ShahriarLabs Simulators · SimAWS
Find the cause. Repair the problem.
Direct explanations of cloud failures, paired with experiments you can run without an account.
- QuantumSketch animation worker
EC2 SSH connection timed out: trace the broken hop
A timeout means the connection did not complete. Check the instance, public address, subnet route, security group and both NACL directions before changing credentials.
Explore - LetX background export worker
Private subnet has no internet: check the NAT path
A private instance needs a usable outbound path. For public NAT, verify the private route to NAT, NAT state and VPC, its public subnet route to an attached internet gateway, and both subnet ACLs.
Explore - ShahriarLabs lesson assets
S3 AccessDenied: identify the permission boundary
A 403 is an access decision, not proof that the object is missing. Identify the caller, action and resource; then check matching allows, explicit denies and the applicable public-access or encryption controls.
Explore - ShahriarLabs asset reader
IAM explicit deny: why another allow cannot fix it
A matching explicit deny overrides an allow. First identify which statement applies to the exact action, resource and principal; adding a broader allow cannot cancel that deny.
Explore - QuantumSketch rendering queue
SQS backlog keeps growing: compare arrival and drain rates
A queue grows when incoming work exceeds completed work over time. Separate arrival rate, worker capacity and retries before increasing concurrency or changing visibility timeout.
Explore - LetX practice export pipeline
Retry storms: when recovery logic multiplies the outage
Retries consume capacity too. Bound attempts, use backoff and jitter, and make side effects idempotent so failure recovery does not amplify load or duplicate work.
Explore