AccessDenied at 3AM Debugging Lab

AccessDenied at 3AMSecrets & AuthMediumPreparing

00:00

Incident Dossier

AccessDenied at 3AM

A nightly export starts failing after credential rotation. The object path is valid, but the runtime still receives credentials that no longer authorize access.

Initial failing signalRotated credential should allow object readExpected behavior: read allowed with STORAGE_ROLE=object-reader · actual behavior: AccessDenied: role legacy-reader cannot read reports/daily.json

Progress

1Reproduce the bugRun checks

2Edit the fixOpen

3Pass checksOpen

4Submit fixOpen

Reproduction Steps

Run npm test.
Inspect the failing storage request and the code that supplies its credentials.
Trace the configured role from the process environment to the storage client.
Make the smallest correction that preserves fail-closed behavior.

Focus Mode

Start

src/storage.js

Likely area

src/storage.js

Challenge Coach

Hints reveal broad direction first, then narrow toward the suspect path without showing hidden tests or exact solution code.

TopicSecrets & Auth

DifficultyMedium

Est. time22 min

Workspacepreparing

Explorer

Loading files

Evidence Map

Failing signal loaded from challenge API
Workspace files loaded from workspace API
Results rendered only after API run/submit

Autosaved

workspace

Outputread-onlyready$ prepare workspace

Preparing workspace