# EG334S staged rebuild

These three templates rebuild the network, compute, VPN, audit and alerting
resources without storing ephemeral tunnel addresses or VPN pre-shared keys in
Git.

| Stage | Template | Target |
|---|---|---|
| 1 | `vpn1-onprem-us-east-1.yaml` | AWS `us-east-1` |
| 2 and 4 | `vpn1-awspublic-eu-west-1.yaml` | AWS `eu-west-1` |
| 3 and 5 | `eg334s-azure-cell.bicep` | Azure `southeastasia` |

The staged order is required. AWS assigns VPN tunnel outside addresses and
pre-shared keys only after it creates a VPN connection, while AWS VPN #2 needs
the Azure gateway public IP first.

## Before starting

- Choose an administrator source CIDR such as your public `/32`; do not use
  `0.0.0.0/0` outside the lab.
- Create or identify an EC2 key pair in each AWS region.
- Have an Azure SSH public key ready.
- Keep VPN pre-shared keys in a protected local parameter file. Never commit
  them, paste them into issues, or add them to the dashboard.
- Expect the Azure VPN gateway to take tens of minutes and incur hourly cost.

## 1. Deploy the simulated on-premises cell

```sh
aws cloudformation deploy \
  --region us-east-1 \
  --stack-name eg334s-vpn1-onprem \
  --template-file vpn1-onprem-us-east-1.yaml \
  --parameter-overrides \
    KeyPairName=REPLACE_USE1_KEY \
    AdminCidr=REPLACE_WITH_YOUR_IP_32 \
    CreateCentralLogBucket=true
```

Record the `StrongSwanElasticIP` and `CentralLogBucketName` stack outputs. This
stage also creates the retained central audit bucket and the `us-east-1` VPC
Flow Log.

## 2. Deploy the AWS public-cloud hub

```sh
aws cloudformation deploy \
  --region eu-west-1 \
  --stack-name eg334s-vpn1-awspublic \
  --template-file vpn1-awspublic-eu-west-1.yaml \
  --parameter-overrides \
    KeyPairName=REPLACE_EUW1_KEY \
    AdminCidr=REPLACE_WITH_YOUR_IP_32 \
    OnPremStrongSwanEIP=REPLACE_STAGE_1_EIP \
    CentralLogBucketName=REPLACE_STAGE_1_BUCKET \
    MonitoringEmail=REPLACE_EMAIL
```

This creates VPN #1, the hub VPC Flow Log, the multi-region CloudTrail, the SNS
topic and the core hub resources. Confirm the SNS email subscription.

AWS generates VPN #1's tunnel addresses during this deployment. Obtain them:

```sh
aws ec2 describe-vpn-connections \
  --region eu-west-1 \
  --filters Name=tag:Name,Values=EG334S-vpn1-connection \
  --query 'VpnConnections[0].VgwTelemetry[].OutsideIpAddress' \
  --output text
```

Update the same stack with the same required parameters plus
`Vpn1Tunnel1OutsideIp` and `Vpn1Tunnel2OutsideIp` to enable the metric-math
alarm.

## 3. Deploy Azure core resources and the VPN gateway

Create the resource group if necessary, then deploy with the VPN connection
disabled:

```sh
az group create --name eg334s-rg --location southeastasia

az deployment group create \
  --resource-group eg334s-rg \
  --template-file eg334s-azure-cell.bicep \
  --parameters \
    sshPublicKey=REPLACE_SSH_PUBLIC_KEY \
    adminSourceCidr=REPLACE_WITH_YOUR_IP_32 \
    deployVpnGateway=true \
    deployVpnConnection=false
```

Record the `vpnGatewayPublicIp` deployment output.

## 4. Add AWS VPN #2

Update the `eu-west-1` stack with its previous parameters plus:

```text
CreateAzureVpn=true
AzureGatewayPublicIp=REPLACE_STAGE_3_IP
```

Record the `AzureVpnConnectionId` output. Retrieve the two outside tunnel
addresses for the alarm:

```sh
aws ec2 describe-vpn-connections \
  --region eu-west-1 \
  --vpn-connection-ids REPLACE_VPN2_ID \
  --query 'VpnConnections[0].VgwTelemetry[].OutsideIpAddress' \
  --output text
```

Download the AWS vendor configuration for VPN #2 into a protected local file.
It contains the pre-shared keys and must not be committed. Use one AWS tunnel
outside address and its matching key for the Azure connection.

## 5. Complete the Azure VPN connection

Put the sensitive values in a private ARM parameter file outside the
repository, then update the same Bicep deployment with:

```text
deployVpnGateway=true
deployVpnConnection=true
awsVpnTunnelPublicIp=REPLACE_AWS_TUNNEL_IP
vpnSharedKey=REPLACE_MATCHING_PSK
```

Use `az deployment group what-if` first, then `az deployment group create`.

## 6. Enable the VPN #2 alarm and verify

Update the `eu-west-1` stack again with the same parameters plus
`Vpn2Tunnel1OutsideIp` and `Vpn2Tunnel2OutsideIp`.

Verify:

```sh
aws cloudformation describe-stacks --region us-east-1
aws cloudformation describe-stacks --region eu-west-1
aws ec2 describe-vpn-connections --region eu-west-1
aws cloudwatch describe-alarms --region eu-west-1
aws cloudtrail get-trail-status --region eu-west-1 --name EG334S-audit-trail
az deployment group what-if --resource-group eg334s-rg --template-file eg334s-azure-cell.bicep
```

The templates cover the core cells, both VPN connections, both VPC Flow Logs,
CloudTrail, SNS and the two VPN alarms. Cost budgets, the dashboard feed and
its scheduled refresh remain separate operational controls.