Resolved incident

GovCloud Admin Console login with ARAM permissions

Keeper · Major · Started

Duration
47m
Severity
Major
Status
Postmortem

Summary

Major · Postmortem

The GovCloud DevOps team uses automated infrastructure deployment systems via Terraform to manage all environments. A change was made to subnet VPC routing which inadvertently caused connectivity issues between certain backend services and a specific Redshift cluster. This issue affected admins on the Keeper Admin Console who have ARAM permissions applied to their role policies. Delegated admins without reporting permissions were not affected. Vault login and other client-side vault applications were not affected. Recent improvements to the Vault and Admin Console backend APIs masked the issue for the automated detection systems which would have immediately flagged the error and alerted the DevOps team. We have resolved the infrastructure route and updated the monitoring systems to take this into account and will continue to monitor for any future issues.

View official incident ↗

Event timeline

How this incident unfolded, from the official status page.

  1. Identified

    Keeper

    We have identified an issue affecting users on the Admin Console in the GovCloud region who have administrative rights over Advanced Reporting & Alerts module (ARAM).

  2. Identified

    Keeper

    We are continuing to work on a fix for this issue.

  3. Resolved

    Keeper

    The issue has been resolved. Console login to GovCloud for users with ARAM reporting administrative functions has been restored.

  4. Postmortem

    Keeper

    The GovCloud DevOps team uses automated infrastructure deployment systems via Terraform to manage all environments. A change was made to subnet VPC routing which inadvertently caused connectivity issues between certain backend services and a specific Redshift cluster. This issue affected admins on the Keeper Admin Console who have ARAM permissions applied to their role policies. Delegated admins without reporting permissions were not affected. Vault login and other client-side vault applications were not affected. Recent improvements to the Vault and Admin Console backend APIs masked the issue for the automated detection systems which would have immediately flagged the error and alerted the DevOps team. We have resolved the infrastructure route and updated the monitoring systems to take this into account and will continue to monitor for any future issues.