At 2 a.m., I tightened an AWS WAF rule to require TLS 1.2+ and our ‘known-good’ CIDRs, then wondered why the ALB kept 403’ing its own health checks — I’d blocked the checker IPs and the multi-AZ failover dutifully evacuated everything. Anyone else accidentally implement zero trust as zero availability?