11 / 11 FIXES VERIFIED LIVE

az storage account update -n titanlivecdfwpub -g titan-live-20260419 --allow-blob-public-access false

az storage account update -n titanlivecdfwpub -g titan-live-20260419 --allow-blob-public-access true

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T15:40:43.218946+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

az storage account update -n titanlivecdfwpub -g titan-live-20260419 --min-tls-version TLS1_2

az storage account update -n titanlivecdfwpub -g titan-live-20260419 --min-tls-version TLS1_0

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T15:40:43.218946+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

az storage account update -n titanlivecdfwtls -g titan-live-20260419 --min-tls-version TLS1_2

az storage account update -n titanlivecdfwtls -g titan-live-20260419 --min-tls-version TLS1_0

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T15:41:38.585655+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

az network nsg rule update -g titan-live-20260419 --nsg-name nsg-titan-cdfw -n allow-ssh-from-internet --source-address-prefixes 10.0.0.0/8

az network nsg rule update -g titan-live-20260419 --nsg-name nsg-titan-cdfw -n allow-ssh-from-internet --source-address-prefixes '0.0.0.0/0'

{
  "access": "Allow",
  "destinationAddressPrefix": "*",
  "destinationAddressPrefixes": [],
  "destinationPortRange": "22",
  "destinationPortRanges": [],
  "direction": "Inbound",
  "etag": "W/\"5bac26d9-cd2c-488c-af77-020d62ce8d69\"",
  "id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/titan-live-20260419/providers/Microsoft.Network/networkSecurityGroups/nsg-titan-cdfw/securityRules/allow-ssh-from-internet",
  "na

az storage account update -n titanlivecdfwnohttps -g titan-live-20260419 --min-tls-version TLS1_2

az storage account update -n titanlivecdfwnohttps -g titan-live-20260419 --min-tls-version TLS1_0

{
  "accessTier": "Hot",
  "accountMigrationInProgress": null,
  "allowBlobPublicAccess": false,
  "allowCrossTenantReplication": false,
  "allowSharedKeyAccess": null,
  "allowedCopyScope": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2026-04-19T15:43:21.829325+00:00",
  "customDomain": null,
  "defaultToOAuthAuthentication": null,
  "dnsEndpointType": null,
  "dualStackEndpointPreference"

aws s3api put-public-access-block --bucket titan-live-cdfw-patient-backups --public-access-block-configuration "BlockPublicAcls=true,BlockPublicPolicy=true,IgnorePublicAcls=true,RestrictPublicBuckets=true"

aws s3api delete-public-access-block --bucket titan-live-cdfw-patient-backups

(no stdout)

aws s3api delete-bucket-policy --bucket titan-live-cdfw-patient-backups

aws s3api put-bucket-policy --bucket titan-live-cdfw-patient-backups --policy '<backup-policy-json>'

(no stdout)

aws iam detach-user-policy --user-name titan-live-admin-cdfw --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

aws iam attach-user-policy --user-name titan-live-admin-cdfw --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

(no stdout)

aws iam delete-access-key --user-name titan-live-admin-cdfw --access-key-id AKIAWRW7XUVSSQBK4XWM

(no rollback — re-create key if needed via create-access-key)

(no stdout)

aws ec2 revoke-security-group-ingress --region us-east-2 --group-id sg-0380f1df5b21d7337 --protocol tcp --port 5432 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress --region us-east-2 --group-id sg-0380f1df5b21d7337 --protocol tcp --port 5432 --cidr 0.0.0.0/0

{
    "Return": true,
    "RevokedSecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-03b9df6cc39fbec53",
            "GroupId": "sg-0380f1df5b21d7337",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 5432,
            "ToPort": 5432,
            "CidrIpv4": "0.0.0.0/0"
        }
    ]
}

aws ec2 revoke-security-group-ingress --region us-east-2 --group-id sg-0380f1df5b21d7337 --protocol tcp --port 22 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress --region us-east-2 --group-id sg-0380f1df5b21d7337 --protocol tcp --port 22 --cidr 0.0.0.0/0

