Template: case

Symptom

What the user, the alarm or the log shows, in one or two sentences. Quote the real error text.

Read the error first

The error message already tells you a lot. Before guessing, answer three questions:

1. Which service wrote the error? (ECS, IAM, S3, the API itself, …)
2. Which kind of “no” is it? “no identity-based policy allows” means nobody gave the permission. “with an explicit deny” means something took it away. A wrong password is not an IAM problem at all.
3. Is it Reach, Allowed or Password? Can the packet get there? Is the caller allowed? Is the secret right?

Decide

flowchart TD
  start[The symptom] --> q1{First question}
  q1 -- yes --> causeA[Cause A]
  q1 -- no --> q2{Second question}
  q2 -- yes --> causeB[Cause B]
  q2 -- no --> causeC[Cause C]

Likely causes

Ranked, most likely first.

1. The most common cause, and why it is the most common.
2. The next one.
3. The rare one that costs the most time.

How to check

Console

Where to click, and what to look for.

CLI

Read-only commands only.

CloudTrail

Which event name to search for, and which field gives the answer.

Fix

The smallest change that fixes it, and where it lives in the code.

Prevent

What stops it from happening again: a check, an alarm, a test or a rule.

Say it in 30 seconds

Say it like this (20-30 seconds)

Write 50 to 75 words: the symptom, how you read the error, the cause you found, the fix, and what you changed so it cannot happen again.

Advanced: the full story

Optional: the timeline, the real numbers, and what we learned.