# EG334S deployed-resource ownership matrix

Status: **controlled working record**. Reconcile this table against a
`complete` inventory after every rebuild and immediately before teardown.

The templates describe what a new deployment *can own*. Only
`aws cloudformation describe-stack-resources` proves what the current stacks
actually own. If that query fails, ownership is **unknown**, not manual and not
absent.

| Resource group | Intended owner | Delete mechanism | Retention / exception |
|---|---|---|---|
| us-east-1 VPC, subnet, routes, IGW, security groups, two EC2 instances and strongSwan EIP | `eg334s-vpn1-onprem` stack | Delete the stack | None intended |
| us-east-1 VPC Flow Log | `eg334s-vpn1-onprem` stack | Delete the stack | None intended |
| Central audit S3 bucket | `eg334s-vpn1-onprem` stack | Empty and delete explicitly after evidence retention | `DeletionPolicy: Retain`; stack deletion deliberately leaves it behind |
| eu-west-1 VPC, subnet, routes, IGW, VGW, EC2 server and VPN #1 | `eg334s-vpn1-awspublic` stack | Delete the stack after VPN #2 | None intended |
| Optional AWS side of VPN #2 | `eg334s-vpn1-awspublic` stack when `CreateAzureVpn=true` | Delete with the hub stack after Azure is disconnected | Verify the current stack parameters and resources |
| eu-west-1 VPC Flow Log, multi-region CloudTrail, SNS topic/subscription and VPN alarms | `eg334s-vpn1-awspublic` stack | Delete the stack | Email subscription confirmation remains an external recipient action |
| CloudWatch dashboard and AWS Budgets | Manual / account-level controls | Delete explicitly | Not defined by the current templates |
| Azure VNet, VM, NSG, public IPs, VPN gateway, LNG and connection | `eg334s-rg` resource group via Bicep | `az group delete` | Static IP retention is a deliberate cost/rebuild choice only before final teardown |
| Key pairs and any legacy IAM role | Manual / account-level | Delete explicitly or escalate to the lab administrator | IAM is global; the locked lab-account role remains **unverified** |
| Cloudflare dashboard, KV, API functions and watchdog | Project publication controls | Decision required before final closure | **TBD by team / lecturer:** retain as assessment evidence or decommission |

## Reconciliation gate

1. Run `./scripts/inventory.sh`.
2. Continue only if `.complete == true` and `.errors` is empty.
3. For every live stack, save `describe-stack-resources` output.
4. Compare each live resource to this matrix.
5. Label differences `stack-owned`, `manual`, `retained`, or `unexpected`.
6. Do not sign off teardown while any item is `unknown` or `unexpected`.