{
    "Return": true,
    "RevokedSecurityGroupRules": [
        {
            "SecurityGroupRuleId": "sgr-04dd8d511ddfc42a6",
            "GroupId": "sg-0380f1df5b21d7337",
            "IsEgress": false,
            "IpProtocol": "tcp",
            "FromPort": 22,
            "ToPort": 22,
            "CidrIpv4": "0.0.0.0/0"
        }
    ]
}

az storage container set-permission --name patient-data --account-name stg-pyx-patient-raw --public-access off

az storage container set-permission --name patient-data --account-name stg-pyx-patient-raw --public-access blob

az sql server firewall-rule update --resource-group $(az sql server show --name sql-pyx-prod --query resourceGroup -o tsv) --server sql-pyx-prod --name AllowAllIPs --start-ip-address 10.0.0.0 --end-ip-address 10.255.255.255

az sql server firewall-rule update --resource-group $(az sql server show --name sql-pyx-prod --query resourceGroup -o ts

az storage account update --name stg-pyx-analytics --min-tls-version TLS1_2

az storage account update --name stg-pyx-analytics --min-tls-version TLS1_0

az datafactory pipeline update --factory-name adf-pyx-prod --name ingest_epic --pipeline-file pipeline_config.json --resource-group $(az datafactory show --name adf-pyx-prod --query resourceGroup -o tsv)

az datafactory pipeline update --factory-name adf-pyx-prod --name ingest_epic --pipeline-file pipeline_config_backup.jso

az webapp update --name app-pyx-patient-portal --resource-group $(az webapp show --name app-pyx-patient-portal --query resourceGroup -o tsv) --https-only true

az webapp update --name app-pyx-patient-portal --resource-group $(az webapp show --name app-pyx-patient-portal --query r

az keyvault update --name kv-pyx-secrets --enable-soft-delete true --enable-purge-protection true

az keyvault update --name kv-pyx-secrets --enable-soft-delete false --enable-purge-protection false

az databricks workspace update --resource-group $(az databricks workspace show --name dbw-pyx-analytics --query resourceGroup -o tsv) --name dbw-pyx-analytics --public-network-access Disabled --required-nsg-rules NoAzureDatabricksRules --custom-virtual-network-id /subscriptions/$(az account show --query id -o tsv)/resourceGroups/$(az databricks workspace show --name dbw-pyx-analytics --query resourceGroup -o tsv)/providers/Microsoft.Network/virtualNetworks/vnet-databricks-secure --custom-public-subnet-name public-subnet --custom-private-subnet-name private-subnet

az databricks workspace update --resource-group $(az databricks workspace show --name dbw-pyx-analytics --query resource

az ad sp delete --id 8f2e1c

az ad sp create-for-rbac --name 'sp-pyx-etl-legacy' --role Contributor --scopes '/subscriptions/$(az account show --quer

az ad app owner add --id $(az ad app list --display-name 'Copilot-Legacy-POC' --query '[0].appId' -o tsv) --owner-object-id $(az ad user show --id security-admin@company.com --query 'id' -o tsv)

az ad app owner remove --id $(az ad app list --display-name 'Copilot-Legacy-POC' --query '[0].appId' -o tsv) --owner-obj

az network dns record-set cname delete --resource-group $(az network dns zone list --query "[?name=='example.com'].resourceGroup" -o tsv) --zone-name example.com --name pyx-legacy --yes

az network dns record-set cname create --resource-group $(az network dns zone list --query "[?name=='example.com'].resou

az network application-gateway ssl-cert update --gateway-name pyx-health-appgw --resource-group pyx-health-rg --name pyx-health-wildcard-cert --cert-file /path/to/new-pyx-health-wildcard.pfx --cert-password $CERT_PASSWORD

az network application-gateway ssl-cert update --gateway-name pyx-health-appgw --resource-group pyx-health-rg --name pyx

az network nsg rule create --resource-group rg-titan-security --nsg-name nsg-clinician-workstations --name block-claude-ai --priority 100 --direction Outbound --access Deny --protocol Tcp --destination-address-prefixes 'api.anthropic.com' --destination-port-ranges 443 --source-address-prefixes '10.0.100.0/24'

az network nsg rule delete --resource-group rg-titan-security --nsg-name nsg-clinician-workstations --name block-claude-

aws s3api put-public-access-block --bucket pyx-patient-backups --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true && aws s3api put-bucket-acl --bucket pyx-patient-backups --acl private

aws s3api delete-public-access-block --bucket pyx-patient-backups && aws s3api put-bucket-acl --bucket pyx-patient-backu

