aws-production-debugginglisted

# AWS Production Debugging Find out which AWS control denied, dropped or throttled the thing that is failing. ## Purpose **Use this when:** - An API call fails with `AccessDenied`, `UnauthorizedOperation`, or `AssumeRole` errors. - Traffic does not reach an EC2 instance, ECS task or Lambda function. - A load balancer reports unhealthy targets. - Errors mention `ThrottlingException`, `RequestLimitExceeded`, or a service quota. - Performance degrades on a schedule, or after running well for hours — often credit exhaustion. **Do not use this when:** - The failure is inside Kubernetes rather than in AWS — use `kubernetes-networking`, unless the cause is IAM or the VPC. - You are reviewing infrastructure code — use `terraform-review`. **What this skill assumes:** AWS CLI v2 with credentials for the account in question, and read access to IAM, EC2, ELB and CloudWatch. State which account and region you are operating in before running anything. ## Operating Procedure 1. **Confirm identity, account and region.** An enormous share of AWS confusion is being in the wrong one of the three. 2. **Read the error precisely.** AWS errors name the principal, the action and often the resource. That is most of the diagnosis. 3. **Classify the layer**: identity (IAM), network (SG/NACL/routing), service (quota, throttling, health), or capacity (credits, limits). 4. **Use the simulator rather than reasoning about policies.** IAM evaluation has enough rules that reading JSON i