# EG334S school-account deployment plan Status: **PREPARED - NOT EXECUTED** Target: authorised school AWS account, with Bernard's Azure Singapore tenant used for the second-cloud cell unless the team approves another tenant. ## Outcome Recreate the assessed three-cell environment without copying physical IDs, credentials or VPN secrets from the personal account: 1. simulated on-premises VPC in AWS `us-east-1`; 2. application hub in AWS `eu-west-1`; 3. Azure VNet in `southeastasia`; 4. VPN #1 Virginia-Ireland and VPN #2 Ireland-Singapore; 5. two-AZ Ireland ALB with one active target per AZ, CloudTrail, VPC Flow Logs, CloudWatch alarms, SNS and retained S3 evidence. An optional fifth AWS template creates a private S3 origin and CloudFront distribution for chaptered evidence. It is not required for network acceptance and must be deployed only when public evidence hosting is approved. This directly covers the project requirement for three self-contained cloud cells, two required IPsec connections, web and private test servers, YAML CloudFormation, testing and teardown. The ALB, auto recovery and monitoring controls are additional assessed features. ## Team operating model The content/speaking order remains provisional. For deployment, use temporary operational roles that can rotate: | Role | Responsibility | Approval boundary | |---|---|---| | Deployment operator | Runs one documented stage | Cannot skip account and change-set gates | | Peer verifier | Reads command, account, region and parameters aloud | Must approve before each write | | Network tester | Runs route, tunnel, ICMP and HTTP tests | Does not handle PSKs | | Evidence recorder | Captures sanitized outputs and timestamps | Must redact accounts, keys and secrets | | Cost/teardown controller | Watches billable resources and owns deletion checklist | May stop the run at any cost or ownership anomaly | Bernard remains the credential holder unless the school assigns equivalent least-privilege roles to other team members. Shared root credentials are never permitted. ## Gates Proceed only when all are true: - school account ID is confirmed in writing; - `us-east-1` and `eu-west-1` are enabled; - required EC2, VPC, VPN, ALB, S3, CloudTrail, CloudWatch, SNS, CloudFormation and optional IAM permissions are available; - one EC2 key pair exists in each AWS region; - one approved administrator public IPv4 `/32` is available; - service quotas cover three EC2 instances, two AWS VPN connections, one VGW, one ALB, two Elastic IPs and the required VPCs/subnets; - the team has an attended window for VPN secrets and Azure gateway cost; - rollback and teardown owners are present. If IAM role creation is denied, deploy through the ALB stage and label automated hub recovery **provisional**. Do not weaken the template or use a broader role. ## Deployment stages and elapsed time | Stage | Work | Expected elapsed time | Exit evidence | |---|---|---:|---| | 0 | Account preflight, template validation, quotas, key pairs | 30-45 min | Read-only preflight PASS | | 1 | Virginia on-premises stack and central evidence bucket | 10-20 min | Stack outputs and Flow Log | | 2 | Ireland hub, VGW, VPN #1, CloudTrail and alarms | 15-25 min | Stack complete; VPN available | | 3 | Protect and install generated strongSwan configuration | 30-60 min | At least one VPN #1 tunnel UP | | 4 | Ireland second AZ and ALB | 10-20 min | ALB target healthy; HTTP 200 | | 5 | Active secondary controls | 15-25 min | ASG desired 1; both ALB targets healthy | | 6 | Azure gateway plus VPN #2 | 45-90 min | Azure VPN #2 Connected | | 7 | End-to-end acceptance and evidence | 60-90 min | Signed acceptance checklist | | 8 | Demonstration or teardown/parking | 30-60 min | Teardown verification | Allow **4-6 attended engineering hours** and **5-7 hours elapsed**. Azure VPN gateway provisioning is the largest variable. Do not schedule the assessed demonstration immediately after the nominal build finish. ## Controlled execution 1. Copy `school-account.env.example` outside Git, complete it and set mode 600. 2. Source it, then run: ```bash source /secure/path/school-account.env ./scripts/school-deploy.sh plan ``` 3. Record the account-ID confirmation. The `plan` action is read-only. 4. For the attended write window only: ```bash export EG334S_EXECUTE=DEPLOY ./scripts/school-deploy.sh deploy-onprem ./scripts/school-deploy.sh deploy-hub ./scripts/school-deploy.sh configure-vpn1-firewall ``` 5. Retrieve the AWS VPN vendor configuration into a protected file and install the completed strongSwan templates. Never record or commit the PSKs. 6. Deploy the ALB, then the active secondary: ```bash ./scripts/school-deploy.sh deploy-alb ./scripts/school-deploy.sh deploy-recovery ``` 7. Follow `SCHOOL_ACCOUNT_DEPLOYMENT.md` for staged VPN #2 because that stage exchanges runtime-generated endpoints and protected secrets between AWS and Azure. The helper intentionally does not automate PSK extraction or Azure secret entry. Those are attended security operations. ## Acceptance matrix | Test | Pass condition | |---|---| | IaC | All CloudFormation stacks complete; Bicep what-if reviewed | | VPN #1 | Connection available and at least one tunnel UP | | VPN #2 | AWS/Azure control planes agree; Ireland-Azure data path passes | | Azure-Virginia transit | Provisional until the Ireland Transit Gateway migration package is implemented and accepted | | Routing | `10.0.0.0/16`, `10.1.0.0/16`, `10.2.0.0/16` have only intended next hops | | Workloads | Private ICMP and HTTP tests return expected endpoints | | ALB | Two subnets in separate AZs; two healthy targets; public HTTP 200 | | Failure routing | Surviving target continues serving; any transient errors are measured and reported | | Monitoring | CloudTrail logging, two Flow Logs, alarms and SNS confirmed | | Evidence | Outputs are timestamped, sanitized and linked to the report | | Teardown | No unintended EC2, VPN gateway, ALB, EIP or retained disk remains | An acceptance failure is evidence, not permission to improvise. Record it, rollback the affected stage, and mark the capability **provisional**. ## Rollback and teardown Delete borrowers before owners: 1. recovery stack; 2. ALB stack; 3. Azure VPN #2 connection; 4. Azure gateway or resource group as approved; 5. Ireland hub stack, after VPN #2 is removed; 6. Virginia on-premises stack; 7. retained S3 evidence bucket only after retention approval. Run `verify-teardown.sh` and inspect both AWS regions and Azure. CloudTrail, Flow Log objects and public evidence may be retained only by an explicit team and lecturer decision. ## Cost control - Run the Azure VPN gateway only for build, test and demonstration windows. - Keep the secondary ASG at desired capacity one while active-active operation is required. Deliberately returning it to zero saves cost but ends the active-active claim. - Stop nonessential test EC2/VM workloads only after capturing required evidence; Site-to-Site VPN endpoints and ALB remain billable independently. - Confirm current prices and school credits immediately before deployment. - Set budget alerts before the first write and assign one person to teardown. The personal account remains a separate fallback test bed. It is not connected to the school account and does not prove school-account acceptance.