aws iam detach-user-policy --user-name jsmith --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

aws iam attach-user-policy --user-name jsmith --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

aws ec2 revoke-security-group-ingress --group-id sg-0a7b3c4d5e6f7g8h9 --protocol tcp --port 5432 --cidr 0.0.0.0/0

aws ec2 authorize-security-group-ingress --group-id sg-0a7b3c4d5e6f7g8h9 --protocol tcp --port 5432 --cidr 0.0.0.0/0

aws rds create-db-snapshot --db-instance-identifier pyx-clinical-prod --db-snapshot-identifier pyx-clinical-prod-pre-encryption-$(date +%Y%m%d-%H%M%S) && aws rds copy-db-snapshot --source-db-snapshot-identifier pyx-clinical-prod-pre-encryption-$(date +%Y%m%d-%H%M%S) --target-db-snapshot-identifier pyx-clinical-prod-encrypted-$(date +%Y%m%d-%H%M%S) --kms-key-id alias/aws/rds && aws rds restore-db-instance-from-db-snapshot --db-instance-identifier pyx-clinical-prod-encrypted --db-snapshot-identifier pyx-clinical-prod-encrypted-$(date +%Y%m%d-%H%M%S) --storage-encrypted

aws rds delete-db-instance --db-instance-identifier pyx-clinical-prod-encrypted --skip-final-snapshot && aws rds delete-

aws iam create-role --role-name GlueServiceRole-PyxClaimsETL --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"glue.amazonaws.com"},"Action":"sts:AssumeRole"}]}' && aws iam attach-role-policy --role-name GlueServiceRole-PyxClaimsETL --policy-arn arn:aws:iam::aws:policy/service-role/AWSGlueServiceRole && aws iam put-role-policy --role-name GlueServiceRole-PyxClaimsETL --policy-name PyxClaimsETLPolicy --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:GetObjectVersion","s3:ListBucket"],"Resource":["arn:aws:s3:::*"]},{"Effect":"Allow","Action":["glue:StartJobRun"],"Resource":"*"},{"Effect":"Allow","Action":["rds:DescribeDBInstances","rds:Connect"],"Resource":"*"}]}' && aws glue update-job --job-name pyx-claims-etl --job-update Role=arn:aws:iam::403670388211:role/GlueServiceRole-PyxClaimsETL

aws glue update-job --job-name pyx-claims-etl --job-update Role=arn:aws:iam::403670388211:role/GlueServiceRole-Admin

aws eks update-cluster-config --region $(aws eks describe-cluster --name pyx-claims-cluster --query 'cluster.arn' --output text | cut -d':' -f4) --name pyx-claims-cluster --resources-vpc-config endpointPublicAccess=false,endpointPrivateAccess=true

aws eks update-cluster-config --region $(aws eks describe-cluster --name pyx-claims-cluster --query 'cluster.arn' --outp

aws cloudtrail create-trail --name titan-ai-cloudtrail-us-west-2 --s3-bucket-name titan-ai-cloudtrail-logs-$(date +%s) --include-global-service-events --is-multi-region-trail --enable-log-file-validation --region us-west-2 && aws s3 mb s3://titan-ai-cloudtrail-logs-$(date +%s) --region us-west-2 && aws cloudtrail start-logging --name titan-ai-cloudtrail-us-west-2 --region us-west-2

aws cloudtrail stop-logging --name titan-ai-cloudtrail-us-west-2 --region us-west-2 && aws cloudtrail delete-trail --nam

aws acm request-certificate --domain-name portal.pyx-health.com --validation-method DNS --region us-east-1

aws iam update-access-key --user-name legacy-deploy-bot --access-key-id AKIAXXXX7G8H --status Inactive

aws iam update-access-key --user-name legacy-deploy-bot --access-key-id AKIAXXXX7G8H --status Active

aws lambda update-function-configuration --function-name pyx-claims-normalize --runtime python3.11

aws lambda update-function-configuration --function-name pyx-claims-normalize --runtime python3.7

aws cloudtrail update-trail --name $(aws cloudtrail describe-trails --query 'trailList[0].Name' --output text --region us-east-1) --enable-log-file-validation --region us-east-1

aws cloudtrail update-trail --name $(aws cloudtrail describe-trails --query 'trailList[0].Name' --output text --region u

