Overview

When a CD4P operation fails or behaves unexpectedly, navigate to the Operations page in DCT. All CD4P lifecycle operations (provision, refresh, snapshot, deprovision, reprovision) are asynchronous and tracked there. The operation record includes status, error messages, and metadata that pinpoint the failure point. Use the guidance in the sections below to resolve common issues. For deeper diagnosis, see Advanced diagnostics at the end of this page.

Cloud Account issues

No resources discovered after creating a Cloud Account

If the Cloud Account shows CONNECTION_ERROR or no PaaS Instances appear after discovery:

  • Verify that the region value entered in the wizard exactly matches the region where your instances reside. A mismatch will return zero results with no error.

  • For AWS: confirm the IAM access key ID and secret are valid and not expired. Managed identity authentication (IAM instance roles, EKS IRSA, ECS task roles) is not supported — a static access key is required.

  • For Azure: confirm the Entra ID application credentials (client ID, tenant ID, client secret) are correct and that the application has the required API permissions.

  • Confirm that DCT has outbound HTTPS access to the cloud provider API endpoints from its network location.

Cloud Account shows CONNECTION_ERROR after previously working

A CONNECTION_ERROR after a period of successful operation typically indicates:

  • The IAM access key or Entra ID client secret has been rotated or expired.

  • A network change has blocked DCT’s outbound access to cloud provider APIs.

  • Cloud provider service disruption in the configured region.

Update the Cloud Account credentials if the key has been rotated, then wait for the next discovery cycle or manually trigger a refresh.

Operation failures

Provision or Refresh fails

Check the job record for the specific error. Common causes include:

  • The selected point in time falls outside the cloud provider’s available restore window. For timestamp-based operations (PITR), the timestamp must be between the earliest restore point and the latest restorable time reported by the cloud provider.

  • The target Cloud Account does not have sufficient IAM or Entra ID permissions to create the resource type. Review the permissions list in Requirements and Architecture.

  • For Azure: the Azure Blob Storage Account is unavailable, misconfigured, or in a different region than the target Managed Instance.

Snapshot (Bookmark creation) fails

Bookmark creation requires a DCT-managed snapshot to be taken. If the operation fails:

  • Confirm the instance or database is in RUNNING or STOPPED status. Snapshot operations are not available on DEPROVISIONED or CREATING resources.

  • Confirm the snapshot name is unique for the instance or database. Duplicate snapshot names will cause the operation to fail.

  • Review the bookmarks container logs for snapshot tracking errors.

Automated backups discovered from the cloud provider cannot be used as bookmark sources. Only DCT-managed snapshots are eligible.

Deprovision or Reprovision fails

For Deprovision:

  • The target must be in DCT_MANAGED status. Discovered (unmanaged) resources cannot be deprovisioned through DCT.

For Reprovision:

  • The target must be in DEPROVISIONED or FAILED status.

  • The selected snapshot or point-in-time must still be within the cloud provider’s available restore window.

AWS RDS-specific issues

Authentication fails or Cloud Account shows CONNECTION_ERROR

AWS authentication with DCT requires a static IAM access key. If the Cloud Account shows CONNECTION_ERROR or credential errors:

  • IAM managed identities (instance roles, EKS IRSA, ECS task roles) are not supported. A static IAM access key ID and secret access key must be provided.

  • Verify the access key has not been rotated or deactivated in the AWS IAM console. If the key has been rotated, update the Cloud Account credentials in DCT.

  • A single IAM access key can be used across multiple AWS regions. If managing databases in multiple regions, confirm the correct region is set on each Cloud Account — credentials do not need to differ by region.

  • If the session token field was populated, remove it. Session tokens are temporary STS credentials intended for development and testing. Long-lived IAM access keys should be used in production, and the session token field should be left empty.

Provision or Refresh fails with permissions error

If AWS operations fail with access denied errors, verify the IAM user has all required operational permissions. Discovery-only permissions are not sufficient for provisioning, refresh, or snapshot operations. Refer to the IAM permissions list in Requirements and Architecture and confirm all operational permissions are attached to the IAM user in the target account.

Automated backup window not reflected in timeline

DCT discovers AWS automated backups during each telemetry cycle and displays them in the instance timeline. If expected backups are not appearing:

  • Confirm the IAM user has rds:DescribeDBInstanceAutomatedBackups permission. Without this, automated backup history will not be discovered.

  • Automated backups older than the AWS-configured retention period will not appear — they are not stored by AWS and cannot be recovered. Only backups within the active retention window are discoverable.

Azure-specific issues

Operations fail with JDBC connectivity errors

Unlike AWS RDS, DCT connects directly to Azure SQL Managed Instance databases over JDBC for operations including snapshot and provision from snapshot. If JDBC connectivity fails:

  • Confirm that the network security group allows inbound traffic from the DCT deployment on the managed instance’s public endpoint port (default 3342).

  • Verify that SQL authentication credentials (admin_username and admin_password) or Entra ID authentication is correctly configured on the instance.

Backup or snapshot operations fail

Azure SQL MI operations that use backup storage may fail if:

  • The Azure Blob Storage Account or container is unavailable or has been deleted.

  • The storage account is in a different region than the managed instance. Both must be in the same region.

  • The Entra ID application does not have write permission to the storage container.

Performance expectations

CD4P operations are bounded by cloud provider API performance. The following guidance sets expectations for operation duration:

Operation Expected duration
Snapshot creation ~1 TB / 4 hours (cloud provider dependent).
Provision from snapshot Minutes (faster than snapshot creation, but varies by database size).
Provision from PITR (timestamp) Minutes to tens of minutes depending on restore range.
Refresh Similar to Provision — restores from backup or snapshot.
Deprovision Seconds to minutes (cloud resource deletion).
Reprovision Similar to Provision.

These are approximate values based on internal testing. Actual performance depends on cloud provider load, region, database size, and instance type.

Contact and support

For support, visit the Delphix Support Portal. When submitting a request, include a support bundle, the DCT version, and any error messages to expedite troubleshooting.

Last updated
Oct 8, 2026