# Legacy static VPN #1 retirement — 6 Aug 2026

Status: **PASS — retired without service interruption**.

## Change boundary

The superseded static Virginia–Ireland VPN was deleted after the accepted BGP
replacement had passed its dual-tunnel failover drill. The current BGP VPN and
the independent Ireland–Azure VPN were not modified.

Deleted provider resources:

- static VPN connection `vpn-0304048c980934f5a`;
- customer gateway `cgw-06ddf9ce3e5ef25b4`;
- the static VPN route owned by that connection; and
- eight obsolete UDP/500 and UDP/4500 ingress rules for the retired or former
  peer addresses `34.247.246.9/32`, `176.34.108.143/32`,
  `34.247.145.35/32` and `34.249.198.59/32`.

No EC2 instance, VPC, VGW, ALB, target group, current BGP peer rule or Azure
resource was deleted or replaced.

## Controls added before retirement

CloudFormation stack `eg334s-team2-vpn1-bgp-migration` now owns alarm
`eg334s-team2-VPN1-BGP-TunnelAvailability`. Its metric math alarms only when
neither current BGP tunnel is UP. The alarm was `OK` before cleanup and remained
`OK` afterward.

## Post-change provider state

- VPN #1 `vpn-053c85ebeeb20c115`: BGP, both tunnels UP, one accepted route per
  tunnel.
- VPN #2 `vpn-0106da6f9a20b1302`: static, both tunnels UP, one accepted route
  per tunnel.
- Ireland route table: propagated routes to `10.0.0.0/16` and `10.2.0.0/16`
  active through `vgw-02efe604037a218cf`.
- Current Virginia BGP peer rules retained only for `34.252.232.43/32` and
  `52.208.125.123/32` on UDP/500 and UDP/4500.
- CloudWatch: four project alarms OK.
- ALB: Web Node 1 in eu-west-1a and the current Auto Scaling Web Node 2 in
  eu-west-1b both healthy.

## Application-path verification

| Path | Result |
|---|---|
| Virginia `10.0.1.224` → Ireland `10.1.1.119` | ICMP 4/4, 0% loss, ~69 ms; private HTTP succeeded |
| Ireland `10.1.1.119` → Virginia `10.0.1.224` | ICMP 4/4, 0% loss, ~69 ms |
| Ireland `10.1.1.119` → Azure `10.2.1.4` | ICMP 4/4, 0% loss, ~227 ms; private HTTP succeeded |
| Azure `10.2.1.4` → Ireland `10.1.1.119` | ICMP 4/4, 0% loss, ~227 ms; private HTTP succeeded |

Temporary EC2 Instance Connect keys and Azure Run Command were used for the
verification. No permanent key or broad SSH rule was created.

## CloudFormation ownership note

The original hub and Virginia stacks use unversioned public SSM latest-AMI
references. Change-set previews showed that an otherwise unrelated stack
update could replace live EC2 instances because those references now resolve
to newer AMIs. To avoid an application outage, the approved retirement used
the EC2 APIs and intentionally left the ownership drift recorded in
`docs/iac/INTENTIONAL_DRIFT.md`.