Hybrid Enterprise Multi-Cloud Architecture

School deployment · accepted operating environment

Operator console · one-click checks

Plain-spoken console for the assessors. These buttons do not fake the network. They open the exact live-check or evidence path and show the command we use for that scenario.

Live multi-cloud overview

Critical path · protect this chain, cut everything else first

Technical milestones · evidence-backed status

5-week plan · back-planned from teardown

Team & responsibilities PROVISIONAL

Working allocation only. The team has not confirmed the report section order or final ownership. These cards show current preparation areas and must not be read as approved section assignments.

Readiness planning · provisional preparation map

Preparation guide, not ownership sign-off. The team now has one shared presentation deck. Speaking ownership remains provisional until the team confirms the order and Responsibility Assignment Table. Use the shared TEAM REVIEW deck and the working report.

Decision record: report order, accountable section owners and presentation roles are TBD by the full team, coordinated by Casper, target: 7 Aug checkpoint. Confirmation sequence: agree the report order → assign one accountable owner to each section → update the Responsibility Assignment Table and this page → then run the readiness check.

The test to apply after ownership is confirmed. Have someone outside the team open the assigned material at random and ask one question. If the owner must read from the document to answer, more preparation is needed.

Interactive access is still a single point of failure. The automated refresh uses short-lived OIDC access and the operator scripts are shared, but the demo sessions, SSH keys and recovery path have not been proven from a second device. Backup operator TBD by the team by 12 Aug. Closure requires one end-to-end rehearsal with Bernard observing but not operating.

School deployment · component architecture & verified packet flows

DEPLOYED SCHOOL ENVIRONMENT · TEAM REVIEW
The school environment runs under the eg334s-team2 prefix in AWS Virginia and Ireland. The Azure workload is deployed in East Asia (Hong Kong); VPN #1 and VPN #2 each have one AWS tunnel endpoint UP, and the Ireland ALB has one healthy Apache target in each Availability Zone.

Deployment engineering reference Component-to-component connectivity, addressing, next hops, encrypted paths and verified application flow in one consolidated reference.

Open full-size engineering view View deployed connection matrix

How to read this view. Follow each numbered component and arrow from its source address through the route or gateway to the destination. VPN #1 and VPN #2 terminate on Ireland VGW vgw-02efe604037a218cf. The VGW exchanges routes with each remote network but does not forward traffic from one VPN connection into the other; Virginia–Azure transit remains outside the topology.

Evidence boundary. The identifiers and addresses below are dated deployment evidence and can change after a rebuild. The live target-health and VPN status must be checked again before a demonstration.

Deployed connection matrix · source, destination, route and protocol 9 VERIFIED FLOWS / CONTROLS

The table separates application delivery, internal forwarding, encrypted transit and the management/evidence plane. Provider-generated values are dated school-environment evidence, not portable inputs.