gsutil iam ch -d allUsers:objectViewer gs://pyx-research-data

gsutil iam ch allUsers:objectViewer gs://pyx-research-data

gcloud projects remove-iam-policy-binding pyx-prod --member='serviceAccount:analytics-sa@pyx-prod.iam.gserviceaccount.com' --role='roles/owner'

gcloud projects add-iam-policy-binding pyx-prod --member='serviceAccount:analytics-sa@pyx-prod.iam.gserviceaccount.com'

gcloud compute firewall-rules update allow-all-ingress --source-ranges=10.0.0.0/8,172.16.0.0/12,192.168.0.0/16 --project=pyx-prod

gcloud compute firewall-rules update allow-all-ingress --source-ranges=0.0.0.0/0 --project=pyx-prod

gcloud compute instances add-metadata clinical-etl-vm --zone=$(gcloud compute instances list --filter='name:clinical-etl-vm' --format='value(zone)') --metadata=serial-port-enable=false --project=pyx-prod

gcloud compute instances add-metadata clinical-etl-vm --zone=$(gcloud compute instances list --filter='name:clinical-etl

gcloud bigquery datasets remove-iam-policy-binding patient_analytics --member='allAuthenticatedUsers' --role='roles/bigquery.dataViewer' --project=pyx-prod

gcloud bigquery datasets add-iam-policy-binding patient_analytics --member='allAuthenticatedUsers' --role='roles/bigquer

gcloud iam roles create dataflow_claims_streaming_role --project=pyx-prod --title='Dataflow Claims Streaming Role' --description='Minimal permissions for claims-streaming job' --permissions='pubsub.subscriptions.consume,pubsub.messages.ack,bigquery.tables.updateData,bigquery.datasets.get,bigquery.tables.get,dataflow.jobs.get,dataflow.jobs.updateContents,compute.machineTypes.get,compute.zones.get,storage.objects.get,storage.objects.create' --stage=GA && gcloud projects add-iam-policy-binding pyx-prod --member='serviceAccount:claims-streaming-sa@pyx-prod.iam.gserviceaccount.com' --role='projects/pyx-prod/roles/dataflow_claims_streaming_role'

gcloud projects remove-iam-policy-binding pyx-prod --member='serviceAccount:claims-streaming-sa@pyx-prod.iam.gserviceacc

gcloud sql instances patch pyx-clinical-replica --no-assign-ip --authorized-networks= --project=pyx-prod

gcloud sql instances patch pyx-clinical-replica --assign-ip --authorized-networks=0.0.0.0/0 --project=pyx-prod

gcloud pubsub topics remove-iam-policy-binding patient-events --member='allUsers' --role='roles/pubsub.subscriber' --project=pyx-prod

gcloud pubsub topics add-iam-policy-binding patient-events --member='allUsers' --role='roles/pubsub.subscriber' --projec

gcloud compute networks delete default --project=pyx-prod --quiet

gcloud compute networks create default --subnet-mode=auto --project=pyx-prod && gcloud compute firewall-rules create def

gcloud kms keys update phi-at-rest --location=global --keyring=phi-enc --rotation-period=90d --next-rotation-time=$(date -d '+90 days' --iso-8601=seconds)

gcloud kms keys update phi-at-rest --location=global --keyring=phi-enc --remove-rotation-schedule

az ad user update --id cfo@pyx-health.com --force-change-password-next-sign-in true && az ad signed-in-user revoke-refresh-tokens --upn cfo@pyx-health.com

az ad user update --id cfo@pyx-health.com --force-change-password-next-sign-in false

az cosmosdb sql container throughput update --account-name cosmos-pyx-prod --database-name $(az cosmosdb sql database list --account-name cosmos-pyx-prod --query '[0].name' -o tsv) --name $(az cosmosdb sql container list --account-name cosmos-pyx-prod --database-name $(az cosmosdb sql database list --account-name cosmos-pyx-prod --query '[0].name' -o tsv) --query '[0].name' -o tsv) --throughput 20000

az cosmosdb sql container throughput update --account-name cosmos-pyx-prod --database-name $(az cosmosdb sql database li

az webapp deployment slot create --name patient-portal --resource-group titan-healthcare-rg --slot staging --configuration-source patient-portal && az webapp config appsettings set --name patient-portal --resource-group titan-healthcare-rg --slot staging --settings HEALTH_CHECK_PATH=/api/health DEPLOYMENT_VALIDATION=true

