# AWS read-only control audit — 30 July 2026

Checked during the overnight implementation window using authenticated,
read-only AWS CLI queries. No resource was started, stopped, deployed, modified
or deleted.

## Result

**No unexplained chargeable AWS resource was found.** The personal test-bed
account contains the expected three running `t3.micro` instances, two VPN
objects, one two-AZ ALB, one zero-capacity recovery ASG, project monitoring and
evidence controls.

| Control | Observed state |
|---|---|
| CloudFormation | `eg334s-vpn1-onprem`, `eg334s-vpn1-awspublic`, `eg334s-personal-demo-site` and `eg334s-hub-recovery` complete |
| Compute | Two expected us-east-1 instances and one expected eu-west-1 hub instance running |
| VPN #1 | connection available; one tunnel UP and one standby tunnel DOWN |
| VPN #2 | connection available; both tunnels DOWN because Azure is deliberately parked |
| ALB | active, internet-facing, spans eu-west-1a and eu-west-1b |
| ALB target | existing hub EC2 `i-074bf0cb910a99e02` healthy on port 80 |
| Recovery | `eg334s-hub-recovery-HubRecoveryAsg` min 0, desired 0, max 1; attached to the ALB target group |
| CloudWatch | four project alarms OK; VPN #2 alarm in the acknowledged maintenance state; ALB unhealthy-host alarm OK |
| CloudTrail | logging; latest delivery succeeded with no delivery error |
| Public IPs | us-east-1 Elastic IP attached to strongSwan; both eu-west-1 public addresses belong to requester-managed ALB ENIs |
| NAT gateways | none in either project AWS region |
| IAM | one GitHub read-state role and three recovery-stack roles; all accounted for |
| S3 | one project Flow Log/evidence bucket found |
| July unblended cost | approximately zero after credits at query time; the dashboard may separately show gross usage and credit treatment |

## Claim boundaries

- One healthy ALB target is normal operation, not active/active compute.
- A two-AZ ALB plus a cold recovery group improves application-service
  recoverability; it does not provide regional, VGW or VPN high availability.
- VPN #2's alarm is a real detection of its parked state, not an unplanned
  incident.
- The two eu-west-1 public addresses are not orphan Elastic IPs; their network
  interfaces are requester-managed by the ALB.
- This record is dated evidence. The live dashboard must continue to qualify
freshness and completeness independently.