# Keeper: Major incident: GovCloud SSO login 403 error - Resolved

**Summary:** Keeper reported a major incident affecting some GovCloud SSO logins with 403 errors, impacting the Admin Console and Web Vault. It started and was resolved at 2023-05-16 02:00 UTC; the recorded duration was 0 min. An overly aggressive WAF rule in Amazon Shield blocked requests; DevOps applied WAF rule policy changes to resolve it. _(machine-written, sol)_
- Kind: Major incident · Label: outage (model (Jev))
- Changed: 2023-05-16 02:00 UTC · Detected: 2026-10-17 18:22 UTC
- [Source: https://stspg.io/85ddsjvj5lr9](https://stspg.io/85ddsjvj5lr9)
- [Company: Keeper](https://rewindex.com/company/keeper.md)
- Versions: before (none: first archived) → after incident\_version:311/dyg76k2r4wg8@fbb6f9e9a57b
- Change 1 of 1 for this incident

## What changed

**1. Added: Title**

```diff
+ GovCloud SSO login 403 error - Resolved
```

**2. Added: Impact**

```diff
+ major
```

**3. Added: Status**

```diff
+ postmortem
```

**4. Added: Start time**

```diff
+ 2023-05-16 02:00 UTC
```

**5. Added: Resolved time**

```diff
+ 2023-05-16 02:00 UTC
```

**6. Added: Affected components**

```diff
+ Keeper Admin Console (GovCloud), Keeper Infrastructure (GovCloud) - Keeper Admin Console (GovCloud), Keeper Infrastructure (GovCloud) - Keeper Web Vault (GovCloud), Keeper Web Vault (GovCloud)
```

**7. Added: Update** (resolved) · 2023-05-16 02:00 UTC

```diff
+ We are aware of 403 errors that were occurring when logging in through GovCloud with SSO. The issue has been resolved. An overly aggressive WAF rule in the Amazon Shield system blocked the requests.
```

**8. Added: Update** (postmortem) · 2023-05-16 02:04 UTC

```diff
+ Some SSO logins on the GovCloud environment were generating a 403 error. An overly aggressive WAF rule in the Amazon Shield system blocked the requests. The DevOps team applied the necessary WAF rule policy changes to resolve the issue.
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2023-05-16 02:00 UTC | Major incident: GovCloud SSO login 403 error - Resolved (this change) | outage |

All Keeper changes: [timeline](https://rewindex.com/company/keeper/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/i6c2e090f9deca3 · Markdown: https://rewindex.com/change/i6c2e090f9deca3.md · JSON: https://rewindex.com/api/v1/changes/i6c2e090f9deca3 · Generated 2026-10-18T01:29:49.040Z