The Challenge 2 and Challenge 3 walkthroughs include a prerequisite to switch the Challenge 1 "Require a tag and its value" and "Block public IP" policy assignments to DoNotEnforce. If an attendee reasonably leaves those policies enforcing (for example, to preserve the evidence pack), every later az ... create command is denied by the still active DataClassification tag policy, returning a RequestDisallowedByPolicy error that does not obviously point back to Challenge 1.
This is easy to miss because the relax step lives in a "Preparing for Next Challenges" section at the end of the Challenge 1 walkthrough, while the failure appears two challenges later.
Suggestion: either add --tags DataClassification=<value> to the create commands in Challenges 2 through 5 so they succeed regardless, or repeat the "relax the Challenge 1 policies" note prominently at the top of each later walkthrough.
The Challenge 2 and Challenge 3 walkthroughs include a prerequisite to switch the Challenge 1 "Require a tag and its value" and "Block public IP" policy assignments to DoNotEnforce. If an attendee reasonably leaves those policies enforcing (for example, to preserve the evidence pack), every later
az ... createcommand is denied by the still activeDataClassificationtag policy, returning aRequestDisallowedByPolicyerror that does not obviously point back to Challenge 1.This is easy to miss because the relax step lives in a "Preparing for Next Challenges" section at the end of the Challenge 1 walkthrough, while the failure appears two challenges later.
Suggestion: either add
--tags DataClassification=<value>to the create commands in Challenges 2 through 5 so they succeed regardless, or repeat the "relax the Challenge 1 policies" note prominently at the top of each later walkthrough.