# Live-state, routing, ownership and cost evidence · 30 July 2026

Capture window: **17:42:52–17:47:06 SGT**  
UTC window: **09:42:52–09:47:06 UTC**  
Method: authenticated, read-only AWS CLI and Azure CLI/API queries.  
Change boundary: **no resource was started, stopped, updated, deployed or deleted**.

This record closes the four approved evidence actions:

1. timestamped live-state snapshot;
2. routing and security evidence;
3. deployed-resource ownership reconciliation; and
5. pre-parking cost baseline.

Credentials, VPN pre-shared keys and the administrative `/32` address are not
reproduced in this public record.

## 1 · Timestamped live-state snapshot

### AWS

- Authenticated account: `980195619820`.
- Virginia (`us-east-1`):
  - `i-08852e3ba5d35c9c0` · `EG334S-onprem-strongswan` · `t3.micro` ·
    `10.0.1.77` · **running** · source/destination check **disabled**.
  - `i-03788b81b7394a8ef` · `EG334S-onprem-server` · `t3.micro` ·
    `10.0.1.154` · **running**.
- Ireland (`eu-west-1`):
  - `i-074bf0cb910a99e02` · `EG334S-awspublic-server` · `t3.micro` ·
    `10.1.1.61` · **running**.
- VPN #1 `vpn-065016cdb8d06a873`: **available**; static route
  `10.0.0.0/16`; one tunnel **UP** with one accepted route and one standby
  endpoint down.
- VPN #2 `vpn-03dcb879c286f5ecd`: **available**; static route
  `10.2.0.0/16`; one tunnel **UP** with one accepted route and one standby
  endpoint down.
- Internet-facing ALB
  `eg334s-personal-demo-site-alb-349585711.eu-west-1.elb.amazonaws.com`:
  **active** across `eu-west-1a` and `eu-west-1b`.
- Target group `eg334s-personal-targets`: primary hub target
  `i-074bf0cb910a99e02:80` **healthy**.
- Recovery ASG `eg334s-hub-recovery-HubRecoveryAsg`: minimum `0`, desired
  `0`, maximum `1`, zero recovery instances.
- All four project alarms were **OK**:
  - `EG334S-Hub-Recovery-Over-10-Minutes`;
  - `EG334S-Hub-StatusCheckFailed`;
  - `EG334S-VPN1-TunnelDown`;
  - `EG334S-VPN2-TunnelDown`.
- CloudTrail `EG334S-audit-trail`: `IsLogging=true`; delivery succeeded at
  `17:41:56 SGT`; latest digest delivery at `17:23:26 SGT`.
- Both VPC Flow Logs were **ACTIVE**, captured with traffic type `ALL`:
  - `fl-0ef531e2d2d6d1173` · Virginia VPC;
  - `fl-0963dc40ce2f1c698` · Ireland VPC.

The two Ireland public IPv4 addresses previously suspected of being unattached
were reconfirmed as **required ALB-managed addresses**, not orphans:

| Public IPv4 | AZ | ENI | State |
|---|---|---|---|
| `108.131.189.140` | `eu-west-1a` | `eni-0fc0e7efe0945cac5` | `ServiceManaged=alb`, in use |
| `54.216.79.2` | `eu-west-1b` | `eni-0244baea07b61d740` | `ServiceManaged=alb`, in use |

### Azure

- Subscription: `7423798e-fe48-4db3-b8ca-9a8284c01d9f`.
- Resource group: `eg334s-rg` · 12 resources in `southeastasia`.
- VM `eg334s-azure-server`: provisioning succeeded and **running**.
- Gateway `eg334s-vpngw`: `VpnGw1AZ`, route-based, provisioning
  **Succeeded**.
- VPN #2 connection `eg334s-vpn2-connection`: **Connected**, IKEv2,
  provisioning **Succeeded**.
- Direct VPN #3 connection `eg334s-vpn3-onprem-connection`: **Connected**,
  IKEv2, provisioning **Succeeded**.
- Azure peer definitions:
  - Ireland peer `34.243.188.162` for `10.1.0.0/16`;
  - Virginia peer `3.214.123.92` for `10.0.0.0/16`.

## 2 · Routing and security evidence

### Virginia

Route table `rtb-09c484653b65a46b3` was active and associated with
`subnet-02c8da2a1ad82bc90`:

- `10.1.0.0/16` → strongSwan EC2 `i-08852e3ba5d35c9c0`;
- `10.2.0.0/16` → strongSwan EC2 `i-08852e3ba5d35c9c0`;
- `0.0.0.0/0` → `igw-0aa7206c6a7d03ac1`.

