service · inferred from evidence
IAM
AWS Identity and Access Management, mentioned in the context of required permissions for Route53 ACME challenges.
- Crossplane cannot pull xpkg OCI packages from ECR with IRSA
Teaches how to crossplane cannot pull xpkg OCI packages from ECR with IRSA. Based on a real issue report and its verified fix.
- Cloud SQL Proxy: "Error during createEphemeral ... Error 403: The client is not authorized to make this request"
This is a known IAM propagation quirk, not a proxy bug: re-grant the role to force it to take effect. Remove the Cloud SQL Client role from the failing service account in IAM & Admin > IAM (uncheck it and Save), verify the account disappear
- GCS getSignedUrl fails: Cannot sign data without client_email
How to fix: GCS getSignedUrl fails: Cannot sign data without client_email. The verified fix from the maintainer thread, distilled into reusable steps.
- UnrecognizedClientException when calling the GetAccount operation (django-ses)
The keys were valid, but the IAM identity behind them was missing the permissions django-ses's throttling/quota checks need. Grant the IAM user or role ses:GetAccount and ses:GetSendQuota in addition to the normal send permissions.
- UnrecognizedClientException when calling the GetAccount operation (django-ses)
On django 4.2.1 with django-ses 3.4.1, calling Django's send_mail raised: An error occurred (InvalidClientTokenId) when calling the GetSendQuota operation: The security token included in the request is invalid. Enabling USE_SES_V2 = True ch
- Fix Traefik wildcard certificate failures: ACME DNS-01 in Docker
Getting wildcard certs from Let's Encrypt with Traefik in Docker fails for repeatable reasons: the resolver is defined in the wrong config (static vs dynamic), propagation keys are wrong, provider env vars or permissions are off, or TXT pro