Connection	Source component / address	Destination component / address	Route or next hop	Protocol / ports	Return path and observed state
Public application entry	Internet client Dynamic public source address	eg334s-team2-alb-alb-705364735.eu-west-1.elb.amazonaws.com AWS-managed ALB node addresses can change.	Public DNS resolves the internet-facing ALB; listener selects the shared target group.	TCP/80 HTTP	Selected target → ALB → client. Acceptance: listener active and both targets healthy.
ALB → Web Node 1	ALB service nodes ALB security group	Web Node 1 Apache EC2 · 10.1.1.119:80 eu-west-1a	Target group sends requests to the registered instance in subnet 10.1.1.0/24.	TCP/80 HTTP + health checks	Target → ALB → client. Acceptance: target healthy in eu-west-1a.
ALB → Web Node 2	ALB service nodes ALB security group	Web Node 2 Apache EC2 · 10.1.2.111:80 eu-west-1b	Same target group sends requests to the ASG-managed instance in subnet 10.1.2.0/24.	TCP/80 HTTP + health checks	Target → ALB → client. Acceptance: desired 1 and target healthy in eu-west-1b.
Virginia workload → VPN router	Private test host 10.0.1.104	strongSwan EC2/ENI 10.0.1.55	Virginia route table targets the strongSwan instance/ENI for 10.1.0.0/16. No current route is published for 10.2.0.0/16.	Private payload ICMP / permitted test traffic	Router forwards replies to 10.0.1.104. IPv4 forwarding persistently enabled · source/destination check disabled
VPN #1 · Virginia ↔ Ireland	strongSwan Elastic IP 174.129.120.215 Private CIDR 10.0.0.0/16	AWS endpoints 34.247.246.9 UP 176.34.108.143 DOWN	vpn-0304048c980934f5a terminates on vgw-02efe604037a218cf.	IKEv1 · static UDP/500 UDP/4500 NAT-T	Ireland learns 10.0.0.0/16 through VGW propagation. Acceptance: at least one tunnel endpoint UP.
VPN #2 · Ireland ↔ East Asia	AWS endpoints 52.51.60.239 UP 52.211.121.132 DOWN	Azure VNet Gateway Public IP 20.24.123.36 Private CIDR 10.2.0.0/16	vpn-0106da6f9a20b1302 connects the Ireland VGW to eg334s-team2-vpngw.	IKEv2 · route-based/static UDP/500 UDP/4500	Azure LNG represents 10.1.0.0/16; Ireland learns 10.2.0.0/16 through the VGW. Acceptance requires Azure Connected plus private ICMP/HTTP.
Azure gateway → workload	VNet Gateway GatewaySubnet 10.2.255.0/27	nginx VM 10.2.1.4 Subnet 10.2.1.0/24	Azure VNet system route delivers traffic to the workload subnet; the workload NSG is evaluated.	Private ICMP TCP/80 HTTP	VM returns through the VNet Gateway route for the Ireland prefix 10.1.0.0/16.
AWS telemetry and evidence flow	Both AWS VPCs CloudTrail CloudWatch	Retained S3 audit storage CloudWatch dashboard SNS topic	Provider-managed service delivery; separate from the application data path.	VPC Flow Logs CloudTrail API events CloudWatch metrics	Provides dated verification, alarm notification and teardown evidence.
Azure management flow	Authorised operator Azure control plane	Azure VM and resource group eg334s-team2-rg	Run Command requires VM action permission. Reader permits inspection only; it does not permit command execution.	Azure management-plane HTTPS	Activity Log records changes. Additional team access remains a separate, least-privilege administration task.

Deliverables · current working artefacts

School team connectivity lab · deployed test endpoints

A concise operator view for team members to verify the two supported encrypted paths after the school build. It publishes target commands—not passwords, SSH keys, access tokens, account identifiers or VPN pre-shared keys.

Diagrams · network, recovery, evidence and build sequence

1 · Core network and VPN topology

Deployed design reference, not a substitute for live telemetry. The diagram follows the reconciled CloudFormation and Bicep design: Virginia has one public subnet; the Ireland application entry spans public subnets in eu-west-1a and eu-west-1b; Azure has one workload subnet and one GatewaySubnet. VPN #1 and VPN #2 are the current encrypted paths. The strongSwan EC2 owns the Elastic IP, has IPv4 forwarding persistently enabled and source/destination checking disabled, and routes traffic for the separate Amazon Linux 2 ICMP/SSH test host. Provider-managed addresses can change after rebuilding, and the VGW remains deliberately non-transitive. The live map and state banner above are authoritative for current availability. Open editable vector · Open historical commissioning capture.

2 · Two-AZ ALB application resilience · Test 9

Current school-deployment evidence. Test 9 abruptly stopped Web Node 1 in eu-west-1a while Web Node 2 in eu-west-1b remained registered and healthy behind the same ALB. Across 203 one-second samples, 198 returned HTTP 200 and five transient failures were retained while ALB health detection converged in 36.8 seconds. Both targets were restored healthy. This proves two-AZ application-target resilience; it does not claim a whole-AZ, ALB, VPC, VGW or regional failure, and it does not claim zero interruption. Open Test 9 recording.

3 · Live evidence and public-dashboard pipeline

Why the public evidence is trustworthy. GitHub Actions uses AWS and Azure OIDC to collect state normally hourly and the larger inventory approximately every three hours. Complete, error-aware JSON is written to Workers KV as the primary path; committed files are the browser fallback. The Cloudflare watchdog checks KV every five minutes and dispatches a freshness-gated workflow only when needed, while the native GitHub schedule is an independent fallback. The dashboard distinguishes fresh, stale, partial and unreachable: freshness never substitutes for completeness, and no VPN PSK, SSH key or cloud credential is published. Open editable vector.

