am.
In AWS, we have LAMBDA functions and it appears tied to CloudWatch.  When I open one of the log groups tied to a specific Lambda, I am able to view a log for the most recent attempt.  I get basically the following:
[Error] AuthenticationError: [invalid_grant] no valid scopes defined Traceback (most recent call last):...
It appears to try and request an access_token...
  File "/opt/python/lib/python3.12/site-packages/aiosalesforce/auth/client_credentials_flow.py", line 83, in _acquire_new_access_token
    raise AuthenticationError(
Error terminates there without more detail.

I am aware of the code being uploaded to the Lamba is python and nowhere in the code uploaded is a client_credential_flow.py.  Wondering if it is a built  page/library in AWS.

My research so far told me to look in SalesForce for some specifics.  I confirmed the following:
Connected App: Enable OAuth Settings, Require Proof Key for Code Exchange, Require Secret for Web Server, Require secret for Refresh Token, and Enable client credential are all checked.
Policies - IP Relaxation is relax IP restrictions, Refresh token Policy is Immediately expire refresh token, there are No OAuth Custom Scopes defined.

We had an issue a few weeks back with a BOTO3.  AWS updated the BOTO3 and broke this application.  I had to upgrade the BOTO3 to match AWS and republish the code.  I am wondering if something similar has happened again.

Where I am really stuck is where to check things in AWS.  Like how do I know if this is something like the BOTO3 issue where a library updated in AWS.  Or, how to check if the credentials or tokens are correct.  I've burned about 12 hours in google and KB's and don't feel any closer to an answer.  Any assistance or direction would be appreciated.

DMoody · Answer

"Verify that the client ID and client secret being used in your Lambda function match those in the Salesforce Connected App."
Where do I find this in the Lambda?

"Check if there were any recent changes to the Salesforce Connected App settings, especially around OAuth configuration or IP restrictions"
Network Engineer for SalesForce states nothing changed on their end. So leaning toward an AWS change but unsure how to know if they changed anything.

"If you're using AWS Secrets Manager to store Salesforce credentials, verify that the secrets are still valid and accessible by your Lambda function."
How do you confirm this Secrets Manager is linked to a Lambda?

re:Post Agent · Answer

Based on the error message and details you've provided, it appears you're experiencing an OAuth authentication issue between AWS and Salesforce. The specific error "[invalid_grant] no valid scopes defined" suggests there's a problem with the OAuth scopes configuration.

The issue is likely related to the Salesforce Connected App configuration you mentioned, specifically the "No OAuth Custom Scopes defined" part. When using the client credentials flow for OAuth authentication with Salesforce, you need to define appropriate OAuth scopes that specify what permissions your application needs.

Here are some steps to troubleshoot and potentially resolve the issue:

1. In Salesforce, check the Connected App configuration and add appropriate OAuth scopes. Common scopes include "api", "refresh_token", etc., depending on what your application needs to access.

2. Verify that the client ID and client secret being used in your Lambda function match those in the Salesforce Connected App.

3. Check if there were any recent changes to the Salesforce Connected App settings, especially around OAuth configuration or IP restrictions.

4. Look at CloudWatch Logs for the Lambda function to see if there are any additional error details that might provide more context.

5. If you're using AWS Secrets Manager to store Salesforce credentials, verify that the secrets are still valid and accessible by your Lambda function.

6. Check if there have been any recent AWS service updates that might affect the integration, similar to the BOTO3 issue you experienced previously.

The error is coming from the "aiosalesforce" Python library (specifically the client_credentials_flow.py file), which is likely installed as a dependency in your Lambda function. This is not a built-in AWS library but rather a third-party Python package for interacting with Salesforce.

The timing of the failure (1:00 AM on 10/04/2025) could indicate a scheduled token refresh that failed, or possibly a change in either AWS or Salesforce that affected the integration.  
**Sources**  
[how to integrate AWS glue with Salesforce using JWT bearer token | AWS re:Post](https://repost.aws/questions/QUzuM0rXgiRnGTCDHkzG9BYQ/how-to-integrate-aws-glue-with-salesforce-using-jwt-bearer-token)  
[Diagnosing Salesforce IoT input stream action issues - AWS IoT Core](https://docs.aws.amazon.com/iot/latest/developerguide/diagnosing-salesforce.html)

AWS Interaction with SalesForce Failing

Add your answer

Relevant content