# Recovery-stack cleanup — 5 August 2026

## Outcome

The failed optional `eg334s-team2-recovery` CloudFormation trial was deleted
from the school AWS account in `eu-west-1`. The accepted deployment remains the
permission-compatible active-active baseline:

- `eg334s-team2-hub` — `UPDATE_COMPLETE`;
- `eg334s-team2-alb` — `CREATE_COMPLETE`;
- `eg334s-team2-secondary` — `UPDATE_COMPLETE`.

## Root cause and evidence boundary

The student identity was not authorised for `iam:CreateRole`. The initial
rollback then lacked `iam:DetachRolePolicy` and `iam:DeleteRolePolicy`, leaving
the stack in `ROLLBACK_FAILED`. All regional resources, including the Route 53
private hosted zone, alarms, launch template and SSM parameter, had already
reached `DELETE_COMPLETE`.

On the controlled deletion retry, both remaining logical resources reached
`DELETE_COMPLETE`:

- `HealthProbeRole` —
  `eg334s-team2-recovery-HealthProbeRole-MutXpbRuiFmo`;
- `RecoveryControllerRole` —
  `eg334s-team2-recovery-RecoveryControllerRole-7s9qxCemaECi`.

The CloudFormation active-stack list then contained only the hub, ALB and
active-secondary stacks. No recovery-controller IAM role, Lambda function,
private hosted zone or `hub.eg334s-team2.internal` endpoint remains live.

## Corrective action

The deployment helper now blocks the advanced controller unless an explicit
administrator-only override is supplied. The standard build order uses
`hub-secondary-eu-west-1.yaml`, which maintains one application target in each
Ireland Availability Zone without custom IAM or Lambda. The historical
controller template remains labelled as a non-baseline reference.

## Claim boundary

This cleanup proves the failed trial was removed and the accepted baseline was
preserved. It does not add regional disaster recovery, VGW recovery or
zero-interruption service. Application resilience continues to rely on ALB
health routing across the two healthy Ireland targets.