AWS signin documentation change
Summary
Added three new troubleshooting sections: network conditions in resource-based policies, lockout after enabling console authorization, and policy changes not taking effect.
Security assessment
The changes document security features like resource-based policies and console authorization, but don't address a specific vulnerability. They help users troubleshoot misconfigurations that could cause lockouts or access denials, improving security awareness without fixing exploits.
Diff
diff --git a/signin/latest/userguide/troubleshooting-sign-in-issues.md b/signin/latest/userguide/troubleshooting-sign-in-issues.md index 7983e58ef..cb3c36fa4 100644 --- a//signin/latest/userguide/troubleshooting-sign-in-issues.md +++ b//signin/latest/userguide/troubleshooting-sign-in-issues.md @@ -7 +7 @@ -My AWS Management Console credentials aren't workingPassword reset is required for my root userI don't have access to the email for my AWS accountMy MFA device is lost or stopped workingI can’t access the AWS Management Console sign-in pageHow can I find my AWS account ID or aliasI need my account verification codeI forgot my root user password for my AWS accountI forgot my IAM user password for my AWS accountI forgot my federated identity password for my AWS accountI can’t sign in to my existing AWS account and I can't create a new AWS account with the same email addressI need to reactivate my suspended AWS accountI need to contact Support for sign-in issuesI need to contact AWS Billing for billing issuesI have a question about a retail orderI need help managing my AWS accountMy AWS access portal credentials aren't workingI forgot my IAM Identity Center password for my AWS accountI receive an error that states ‘It’s not you, it’s us’ when I try to sign in +My AWS Management Console credentials aren't workingPassword reset is required for my root userI don't have access to the email for my AWS accountMy MFA device is lost or stopped workingI can’t access the AWS Management Console sign-in pageI cannot sign in due to network conditions in Sign-in resource-based policiesI am locked out of my account after enabling console authorizationMy policy changes are not taking effectHow can I find my AWS account ID or aliasI need my account verification codeI forgot my root user password for my AWS accountI forgot my IAM user password for my AWS accountI forgot my federated identity password for my AWS accountI can’t sign in to my existing AWS account and I can't create a new AWS account with the same email addressI need to reactivate my suspended AWS accountI need to contact Support for sign-in issuesI need to contact AWS Billing for billing issuesI have a question about a retail orderI need help managing my AWS accountMy AWS access portal credentials aren't workingI forgot my IAM Identity Center password for my AWS accountI receive an error that states ‘It’s not you, it’s us’ when I try to sign in @@ -32,0 +33,6 @@ For more assistance on troubleshooting your sign-in issues, see [What do I do if + * I cannot sign in due to network conditions in Sign-in resource-based policies + + * I am locked out of my account after enabling console authorization + + * My policy changes are not taking effect + @@ -155,0 +162,23 @@ IAM Identity Center users and first-party application sign-in | +## I cannot sign in due to network conditions in Sign-in resource-based policies + +If you see one of the following error messages, a Sign-in resource-based policy or resource control policy (RCP) might be restricting access based on your network location: + + * "Your authentication information is incorrect. Please try again." + + * "Authentication failed Invalid request" + + * "Authentication failed: To access this account, sign in from a different network, or contact your administrator for more information" + + + + +Contact your administrator or see [I cannot sign in due to network conditions in Sign-in resource-based policies](./console-access-control.html#console-access-control-ts-network) for detailed troubleshooting steps. + +## I am locked out of my account after enabling console authorization + +If you configured console authorization and can no longer access your account, you might not have configured excluded principals or emergency recovery access before enforcing the policy. For resolution steps including AWS CLI self-service, the `OrganizationAccountAccessRole`, and AWS Support options, see [I am locked out of my account after enabling console authorization](./console-access-control.html#console-access-control-ts-lockout). + +## My policy changes are not taking effect + +Changes to console authorization configuration and resource permission statements replicate globally and may take a few minutes to take effect. If your changes are not visible after waiting, see [Changes that I make are not always immediately visible](./console-access-control.html#console-access-control-ts-replication) for troubleshooting steps. +