# Chaptered demonstration recording plan

Status: **planned; recordings not yet captured**.

Record eight short chapters instead of one continuous video. This makes failed
or stale evidence replaceable without re-recording the entire demonstration.
Each chapter must begin with the date/time, account/environment, region and
test objective, and end with the observed result and claim boundary.

| # | Chapter | Evidence to capture | Pass condition | Target |
|---|---|---|---|---|
| 1 | Architecture and baseline | Dashboard timestamp, account/region labels, VPC/VNet CIDRs, ALB and parked/live state | Viewer can identify the environment and current state without relying on narration | 2–3 min |
| 2 | IaC validation and deployment | `validate-iac.sh`, CloudFormation/Bicep validation, inspected change sets, stack outputs | No secrets shown; change sets match the intended account-neutral design | 4–6 min |
| 3 | VPN #1 | AWS VPN telemetry, strongSwan status, route and SG evidence, ICMP + HTTP | At least one tunnel up; expected selector; 0% packet loss; HTTP response | 4–5 min |
| 4 | VPN #2 | AWS/Azure gateway and connection state, effective routes, ICMP + HTTP | Control plane up and Azure-to-Ireland data/application path succeeds | 5–7 min |
| 5 | End-to-end boundary | Positive hub paths plus Virginia-to-Azure negative test | Positive paths pass; transitive test fails as designed and is explained | 3–4 min |
| 6 | ALB and hub recovery | ALB DNS, target health, controlled primary failure, recovery ASG, HTTP restoration, CloudWatch metric | HTTP restores within 600 seconds and steady state returns to desired capacity zero | 7–12 min |
| 7 | Monitoring and cost controls | CloudTrail, both Flow Logs, CloudWatch alarms, SNS, budgets, timestamped AWS/Azure cost cards | Each control is named; alarm maintenance state and billing timestamp are explained | 4–5 min |
| 8 | Teardown and school portability | Dependency-ordered stack deletion, Azure cleanup/parking, fail-closed verification, school account package | No unrecorded chargeable resources remain; retained evidence is explicitly listed | 5–8 min |

## Recording method

- Use macOS screen recording or OBS at 1080p, 30 fps.
- Capture only the application window or a clean display; hide notifications,
  bookmarks, account emails and unrelated tabs.
- Use a separate audio track when possible.
- Pause before showing any command output and inspect it for credentials,
  public user details, SSH material or VPN PSKs.
- Never record the Secrets Manager/Parameter Store secret value, downloaded VPN
  configuration PSK, private key, access key, session token or browser password.
- Use a visible chapter slate with environment, objective and date.
- Preserve raw recordings privately; publish only redacted exports approved by
  the team.

## Storage

S3 is suitable for the private master files. Use a dedicated bucket with Block
Public Access, default encryption, versioning and a lifecycle rule to lower-cost
storage or expiry after assessment. The public dashboard should link only to
approved redacted exports, preferably through short-lived signed URLs or a
separate distribution layer. No bucket or paid video distribution was created
overnight.

Suggested object structure:

```text
eg334s-video-evidence/
  raw/2026-08-xx/ch01-architecture.mov
  raw/2026-08-xx/ch02-iac.mov
  ...
  published/v1/ch01-architecture.mp4
  manifests/recording-register.json
```

## Time and cost

Allow approximately 45–60 minutes of final footage, 4–6 hours for attended
capture, and 2–4 hours for redaction, chapter slates, upload and link
verification. S3 storage for a few gigabytes is low-cost; the material cloud
cost is the infrastructure left running during VPN #2 and recovery chapters,
especially the Azure VPN gateway. Capture those chapters in one attended
window, then park/delete the gateway immediately.