IAM policy change blocks service: pre-release and first 30 minutes checklists

A permission change removes a service's access to a queue, bucket or secret.

The pre-release checklist maps each item to a test class from the incident page. The first-30-minutes checklist covers detection, containment, the rollback decision and customer communication.

7 pre-release items · 7 first-30-minutes items · verified 2026-10-21

Pre-release checklist

PR-01Before enabling an account-level public access block, list every bucket that receives public-read uploads and confirm the block does not override their bucket-level ACL policies. config
PR-02Read the infrastructure plan for every bucket policy change and confirm each existing access statement still appears in the planned policy. config
PR-03After a bucket policy change in staging, evaluate the effective policy for the registry service role and confirm it still allows reads of every package format. config
PR-04Run a public-read upload from the scheduler, document and content extraction service roles in a staging account that carries the production account-level settings. config
PR-05Confirm the credentials of every security hardening tool are read-only and cannot change account-level settings in production. config
PR-06Add a synthetic check that runs the test export workflow against production on a schedule and alerts on a failed upload. synthetic
PR-07Add a synthetic check that downloads one package from each repository format and alerts on any 403 response. synthetic

First 30 minutes

FM-01Search service logs and bucket metrics for 403 or access denied responses and record the first timestamp.
FM-02List every policy and account-level permission change in the hours before the first error, including changes made by security tools.
FM-03Group repeated customer reports of the same 403 error into one incident instead of separate per-customer investigations.
FM-04Redeploy the previous bucket policy or revert the account-level setting if its change time precedes the first error.
FM-05Test the fix with the service role that failed, not with a personal workstation credential that may still succeed.
FM-06Post a status update naming the blocked function, such as exports or package downloads, and the time the errors began.
FM-07Freeze further permission changes on the affected account until uploads and downloads succeed again.

Download the checklist

Pre-release checklist (Markdown)1.7 KB · v1.0.0
First 30 minutes checklist (Markdown)1.2 KB · v1.0.0

Only in this checklist

Every test class in this checklist also appears in at least one sibling checklist in the group; the item texts differ: Before enabling an account-level public access block, list every bucket that receives public-read uploads and confirm the block does not override their bucket-level ACL policies.

Questions

What should be checked before a release to prevent IAM policy change blocks service?

7 pre-release items, PR-01 to PR-07. PR-01: Before enabling an account-level public access block, list every bucket that receives public-read uploads and confirm the block does not override their bucket-level ACL policies.

Is there a rollback plan for IAM policy change blocks service?

The first-30-minutes checklist has 7 items. FM-01: Search service logs and bucket metrics for 403 or access denied responses and record the first timestamp.

What should a team do in the first 30 minutes after IAM policy change blocks service is detected?

The first-30-minutes checklist has 7 items. FM-01: Search service logs and bucket metrics for 403 or access denied responses and record the first timestamp.

Which configuration checks apply to IAM policy change blocks service?

PR-01: Before enabling an account-level public access block, list every bucket that receives public-read uploads and confirm the block does not override their bucket-level ACL policies. PR-02: Read the infrastructure plan for every bucket policy change and confirm each existing access statement still appears in the planned policy. PR-03: After a bucket policy change in staging, evaluate the effective policy for the registry service role and confirm it still allows reads of every package format. PR-04: Run a public-read upload from the scheduler, document and content extraction service roles in a staging account that carries the production account-level settings. PR-05: Confirm the credentials of every security hardening tool are read-only and cannot change account-level settings in production.

Is a IAM policy change blocks service checklist still needed if deployment is automated?

Yes. Automation runs the steps; the checklist names what the tests must cover: configuration and environment tests and synthetic monitoring.

Which pipeline stages does the IAM policy change blocks service checklist cover?

The pre-release items map to the pre-deploy and post-deploy stages.