{
  "generatedAt": "2026-07-29T11:17:54.727Z",
  "region": "us-east-1",
  "network": {
    "vpcId": "vpc-0a7372998ea5c1c83",
    "cidr": "10.42.0.0/16",
    "azs": [
      "us-east-1a",
      "us-east-1b"
    ],
    "subnets": {
      "public": [
        {
          "cidr": "10.42.0.0/24",
          "az": "us-east-1a",
          "autoAssignPublicIp": false
        },
        {
          "cidr": "10.42.1.0/24",
          "az": "us-east-1b",
          "autoAssignPublicIp": false
        }
      ],
      "app": [
        {
          "cidr": "10.42.10.0/24",
          "az": "us-east-1a",
          "autoAssignPublicIp": false
        },
        {
          "cidr": "10.42.11.0/24",
          "az": "us-east-1b",
          "autoAssignPublicIp": false
        }
      ],
      "data": [
        {
          "cidr": "10.42.20.0/24",
          "az": "us-east-1a",
          "autoAssignPublicIp": false
        },
        {
          "cidr": "10.42.21.0/24",
          "az": "us-east-1b",
          "autoAssignPublicIp": false
        }
      ]
    },
    "routing": {
      "publicDefaultViaIgw": true,
      "privateDefaultRoutes": 0,
      "privateRouteTables": [
        {
          "name": "net-app-rt",
          "hasDefaultRoute": false,
          "gatewayEndpointRoutes": 2
        },
        {
          "name": "net-data-rt",
          "hasDefaultRoute": false,
          "gatewayEndpointRoutes": 2
        }
      ],
      "natGateways": 0
    }
  },
  "securityTiers": {
    "groups": [
      {
        "tier": "app",
        "name": "net-app-sg",
        "ingress": [
          {
            "port": 8080,
            "peers": [
              "net-web-sg"
            ]
          }
        ],
        "egress": [
          {
            "port": 443,
            "peers": [
              "0.0.0.0/0"
            ]
          }
        ]
      },
      {
        "tier": "data",
        "name": "net-data-sg",
        "ingress": [
          {
            "port": 5432,
            "peers": [
              "net-app-sg"
            ]
          }
        ],
        "egress": []
      },
      {
        "tier": "vpce",
        "name": "net-vpce-sg",
        "ingress": [
          {
            "port": 443,
            "peers": [
              "10.42.0.0/16"
            ]
          }
        ],
        "egress": []
      },
      {
        "tier": "web",
        "name": "net-web-sg",
        "ingress": [
          {
            "port": 443,
            "peers": [
              "0.0.0.0/0"
            ]
          }
        ],
        "egress": [
          {
            "port": 8080,
            "peers": [
              "net-app-sg"
            ]
          },
          {
            "port": 5432,
            "peers": [
              "10.42.0.0/16"
            ]
          },
          {
            "port": 443,
            "peers": [
              "0.0.0.0/0"
            ]
          }
        ]
      }
    ],
    "defaultSgLocked": true
  },
  "nacls": {
    "nacls": [
      {
        "name": "net-private-nacl",
        "subnets": 4,
        "entries": [
          {
            "rule": 100,
            "direction": "egress",
            "action": "allow",
            "protocol": "tcp",
            "ports": "0-65535",
            "cidr": "0.0.0.0/0"
          },
          {
            "rule": 90,
            "direction": "ingress",
            "action": "deny",
            "protocol": "tcp",
            "ports": "3389",
            "cidr": "0.0.0.0/0"
          },
          {
            "rule": 100,
            "direction": "ingress",
            "action": "allow",
            "protocol": "tcp",
            "ports": "0-65535",
            "cidr": "10.42.0.0/16"
          },
          {
            "rule": 110,
            "direction": "ingress",
            "action": "allow",
            "protocol": "tcp",
            "ports": "1024-65535",
            "cidr": "0.0.0.0/0"
          }
        ]
      },
      {
        "name": "net-public-nacl",
        "subnets": 2,
        "entries": [
          {
            "rule": 100,
            "direction": "egress",
            "action": "allow",
            "protocol": "tcp",
            "ports": "0-65535",
            "cidr": "0.0.0.0/0"
          },
          {
            "rule": 90,
            "direction": "ingress",
            "action": "deny",
            "protocol": "tcp",
            "ports": "3389",
            "cidr": "0.0.0.0/0"
          },
          {
            "rule": 100,
            "direction": "ingress",
            "action": "allow",
            "protocol": "tcp",
            "ports": "443",
            "cidr": "0.0.0.0/0"
          },
          {
            "rule": 110,
            "direction": "ingress",
            "action": "allow",