The strongSwan instance had source/destination check disabled. Its security
group allowed IKE/NAT-T (`UDP/500` and `UDP/4500`) plus the three private
project CIDRs. The test server allowed private ICMP from Ireland and Singapore.
Administrative SSH remained restricted to one explicit `/32`, redacted here.

### Ireland

Route table `rtb-0a832e0ffdea41d6e` was active, associated with both Ireland
subnets and propagating from `vgw-0bf466d711cc93ac4`:

- `10.0.0.0/16` → VGW, origin `EnableVgwRoutePropagation`;
- `10.2.0.0/16` → VGW, origin `EnableVgwRoutePropagation`;
- `0.0.0.0/0` → `igw-0b63cebe58b7e2747`.

The hub server security group allowed private HTTP and ICMP from the Virginia
and Singapore CIDRs. The ALB security group exposed public HTTP on port 80;
the hub received ALB HTTP through a separate stack-owned ingress rule.

### Singapore

The Azure VM NIC effective-route table showed:

- `10.0.0.0/16` → `VirtualNetworkGateway` for direct VPN #3;
- `10.1.0.0/16` → `VirtualNetworkGateway` for VPN #2;
- `10.2.0.0/16` → `VnetLocal`.

The effective NSG allowed ICMP from the two AWS CIDRs and restricted SSH to
one administrative `/32`. Public HTTP remained an explicit workload rule.

**Interpretation:** Virginia-to-Singapore connectivity uses direct VPN #3
through strongSwan and the Azure gateway. It does not rely on transitive
forwarding through the Ireland VGW.

## 3 · Deployed-resource ownership reconciliation

CloudFormation `describe-stack-resources` was run against every active project
stack in both AWS regions.

| Region | Stack / control owner | Reconciled responsibility |
|---|---|---|
| `us-east-1` | `eg334s-vpn1-onprem` | Virginia VPC, subnet, route table, IGW, two EC2 instances, security groups and strongSwan EIP |
| `us-east-1` | `eg334s-vpn3-onprem-routing` | Direct VPN #3 route to `10.2.0.0/16` and two security-group ingress rules |
| `us-east-1` | `eg334s-video-evidence` | Versioned video S3 bucket, bucket policy, CloudFront distribution and origin access control |
| `eu-west-1` | `eg334s-vpn1-awspublic` | Ireland VPC, primary subnet, route table, IGW, VGW, hub EC2, security group, VPN #1 and its static route |
| `eu-west-1` | `eg334s-hub-recovery` | Recovery subnet, launch template, zero-capacity ASG, Lambda/EventBridge control plane, private Route 53 record and two recovery alarms |
| `eu-west-1` | `eg334s-personal-demo-site` | Two-AZ ALB, listener, target group, ALB security controls and unhealthy-host alarm |

Current AWS resources not owned by those six stacks are controlled
operationally and must be handled explicitly during teardown:

- VPN #2 and its Azure customer-gateway/static-route objects;
- both VPC Flow Logs and their destination bucket;
- CloudTrail and its retained evidence objects;
- the VPN #1 and VPN #2 alarms, SNS topic, budgets and CloudWatch dashboard.

Azure deployment records also reconciled successfully:

| Deployment | State | Resource responsibility |
|---|---|---|
| `eg334s-azure-cell` | Succeeded | VM, NIC, NSG, workload public IP and VNet; the managed OS disk is created with the VM |
| `eg334s-azure-vpn23` | Succeeded | VpnGw1AZ gateway, both VPN connections and both local network gateways |

The retained gateway public IP `eg334s-vpngw-pip` is a pre-existing dependency
passed into the VPN deployment. It must be managed explicitly rather than
assumed to be deleted with the deployment record.

## 5 · Pre-parking cost baseline

Captured through provider-native billing APIs during the same evidence window:

| Provider | Month-to-date value | Qualification |
|---|---:|---|
| AWS usage | **US$20.9644264296** | Account-level usage before credits |
| AWS credits | **−US$20.9644266675** | Account-level credits |
| AWS estimated net | **approximately US$0.00** | Credits currently offset usage; values can continue to settle |
| Azure actual cost | **US$5.8480278730** | Subscription month-to-date Cost Management response |

The AWS Cost Explorer result is account-wide, not a project-only allocation.
Its largest current service category was Amazon VPC at US$14.8448473003,
followed by EC2 compute at US$3.5275648956. The Azure Cost Management result
is also a billing snapshot and may lag resource activity.

This baseline must be compared with a separately timestamped post-parking
capture. It is evidence of the value reported by the billing APIs at capture
time, not a final invoice or a promise of future cost.

## Result

**PASS · the approved read-only evidence capture completed without changing
infrastructure.** Live state, route/security intent, resource ownership and
pre-parking billing were all observed and recorded. The remaining operational
action is a separate post-parking comparison if and when parking is authorised.