# EG334S school-account IaC package contents

Status: **provider validated; school-account deployment and live acceptance pending**  
Validated: **1 August 2026**

This archive is the controlled, account-neutral rebuild package for the
three-cell EG334S environment. It contains 21 project files plus the generated
`MANIFEST.sha256` integrity record.

## Security and completeness boundary

- No AWS account ID, deployed resource ID, cloud credential, SSH private key or
  VPN pre-shared key is stored in the package.
- AWS creates the two tunnel endpoint pairs and PSKs during deployment. Insert
  those values only into protected working files during the attended VPN seam.
- Five CloudFormation YAML files passed `aws cloudformation validate-template`.
- Both Azure Bicep files passed `az bicep build`.
- Validation proves syntax and provider schema, not school-account permissions,
  quotas, change-set safety or live data-plane acceptance.

## Deployment order

1. Run `scripts/validate-iac.sh` and the read-only school-account preflight.
2. Deploy the Virginia core template.
3. Deploy the Ireland hub template and establish VPN #1 with protected
   strongSwan working files.
4. Deploy the Ireland ALB and active secondary templates.
5. Deploy the Azure cell, stage AWS VPN #2, then complete the scoped Azure VPN
   connection with the AWS-generated endpoint and PSK.
6. Run the acceptance matrix and retain sanitized evidence.
7. Deploy the optional evidence-distribution template only when approved.
8. Teardown borrowers before owners and run fail-closed verification.

## Deployment templates

| File | Scope | Purpose |
|---|---|---|
| `docs/iac/vpn1-onprem-us-east-1.yaml` | AWS us-east-1 | Virginia VPC, subnet, routes, strongSwan, test host, EIP, security, Flow Log and retained S3 audit storage |
| `docs/iac/vpn1-awspublic-eu-west-1.yaml` | AWS eu-west-1 | Ireland VPC, VGW, hub EC2, VPN #1, staged VPN #2, route propagation, Flow Log, CloudTrail, SNS and VPN alarms |
| `docs/iac/hub-alb-eu-west-1.yaml` | AWS eu-west-1 | Second-AZ subnet, internet-facing ALB, target group, listener, security and target-health alarm |
| `docs/iac/hub-recovery-eu-west-1.yaml` | AWS eu-west-1 | Active secondary ASG, launch template, private DNS, health controller, event rules and recovery alarm |
| `docs/iac/video-evidence-distribution.yaml` | AWS optional evidence plane | Private S3 origin and CloudFront delivery for approved chaptered evidence |
| `docs/iac/eg334s-azure-cell.bicep` | Azure southeastasia | VNet, subnets, NSG, Ubuntu/nginx VM, public IP and staged VpnGw1AZ resources |
| `docs/iac/azure-vpn2.bicep` | Azure southeastasia | Scoped VPN #2 deployment against the existing Azure core |

## Protected configuration inputs

| File | Purpose |
|---|---|
| `docs/iac/strongswan-school-ipsec.conf.template` | Two-tunnel VPN #1 strongSwan configuration skeleton |
| `docs/iac/strongswan-school-ipsec.secrets.template` | Placeholder-only VPN #1 PSK mapping; completed copy must remain mode `600` outside Git |
| `docs/iac/school-account.env.example` | Account gate, profiles, regional key pairs, approved administrator `/32`, monitoring email and write switch |

## Runbooks and ownership records

| File | Purpose |
|---|---|
| `docs/iac/PACKAGE_CONTENTS.md` | This manifest, validation boundary and deployment order |
| `docs/iac/SCHOOL_TEAM_DEPLOYMENT_PLAN.md` | Roles, gates, timings, acceptance, rollback and cost controls |
| `docs/iac/SCHOOL_ACCOUNT_DEPLOYMENT.md` | Detailed account-safe deployment and VPN seam |
| `docs/iac/REBUILD.md` | Clean-environment rebuild dependencies and sequence |
| `docs/iac/HUB_ALB.md` | ALB integration and validation runbook |
| `docs/iac/HUB_RECOVERY.md` | Recovery objective, operation and restoration runbook |
| `docs/iac/OWNERSHIP.md` | Cross-stack ownership and borrower-before-owner deletion order |

## Validation and execution scripts

| File | Purpose |
|---|---|
| `scripts/validate-iac.sh` | Fail-closed static safety checks |
| `scripts/preflight-school-account.sh` | Read-only identity, regional access and provider-schema validation |
| `scripts/school-deploy.sh` | Account-ID-gated AWS deployment helper |
| `scripts/verify-teardown.sh` | Fail-closed residual-resource verification |

`MANIFEST.sha256` is generated when the archive is built and records the digest
of every project file above. Verify it from the extracted archive with:

```bash
shasum -a 256 -c MANIFEST.sha256
```