S3 · KMS · Advanced
KMS allows the bucket, not the reader
Authorized users can list objects but cannot download encrypted content.
INITIAL ALERT
Authorized users can list objects but cannot download encrypted content.
You are primary on-call. Establish the failure domain, protect healthy capacity, and choose the safest next action.
S3 GetObject is allowed and the object key exists.
The decisive evidence and solution remain locked inside the simulation.WHAT THIS TESTS
Production judgment across S3 · KMS.
Storage can be available while data is unreadable, unexpectedly archived, throttled, or quietly accumulating cost. The evidence lives across service state and policy layers.
- 01Separate availability from data access
- 02Inspect encryption and lifecycle controls
- 03Balance recovery, durability, and cost
SIMULATION STRUCTURE
Four evidence layers. No answer shown here.
The full exercise unlocks each layer as you commit to decisions.
Alert
Confirm the reported symptom and customer impact.
Baseline
Compare the failing path with a known-good condition.
Finding
Identify the evidence that separates plausible causes.
Change
Choose a controlled recovery and a durable prevention step.
Can you make the call without seeing the solution?
Try three incidents free. Paid incidents unlock only after Stripe confirms lifetime access.