Reading /evidence/status.json…
One command each way: make demo stakes out the whole
network, runs the Reachability Analyzer paths, executes the probe suite, and files fresh
evidence in about 15 minutes; make teardown strikes everything that bills (two
instances, three interface endpoints, flow logs) and leaves this page serving the final
report. Idle between windows: ~$0.
The blueprint
Three subnet tiers across two availability zones. Traffic is admitted one hop at a time: 443 from the internet to the web tier, 8080 from web to app, 5432 from app to data. The private tiers have no route to the internet at all.
Both instances are managed exclusively through SSM; no SSH port exists anywhere in the VPC. The public one registers over the internet, the private one through the three PrivateLink interface endpoints ($0.01/hr each: the plank's main running cost, and the reason it tears down between windows).
Send the inspector on a round
–
While the stack is staked out you can walk the site yourself. A round runs the eight probe commands on the two live instances via SSM Run Command, one at a time, and closes by checking the field results against the four Reachability Analyzer verdicts from the plan check. The blocked paths are part of the round: watching them fail on cue is the point. One inspector is out at a time; if a round is already under way you are handed that one to watch instead.
Checking whether the site is staked out…
the field book opens when a round goes out (or pick a recent round below)
Recent rounds
Yours and other visitors'. Records expire after 48 hours; pick one to read its field book back.
Loading…
Latest evidence report
–
No evidence has been generated yet. The first
make demo cycle will populate this section.
Reachability Analyzer verdicts the plan check
Four paths analyzed by AWS's configuration-analysis engine on every deploy. Two are designed to be reachable, two are designed not to be; the ✗ rows passing is the point.
| Path | Verdict |
|---|
Live connectivity probes the field inspection
Commands executed on both instances via SSM Run Command during report generation: the data plane agreeing with the control plane.
| Probe | Result |
|---|
Routing: the no-NAT pattern
VPC endpoints
Segmentation layers
Flow logs real internet noise
What this plank proves
- Segmentation you can verify, not just draw: every tier boundary is tested from both directions. Reachability Analyzer analyzes the configuration, and probe commands on the instances confirm the data plane, including the paths that are supposed to fail.
- Proof on demand, not a screenshot: while the stack is live, any visitor can send the inspector on a round and watch the eight probes walk the site one SSM command at a time, traced on the plan view, closed out against the analyzer verdicts. One round at a time, thirty per day, $0 per round.
- The no-NAT cost pattern: private subnets have no internet route at all, yet reach S3 and DynamoDB through free gateway endpoints. A NAT gateway idles at ~$33/month before data charges; knowing when you don't need one is real architecture.
- Zero SSH: both instances are administered through SSM Session Manager/Run Command, the private one over PrivateLink interface endpoints, so no bastion, no port 22, no key pairs exist anywhere in the design.
- Defense in layers: stateful security groups referencing groups (not CIDRs), stateless NACLs underneath with an explicit RDP deny, a locked default security group, IMDSv2 enforced, encrypted volumes. Each layer is visible in the evidence.
- Cost-honest architecture: instances, interface endpoints, and flow logs bill hourly, so the plank is deploy-demo-teardown by design. One command up, one command down, evidence persisted between windows.