✳ Practice range / Shared responsibility / 10 min

Whose mistake is on the screenshot?

Two simulated consoles at Northline Analytics. Name the customer-owned misconfiguration, the first fix, and the evidence that would show it is gone.

YOUR CASE FILE

SYNTHETIC TABLETOP / CLOUD-044
Organization: Northline Analytics (fiction). No live account.
Every console below is marked SIMULATED.

Case A — object store
  Bucket northline-analytics-exports
  Prefix customer-exports/
  Policy: Allow s3:GetObject for Principal *
  Block public access: Off

Case B — workload role
  Role analytics-export-worker
  Statement: Allow Action * on Resource *
  Used by a batch job, not by a human MFA prompt.

You cannot change a real cloud. Write the owner, the first fix,
and the verification evidence for each case.

Download the synthetic case ↓

SIMULATEDAWS-like object store

Case A · customer-exports/ is world-readable

Account: Northline Analytics (fiction)
Bucket: northline-analytics-exports
Prefix: customer-exports/Public prefix
Statement: Allow s3:GetObjectCustomer policy
Principal: *Anyone
Block public access: OffCustomer setting

Annotation: a public GetObject on this prefix is customer configuration of data and access. It is not a finding about the provider’s physical hosts.

SIMULATEDAWS-like identity console

Case B · analytics-export-worker can do anything

Role: analytics-export-worker
Trusted by: Batch job (machine identity)
Action: *Data-plane wildcard
Resource: *No resource boundary
Human MFA: On for console usersDoes not bind this role

Annotation: MFA on human logins does not narrow a machine role. The wildcard is still a customer identity decision.

Fill this table as you answer. The reflection shows one defensible version.
Case	Owner	First fix	Verification
A · public object store	You decide	You decide	You decide
B · over-permissive role	You decide	You decide	You decide

Your answers stay in this browser. This exercise uses fictional data and makes no changes to any system.

Step 1 of 3

Case A shows public GetObject on customer-exports/. Who owns that mistake?

CASE REFLECTION

Keep the reasoning.

first decisions matched the scenario’s best-supported answer.

On these screenshots the mistake is customer configuration and identity, not the provider’s buildings. Name the owner, make the smaller policy, and keep the diff that shows the public path and the wildcard are gone.

Responsibility table for Northline Analytics (simulated).
Case	Owner	First fix	Verification
A · public GetObject	Customer: configuration, identity, and data	Block public access and remove Principal * from customer-exports/	Policy diff plus public-access block on; simulated access-analyzer finding cleared
B · Action * / Resource *	Customer: the workload role	Replace the wildcard with the job’s read on one prefix	Policy diff; denied call outside that prefix; role still not a human MFA session

Another case ↗