PUBLIC INCIDENT INDEX · ANSWERS PROTECTED
Cloud troubleshooting practice built around the evidence.
Browse the failure symptoms and known-good baselines Google can index. The decisive evidence, choices, diagnosis, recovery, and postmortem stay inside the simulator.
10 PRACTICE TRACKS
Choose the system that usually breaks first.
Each track contains five public briefs and links into the complete 500-incident library.
AWS networking incident practice
Practice isolating failures across VPC routes, NACLs, security groups, load balancers, DNS, NAT gateways, and private endpoints.
Open track →05 BRIEFSAWS EC2 and Auto Scaling incident practice
Work through EC2, Auto Scaling, launch-template, cloud-init, IMDSv2, burst-credit, and EBS attachment failures.
Open track →05 BRIEFSAWS storage incident practice
Practice S3, KMS, EBS, lifecycle, versioning, and storage-cost investigations through production-style incident briefs.
Open track →05 BRIEFSAWS IAM and identity incident practice
Train on IAM policy evaluation, SCPs, permissions boundaries, KMS policies, STS sessions, and secret rotation failures.
Open track →05 BRIEFSTerraform incident practice
Practice remote-state, provider, resource-address, dependency-graph, and refactor incidents without risking a real cloud account.
Open track →05 BRIEFSLinux production incident practice
Investigate filesystem, memory, systemd, permissions, and time-synchronization failures in realistic service contexts.
Open track →05 BRIEFSDocker and ECS incident practice
Practice registry, health-check, CPU quota, read-only filesystem, and image-architecture failures across Docker and ECS.
Open track →05 BRIEFSKubernetes and EKS incident practice
Train on CrashLoopBackOff, ImagePullBackOff, storage claims, Service selectors, and disruption-budget failures.
Open track →05 BRIEFSCI/CD and GitOps incident practice
Practice artifact integrity, OIDC federation, GitOps reconciliation, Helm rendering, and database-aware rollback decisions.
Open track →05 BRIEFSSRE and data incident practice
Investigate replica lag, cache churn, dead-letter queues, alert silences, and retry storms through evidence-led scenarios.
Open track →SEARCHABLE FIELD INDEX
50 production-style incident briefs.
Every page gives you enough context to judge relevance without disclosing the answer.
Return traffic disappears
VPC · NACL
intermittent HTTPS timeouts from public clientsDNS points to yesterday
Route 53 · ALB
some clients reach a retired load balancerThe one-way load balancer
ALB · Security Groups
load-balancer requests time out although instances answer locallyThe NAT runs out of sockets
NAT Gateway · VPC
private workloads intermittently fail outbound dependency callsThe endpoint black hole
VPC Endpoint · S3
private subnets lose access to S3 while other AWS APIs still workThe launch template references a ghost
EC2 · Auto Scaling
an Auto Scaling group cannot replace unhealthy instancesBootstrap never finishes
EC2 · cloud-init
new instances launch but never join the serviceBurst credits hit zero
EC2 · CloudWatch
latency climbs while CPU appears pinned at a low ceilingMetadata hardening breaks startup
EC2 · IMDSv2
new instances cannot retrieve startup credentialsThe volume changes its name
EC2 · EBS
an application starts with an empty data directory after instance replacementKMS allows the bucket, not the reader
S3 · KMS
authorized users can list objects but cannot download encrypted contentDeleted but still there
S3 · Versioning
a previously available object now returns 404 after cleanupLifecycle freezes hot data
S3 · Glacier
a batch job cannot immediately read recently archived objectsThe EBS burst bucket empties
EBS · EC2
disk latency spikes during sustained writes without a volume failureMultipart uploads never leave
S3 · Cost
storage charges rise even though visible object count is stableThe invisible organization deny
IAM · Organizations
an administrator role is denied a newly required API actionThe boundary wins
IAM · Permissions Boundary
a role receives AccessDenied despite a newly attached allow policyThe token expires mid-deploy
STS · CI/CD
a long deployment succeeds initially and then receives ExpiredTokenThe key policy veto
KMS · IAM
a role with kms:Decrypt in IAM still cannot use the keyRotation changes half the system
Secrets Manager · Application
new connections authenticate while pooled connections begin failing unpredictablyThe lock outlives the job
Terraform · Remote State
every Terraform plan fails with a state-lock acquisition errorThe provider changes the plan
Terraform · Provider
an unchanged configuration suddenly proposes broad replacementsCount shifts every address
Terraform · AWS
removing one list item causes Terraform to replace unrelated resourcesThe dependency circle
Terraform · Modules
Terraform cannot construct a plan because resources form a cycleRefactor becomes replacement
Terraform · State
a code-only resource rename proposes destroy and createFree space, no files
Linux · Filesystems
writes fail with no space left although disk capacity remainsThe kernel chooses a victim
Linux · Memory
a service disappears without a normal application shutdownThe variable systemd never saw
Linux · systemd
a service works in an interactive shell but fails under systemdDeploy changes the owner
Linux · Permissions
the application receives permission denied on its own runtime directoryTime breaks trust
Linux · NTP
signed API requests and TLS validations fail only on one hostThe registry rejects the node
ECR · ECS
new tasks remain in image-pull failure while old tasks runHealth check calls a missing tool
Docker · ECS
containers serve traffic briefly but are repeatedly marked unhealthyCPU quota becomes latency
Containers · Linux
container latency spikes while host CPU still has idle capacityRead-only means read-only
Docker · Security
a hardened container exits when creating a temporary fileThe image speaks the wrong architecture
Docker · EC2
a container exits immediately with exec format errorConfigMap triggers a crash loop
Kubernetes · ConfigMap
new Pods cycle through CrashLoopBackOff after a configuration rolloutThe image cannot be pulled
Kubernetes · Registry
Pods remain in ImagePullBackOff after a releaseThe claim waits for storage
Kubernetes · EBS CSI
stateful Pods remain Pending with unbound persistent-volume claimsThe Service selects nobody
Kubernetes · Service
a Service has no endpoints although Pods report ReadyThe disruption budget blocks maintenance
Kubernetes · PDB
node drain stalls because healthy Pods cannot be evictedThe pipeline deploys an old artifact
CI/CD · Artifacts
a successful deployment runs code from a previous commitOIDC presents the wrong audience
CI/CD · OIDC
a CI job cannot exchange its OIDC token for cloud credentialsGitOps keeps undoing the fix
Argo CD · Kubernetes
an emergency cluster edit is reverted within minutesHelm turns a number into a string
Helm · Kubernetes
a release fails validation despite apparently correct valuesRollback meets an irreversible migration
CI/CD · Database
application rollback fails after a database schema deploymentReplica lag serves stale truth
RDS · Replication
users read stale data immediately after successful writesThe cache evicts the hot set
Redis · Application
database load and latency surge while cache availability remains greenMessages flood the dead-letter queue
SQS · Lambda
the primary queue drains while failed messages accumulate rapidlyThe silence hides the outage
Alerting · SRE
customers report an outage before the on-call receives any pageRetries become the outage
SRE · Distributed Systems
a small dependency slowdown grows into fleet-wide saturationREADING IS NOT RESPONDING
Make the call before the answer appears.
Start with three free simulations, then unlock 100 or 500 incidents for lifetime practice.
Enter the simulator →