# Team connectivity lab

Status: **access enablement required**.

This runbook lets an authorised team member demonstrate the two current
private network paths without receiving shared passwords, SSH private keys,
access keys or VPN pre-shared keys. The public dashboard is an instruction and
evidence surface; cloud authentication remains with AWS and Microsoft Entra ID.

## Current access boundary

- The AWS EC2 instances do not currently have Systems Manager instance
  profiles and do not appear as managed nodes. Read-only AWS users cannot open
  a server session.
- The four Azure team accounts have Reader at `eg334s-rg`. Reader can inspect
  resources but cannot execute VM Run Command.
- Administrative SSH is deliberately restricted to an approved `/32`; it must
  not be opened to the internet or replaced with a shared key.

Before team-operated testing, an administrator must approve and implement:

1. an EC2 instance profile with the managed-instance core permissions on the
   Virginia test host and Ireland primary hub;
2. a narrowly scoped team policy for Session Manager access to only those test
   instances; and
3. an Azure custom role limited to reading the VM and invoking Run Command on
   `eg334s-azure-server` (or an attended operator executes the Azure tests while
   the team observes).

These are security-sensitive access changes and are not deployed by this
runbook.

## Login surfaces

- AWS account: <https://980195619820.signin.aws.amazon.com/console/>
- Azure VM: <https://portal.azure.com/#@a0ee2223-813f-4f94-81a0-c043dd0695ae/resource/subscriptions/7423798e-fe48-4db3-b8ca-9a8284c01d9f/resourceGroups/eg334s-rg/providers/Microsoft.Compute/virtualMachines/eg334s-azure-server/overview>

## Approved tests

### Virginia to Ireland over VPN #1

Source: Virginia private test host `10.0.1.154`  
Destination: Ireland primary Apache host `10.1.1.61`

```bash
ping -c 4 10.1.1.61
curl -fsS --max-time 10 http://10.1.1.61/
```

### Ireland to Virginia over VPN #1

Source: Ireland primary Apache host `10.1.1.61`  
Destination: Virginia private test host `10.0.1.154`

```bash
ping -c 4 10.0.1.154
```

### Ireland to Singapore over VPN #2

Source: Ireland primary Apache host `10.1.1.61`  
Destination: Azure nginx VM `10.2.1.4`

```bash
ping -c 4 10.2.1.4
curl -fsS --max-time 10 http://10.2.1.4/
```

### Singapore to Ireland over VPN #2

Source: Azure nginx VM `10.2.1.4`  
Destination: Ireland primary Apache host `10.1.1.61`

```bash
ping -c 4 10.1.1.61
curl -fsS --max-time 10 http://10.1.1.61/
```

Virginia to Singapore is not a current supported path. The Ireland VGW does
not provide inter-VPN transit, so a Virginia–Azure ping is expected to fail.

## Evidence record

For each test, record the operator, SGT timestamp, source instance, destination
private IP, command, sent/received packet totals, packet loss, round-trip time
and HTTP result where applicable. Do not capture credentials, account tokens,
private keys, PSKs, unrelated resources or personal notifications.