            "protocol": "tcp",
            "ports": "1024-65535",
            "cidr": "0.0.0.0/0"
          }
        ]
      }
    ],
    "deny3389": true
  },
  "endpoints": {
    "endpoints": [
      {
        "service": "dynamodb",
        "type": "Gateway",
        "state": "available"
      },
      {
        "service": "s3",
        "type": "Gateway",
        "state": "available"
      },
      {
        "service": "ec2messages",
        "type": "Interface",
        "state": "available"
      },
      {
        "service": "ssm",
        "type": "Interface",
        "state": "available"
      },
      {
        "service": "ssmmessages",
        "type": "Interface",
        "state": "available"
      }
    ],
    "gatewayAvailable": 2,
    "interfaceAvailable": 3
  },
  "flowLogs": {
    "active": true,
    "windowMinutes": 30,
    "totalEvents": 579,
    "accept": 369,
    "reject": 210,
    "rejectSamples": [
      {
        "srcAddr": "66.132.186.133",
        "dstPort": 9626,
        "protocol": "tcp"
      },
      {
        "srcAddr": "85.217.140.49",
        "dstPort": 58544,
        "protocol": "tcp"
      },
      {
        "srcAddr": "3.131.24.55",
        "dstPort": 10002,
        "protocol": "tcp"
      },
      {
        "srcAddr": "45.144.220.67",
        "dstPort": 22,
        "protocol": "tcp"
      },
      {
        "srcAddr": "45.164.218.107",
        "dstPort": 6238,
        "protocol": "udp"
      },
      {
        "srcAddr": "50.116.52.199",
        "dstPort": 448,
        "protocol": "tcp"
      }
    ]
  },
  "probes": [
    {
      "name": "private-internet-egress",
      "from": "private-app",
      "label": "private app tier → internet",
      "expect": "blocked: no NAT, no route",
      "pass": true,
      "detail": "exit 28, 000"
    },
    {
      "name": "private-s3-gateway",
      "from": "private-app",
      "label": "private app tier → S3 (gateway endpoint)",
      "expect": "reachable: prefix-list route, $0",
      "pass": true,
      "detail": "exit 0, 307"
    },
    {
      "name": "private-ddb-gateway",
      "from": "private-app",
      "label": "private app tier → DynamoDB (gateway endpoint)",
      "expect": "reachable: prefix-list route, $0",
      "pass": true,
      "detail": "exit 0, 200"
    },
    {
      "name": "imdsv1-blocked",
      "from": "private-app",
      "label": "IMDSv1 request (no session token)",
      "expect": "rejected with 401",
      "pass": true,
      "detail": "exit 0, 401"
    },
    {
      "name": "imdsv2-works",
      "from": "private-app",
      "label": "IMDSv2 request (session token)",
      "expect": "answers with the instance id",
      "pass": true,
      "detail": "exit 0, i-04b5c1c9231c3586e"
    },
    {
      "name": "public-internet-egress",
      "from": "public-web",
      "label": "public web tier → internet",
      "expect": "reachable via the IGW",
      "pass": true,
      "detail": "exit 0, 200"
    },
    {
      "name": "web-to-app-8080",
      "from": "public-web",
      "label": "web tier → app tier :8080",
      "expect": "reachable: app SG admits the web SG",
      "pass": true,
      "detail": "exit 0, 200"
    },
    {
      "name": "web-to-data-5432",
      "from": "public-web",
      "label": "web tier → app tier :5432",
      "expect": "blocked by the app tier's security group",
      "pass": true,
      "detail": "exit 124"
    }
  ],
  "reachability": [
    {
      "key": "igw-to-app-8080",
      "label": "internet (IGW) → app tier :8080",
      "port": 8080,
      "expectReachable": false,
      "reachable": false,
      "status": "succeeded",
      "pass": true,
      "because": "private subnets have no route to/from the IGW",
      "explanationCodes": [
        "IGW_PRIVATE_IP_ASSOCIATION_FOR_INGRESS",
        "ENI_SG_RULES_MISMATCH"
      ]
    },
    {
      "key": "igw-to-web-443",
      "label": "internet (IGW) → web tier :443",
      "port": 443,
      "expectReachable": true,
      "reachable": true,
      "status": "succeeded",
      "pass": true,
      "because": "public route table + web SG admit HTTPS",
      "explanationCodes": []
    },
    {
      "key": "web-to-app-5432",
      "label": "web tier → app tier :5432",
      "port": 5432,
      "expectReachable": false,
      "reachable": false,
      "status": "succeeded",
      "pass": true,
      "because": "the data port is not open between these tiers",
      "explanationCodes": [
        "ENI_SG_RULES_MISMATCH"
      ]
    },
    {
      "key": "web-to-app-8080",
      "label": "web tier → app tier :8080",
      "port": 8080,
      "expectReachable": true,
      "reachable": true,
      "status": "succeeded",
      "pass": true,
      "because": "app SG admits 8080 from the web SG",
      "explanationCodes": []
    }
  ]
}