Topic87 problems· 6 reviewed

Identity and Access Management

87 incident problems about Identity and Access Management. Start with the reviewed ones.

Read first

How to split IAM, TLS, and WAF failures into a security operations flowAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when authentication, authorization, certificate, WAF, and audit log signals mix together and look like a single access failure.Security3 min read How to isolate an mTLS trust bundle mismatchAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when the client certificate, server certificate, CA bundle, and sidecar reload timing differ and the handshake fails.Security3 min read How to safely diagnose a WAF 403 false positiveAn InfraTree guide that lays out the first signals to check, the CLI verification order, common misdiagnoses, and a safe recovery path when it looks like a permissions problem but a specific header, payload, or rule group is blocking legitimate requests.Security3 min read

Recommended problems

Reviewed problems first, then problems with detailed scenarios.

SECURITY-001The SSH management path is blocked after an overly narrow allowlist changeA situation where the access-control policy looks correct, but one jump-host range is missing, so the actual operations management path is blocked.ReviewedSecurityBeginner16 minFree SECURITY-005IAM role rotation leaves one batch worker using stale credentialsMost services refresh correctly, but one worker process keeps using cached credentials and starts failing scheduled jobs.ReviewedSecurityIntermediate20 minPro SECURITY-016MFA enforcement skipped for legacy admin endpointMFA enforcement skipped for legacy admin endpoint is a hands-on troubleshooting drill. The main login path correctly enforces MFA, but a secondary admin route still accepts a weaker path. Identity and Access Management needs to be checked by narrowing scope, recent change, and...ReviewedSecurityBeginner14 minFree SECURITY-025Locked-down file permission hides SSH authorized_keys from user sessionLocked-down file permission hides SSH authorized_keys from user session is a hands-on troubleshooting drill. The authorized key exists, but the home directory ownership or mode makes the SSH daemon ignore it. Identity and Access Management needs to be checked by narrowing scop...ReviewedSecurityBeginner14 minFree SECURITY-056Secrets Manager rotation updates the writer credential but read replicas still use the old secretRotation completes successfully on the primary path, yet one read-side workload keeps failing because its secret retrieval or cache path was never included in the rotation design.ReviewedSecurityIntermediate21 minFree SECURITY-058OAuth device code session remains active after user offboardingThe user account is disabled, but a previously authorized device code flow keeps working because token revocation and downstream session invalidation were not linked tightly enough.ReviewedSecurityIntermediate20 minFree

All problems (87)

SECURITY-058OAuth device code session remains active after user offboardingThe user account is disabled, but a previously authorized device code flow keeps working because token revocation and downstream session invalidation were not linked tightly enough.ReviewedSecurityIntermediate20 minFree SECURITY-056Secrets Manager rotation updates the writer credential but read replicas still use the old secretRotation completes successfully on the primary path, yet one read-side workload keeps failing because its secret retrieval or cache path was never included in the rotation design.ReviewedSecurityIntermediate21 minFree SECURITY-001The SSH management path is blocked after an overly narrow allowlist changeA situation where the access-control policy looks correct, but one jump-host range is missing, so the actual operations management path is blocked.ReviewedSecurityBeginner16 minFree SECURITY-025Locked-down file permission hides SSH authorized_keys from user sessionLocked-down file permission hides SSH authorized_keys from user session is a hands-on troubleshooting drill. The authorized key exists, but the home directory ownership or mode makes the SSH daemon ignore it. Identity and Access Management needs to be checked by narrowing scop...ReviewedSecurityBeginner14 minFree SECURITY-016MFA enforcement skipped for legacy admin endpointMFA enforcement skipped for legacy admin endpoint is a hands-on troubleshooting drill. The main login path correctly enforces MFA, but a secondary admin route still accepts a weaker path. Identity and Access Management needs to be checked by narrowing scope, recent change, and...ReviewedSecurityBeginner14 minFree SECURITY-039S3 server access log archive fails after object ownership policy changedCentral logging was working until bucket ownership controls changed, and now write attempts fail even though the destination bucket still exists and the prefix is correct.SecurityIntermediate19 minFree SECURITY-097Conditional access trusts the compliant device claim but the token was minted before the device fell out of complianceThe policy is sound, yet a risky session survives because token lifetime outlasts the compliance state transition the team expected to revoke it instantly.SecurityIntermediate15 minFree SECURITY-086Federated logout succeeds in the IdP but leaves the local admin session alive on the legacy appThe user appears signed out globally, but the legacy admin panel still accepts requests because its local session invalidation is not coupled to federation logout.SecurityIntermediate16 minFree SECURITY-068MFA-enforced sudo flow breaks non-interactive automation on one hostThe stronger policy is correct for humans, but the service account path now fails because the exempt automation group was never applied consistently.SecurityIntermediate16 minFree SECURITY-071OAuth login fails after a vanity-domain cutoverThe app and IdP are healthy, but authentication loops because the new branded callback path does not exactly match the registered redirect URI set.SecurityIntermediate16 minFree SECURITY-076EKS IRSA token file becomes unreadable after a sidecar changes the shared volume ownershipThe role mapping is correct, but the application cannot assume it because the projected token path no longer matches the runtime user permissions after a sidecar update.SecurityIntermediate17 minFree SECURITY-059Conditional access blocks the break-glass admin path during a device compliance incidentThe stronger policy makes sense normally, but the emergency access route now fails because it was never carved out from the same device compliance requirements.SecurityIntermediate18 minFree SECURITY-036IMDSv1 remains reachable on a standby node after hardening rolloutPrimary instances were hardened correctly, but a rarely used standby or replacement path still exposes the older metadata service behavior.SecurityIntermediate18 minFree SECURITY-010Password policy update breaks automation account loginA stronger policy is applied broadly, but one unattended account still uses the old credential pattern and starts failing.SecurityBeginner13 minFree SECURITY-007Fail2ban blocks internal health checks after noisy auth failuresA brute-force defense rule works, but its source grouping catches internal monitoring traffic by mistake.SecurityBeginner15 minFree SECURITY-035Identity provider session expires before a long-running admin workflow finishesThe user signs in successfully and starts a privileged operation, but the background confirmation step fails because the IdP session duration is shorter than the workflow window.SecurityBeginner17 minFree SECURITY-061SAML login fails after an IdP migrationThe IdP is reachable and the assertion is signed, but the application still rejects login because the expected identity field changed during the migration.SecurityIntermediate18 minFree SECURITY-028CSP header blocks internal admin tool script after hardeningCSP header blocks internal admin tool script is a hands-on troubleshooting drill. A new browser security policy helps overall, but one internal tool script source was never added and breaks the page. Azure Identity and Access Management needs to be checked by narrowing scope,...SecurityBeginner13 minFree SECURITY-019Nginx basic auth protects one path but leaves upload endpoint openNginx basic auth protects one path but leaves upload endpoint open is a hands-on troubleshooting drill. The visible admin page is protected, but an adjacent upload route bypasses the same security control. NGINX Identity and Access Management needs to be checked by narrowing s...SecurityBeginner13 minFree SECURITY-004Sudo policy grants command access but denies required shell pathThe command is technically allowed, yet execution still fails because the wrapper path differs from the approved binary.SecurityBeginner14 minFree