4 · Cross-cloud build sequence

Figure 6.1. The cross-cloud build order. Step 3 is the hinge: AWS only generates the tunnel addresses and pre-shared keys once the VPN connection exists, so neither cloud can be completed first. The seam has to be walked once, in order, by hand.

5 · Supporting service catalogue · report Figure 5.7

Figure 5.7. The VPN environment and the services around it. The two VPN connections are the assets being protected; AWS supplies two tunnel endpoints for each connection. The current templates define both VPC Flow Logs, the multi-region CloudTrail, SNS and both VPN alarms. AWS Budgets and the CloudWatch dashboard remain separate account-level controls. The retained central S3 bucket is intentionally left after stack deletion until evidence is preserved and it is explicitly emptied and removed. Current deployed ownership must be proved from describe-stack-resources; until a complete inventory succeeds, it is TBD rather than assumed. Open the ownership matrix.

Test results · six tests, five pass, one expected fail

Test 4 proves application traffic crossed an encrypted path between two cloud providers and returned a response. Test 5 preserves the VGW negative test: knowing the boundary of the chosen architecture is part of demonstrating it correctly. Test 6 proves that one Ireland application target can fail while the second target continues serving after ALB health convergence.

Security & monitoring · detective controls live (Bernard · Security/Monitoring)

Security groups decide what is allowed. Alarms, trails and flow logs decide what is noticed. The VPN #2 alarm firing on a real outage is stronger proof than a pair of green ticks: it shows the detection path works end to end, from metric to alarm to SNS to inbox.

AWS hub automated recovery drill · PASS

Decision: protect the AWS hub application without duplicating or replacing the VPN infrastructure. The accepted objective is to restore the hub web service within 10 minutes of a detected EC2 failure. This is a controlled application-service recoverability drill—not full High Availability, regional disaster recovery, or VGW/VPN failover.

PASS · 3m 38s RTO ≤ 10 min standby 0 EC2 NOT FULL HA Azure proven separately

Cost monitoring · guardrails active (Bernard · Security/Monitoring)

Checking billing APIs…

How these numbers were obtained. Actual month-to-date spend comes from the Azure Cost Management API and AWS Cost Explorer. Projected daily run rates are estimates calculated from the Azure Retail Prices API and AWS Price List API against the real resource inventory. At the 25 Jul rate check, Azure VPN Gateway VpnGw1AZ was $0.21/hr, the Azure VM Standard_D2als_v7 was $0.101/hr, and each AWS Site-to-Site VPN connection was $0.05/hr.

Actual versus projected, and why they differ so much. The earlier $283 figure was a projection of what leaving everything running to the deadline would have cost. The current month-to-date values are displayed above from the billing APIs. Azure remains lower than the projection because the gateway runs only in short bursts—built, verified and torn down again—rather than continuously.

How fresh can this be? Azure Cost Management returns same-day data, though the current day keeps trickling in for several hours. AWS Cost Explorer lags a day or more and flags its figures as Estimated. So "live cost" does not exist on either cloud. What is real time is the resource inventory, which is what actually matters for catching something left running. Any team member with the documented read-only access can run ./scripts/refresh-cost.sh; it fails closed if either cloud login or a required billing field is unavailable.

Control lesson. The first guardrails covered AWS even though credits reduce its net bill to approximately zero, while the Pay-As-You-Go Azure subscription carried the cash cost. Azure now has its own monthly budget and alerts.

Guardrails are alert-only: the cloud emails you, you act. The cheapest guardrail is still teardown · delete-stack on AWS and az group delete on Azure between work sessions.

Risk watch · the things that actually bite

Owner means whoever can actually act. The programme manager tracks every risk on this list and chases all of them, but only owns the ones where he holds the lever. A risk assigned to someone who cannot discharge it is not managed, it is just parked.

Claim verification · dated evidence record

Identifiers are reconciled to the accepted school deployment. Current health and cost remain timestamped separately in the live banner.

Teardown checklist · run in every region before 30 Aug 23:59

School AWS IAM and key-pair cleanup is account-wide, not regional. Confirm project-tagged roles, instance profiles and both regional key-pair records as separate teardown controls.