az webapp deployment slot delete --name patient-portal --resource-group titan-healthcare-rg --slot staging

aws compliance create-sar-filing --customer-id acme-holdings-llc --account-id checking-882145 --violation-type structuring --total-amount 48300 --transaction-count 7 --timeframe-days 11 --regulation '31-CFR-1020.320' --priority critical --due-date-days 30

aws compliance update-sar-filing --sar-id [generated-id] --status withdrawn --reason 'false-positive-confirmed'

aws frauddetector put-outcome --detector-name titan-cnp-detector --outcome-name BLOCK_AND_CHALLENGE --rule-execution-mode FIRST_MATCHED --event-id txn:pan-ending-4521 --event-timestamp $(date -u +%Y-%m-%dT%H:%M:%S.%3NZ) --event-variables cardBin=Vermont,ipGeo=Lagos,deviceFingerprint=unknown,velocityMultiplier=4

aws frauddetector put-outcome --detector-name titan-cnp-detector --outcome-name REVIEW_MANUAL --event-id txn:pan-ending-

aws stepfunctions start-execution --state-machine-arn arn:aws:states:us-east-1:${ACCOUNT_ID}:stateMachine:kyc-edd-workflow --name case-00284751-edd-remediation --input '{"customer_id":"wealthmax-capital","case_id":"case-00284751","risk_level":"high","edd_requirements":["source_of_wealth_verification","beneficial_ownership_analysis","pep_enhanced_monitoring"],"trigger_reason":"remediation_high_risk_pep"}'

aws stepfunctions stop-execution --execution-arn arn:aws:states:us-east-1:${ACCOUNT_ID}:execution:kyc-edd-workflow:case-

az storage blob upload-batch --destination pci-evidence-q2-2026 --source ./evidence-remediation --account-name titancompliancestorage --auth-mode login --pattern '*.pdf'

az storage blob delete-batch --source pci-evidence-q2-2026 --account-name titancompliancestorage --pattern 'remediation-

aws connect stop-outbound-campaign --campaign-id april-wellness-check --instance-id $(aws connect list-instances --query 'InstanceSummaryList[0].Id' --output text)

aws connect start-outbound-campaign --campaign-id april-wellness-check --instance-id $(aws connect list-instances --quer

az storage blob update --account-name titanaicalls --container-name transcripts --name CAL-20260418-83921.json --metadata redaction_status=pending && az functionapp function invoke --name redact-phi-function --resource-group titan-ai-prod --function-name RedactTranscriptPHI --data '{"call_id":"CAL-20260418-83921","phi_elements":["MRN","DOB"],"redaction_method":"tokenize"}'

az storage blob update --account-name titanaicalls --container-name transcripts --name CAL-20260418-83921.json --metadat

az ml job create --file model-retrain-job.yaml --set inputs.excluded_features='zip_code' --set inputs.bias_metrics_enabled=true --set inputs.model_version='3.3' --resource-group titan-ml-rg --workspace-name titan-ml-ws

az ml model restore --name risk --version 3.2 --resource-group titan-ml-rg --workspace-name titan-ml-ws

az cosmosdb sql database throughput update --account-name titan-cosmosdb --database-name patient-portal-db --throughput 4000

az cosmosdb sql database throughput update --account-name titan-cosmosdb --database-name patient-portal-db --throughput

az servicebus queue purge --name outreach-campaign-queue --namespace-name titan-messaging --resource-group titan-comms && az logic apps workflow run cancel --name ASCVD-risk-2026-Q2 --resource-group titan-workflows

az logic apps workflow run trigger --name ASCVD-risk-2026-Q2 --resource-group titan-workflows --trigger-name manual

az ml model update --name ED-readmit-v2.4 --set tags.status=drift_detected tags.auto_disabled=true --disable-model --enable-model ED-readmit-baseline-v1.8

az ml model update --name ED-readmit-v2.4 --set tags.status=active tags.auto_disabled=false --enable-model --disable-mod

az pipelines variable-group variable update --group-id claims-pipeline-config --name DEDUP_KEY_COLUMNS --value 'claim_id,patient_id,provider_id,service_date,claim_version_seq'

az pipelines variable-group variable update --group-id claims-pipeline-config --name DEDUP_KEY_COLUMNS --value 'claim_id