dwg no. 09Alpenglow municipal worksas-built recorddate 2026-07-29checked twice

Network Blueprint Evidence Report

City of Alpenglow demo account · region us-east-1 · generated 2026-07-29T11:17:54.727Z by the net-evidence-report Lambda (plank 9, Planetek AWS Boardwalk)

How to read this sheet: every claim below is a live API result, a Reachability Analyzer verdict, or the output of a probe command executed on the instances via SSM Run Command during report generation. Rows marked as designed include the paths that are supposed to fail.

1 · VPC & subnets

VPC	`vpc-0a7372998ea5c1c83` · 10.42.0.0/16
Availability zones	us-east-1a, us-east-1b
Public tier	`10.42.0.0/24` (us-east-1a) · `10.42.1.0/24` (us-east-1b)
App tier (private)	`10.42.10.0/24` (us-east-1a) · `10.42.11.0/24` (us-east-1b)
Data tier (private)	`10.42.20.0/24` (us-east-1a) · `10.42.21.0/24` (us-east-1b)
Subnet-level auto-assign public IP	✗ no: public exposure is granted per-instance

2 · Routing: the no-NAT pattern

Public default route via IGW	✓ yes
Default routes in private route tables	0: private subnets have no internet path at all
NAT gateways	0 ($0.045/hr + per-GB, avoided by design)
Private route tables	`net-app-rt`: 2 gateway-endpoint routes, default route absent `net-data-rt`: 2 gateway-endpoint routes, default route absent

3 · Security-group tiers

Tier	Ingress / egress
`net-app-sg`	8080 ← net-web-sg egress: 443 ← 0.0.0.0/0
`net-data-sg`	5432 ← net-app-sg egress: none
`net-vpce-sg`	443 ← 10.42.0.0/16 egress: none
`net-web-sg`	443 ← 0.0.0.0/0 egress: 8080 ← net-app-sg · 5432 ← 10.42.0.0/16 · 443 ← 0.0.0.0/0
Default SG	locked zero rules; nothing can use it

4 · Network ACLs (stateless layer)

net-private-nacl · 4 subnets

Rule	Dir	Action	Ports	Source/Dest
100	egress	allow	0-65535	`0.0.0.0/0`
90	ingress	deny	3389	`0.0.0.0/0`
100	ingress	allow	0-65535	`10.42.0.0/16`
110	ingress	allow	1024-65535	`0.0.0.0/0`

net-public-nacl · 2 subnets

Rule	Dir	Action	Ports	Source/Dest
100	egress	allow	0-65535	`0.0.0.0/0`
90	ingress	deny	3389	`0.0.0.0/0`
100	ingress	allow	443	`0.0.0.0/0`
110	ingress	allow	1024-65535	`0.0.0.0/0`

5 · VPC endpoints

Service	Type · state
`dynamodb`	Gateway · available · free
`s3`	Gateway · available · free
`ec2messages`	Interface · available · $0.01/hr (why this plank tears down)
`ssm`	Interface · available · $0.01/hr (why this plank tears down)
`ssmmessages`	Interface · available · $0.01/hr (why this plank tears down)

6 · Reachability Analyzer verdicts

The plan check: AWS's own configuration-analysis engine ran each path during deploy, so reachable and unreachable claims are proven, not asserted.

Path	Verdict
internet (IGW) → app tier :8080	NOT reachable as designed private subnets have no route to/from the IGW · analyzer: `IGW_PRIVATE_IP_ASSOCIATION_FOR_INGRESS`, `ENI_SG_RULES_MISMATCH`
internet (IGW) → web tier :443	reachable as designed public route table + web SG admit HTTPS
web tier → app tier :5432	NOT reachable as designed the data port is not open between these tiers · analyzer: `ENI_SG_RULES_MISMATCH`
web tier → app tier :8080	reachable as designed app SG admits 8080 from the web SG

7 · Live connectivity probes (SSM Run Command)

The field inspection: commands executed on both instances, the data plane agreeing with the control plane.

Probe	Expected · result
private app tier → internet from private-app	blocked: no NAT, no route as designed exit 28, 000
private app tier → S3 (gateway endpoint) from private-app	reachable: prefix-list route, $0 as designed exit 0, 307
private app tier → DynamoDB (gateway endpoint) from private-app	reachable: prefix-list route, $0 as designed exit 0, 200
IMDSv1 request (no session token) from private-app	rejected with 401 as designed exit 0, 401
IMDSv2 request (session token) from private-app	answers with the instance id as designed exit 0, i-04b5c1c9231c3586e
public web tier → internet from public-web	reachable via the IGW as designed exit 0, 200
web tier → app tier :8080 from public-web	reachable: app SG admits the web SG as designed exit 0, 200
web tier → app tier :5432 from public-web	blocked by the app tier's security group as designed exit 124

8 · Flow logs

Flow log status	ACTIVE (all traffic, 60s aggregation)
Records in the last 30 min	579 total · 369 ACCEPT · 210 REJECT
Sample rejected flows	`66.132.186.133` → :9626/tcp · `85.217.140.49` → :58544/tcp · `3.131.24.55` → :10002/tcp · `45.144.220.67` → :22/tcp · `45.164.218.107` → :6238/udp · `50.116.52.199` → :448/tcp real internet background noise, turned away at the security group, captured minutes after the public IP went live