AWS Architecture

golemsec runs entirely in AWS, provisioned via Terraform (D:\golemsec\terraform) and configured via AWS SSM Run Command (no RDP/SSH exposure required).

Account & region

Item	Value
AWS account	517798688500 (shared account; golemsec isolated in its own VPC)
Local CLI profile	binary (IAM user grimmjow)
Region	us-east-1, single-AZ (us-east-1a)
Tagging	Everything tagged Project=golemsec, ManagedBy=terraform
Cost posture	Full fleet ≈ $0.87/hr (~$630–780/mo if 24×7). Stop instances when idle. pfSense Plus adds ~$0.24/hr software fee while running.

Network

• VPC: vpc-018f15d8bc3e88255 — 10.50.0.0/16
• Edge/egress: pfSense Plus appliance acts as router / NAT / firewall. No NAT Gateway (cost). Private route tables default-route to the pfSense LAN ENI; pfSense does hybrid outbound NAT for 10.50.0.0/16.
• Public ingress: the 20 internal hosts have no public IPs; their security groups allow only 10.50.0.0/16 traffic — not reachable from the internet. The only public surface is the pfSense edge (EIP 35.170.40.167), whose security group permits inbound only from the operator IP 62.0.120.29/32 on OpenVPN (1194/udp), SSH (22), and HTTPS (443). No 0.0.0.0/0 ingress anywhere. Management is via SSM Session Manager (needs no inbound at all). (To change your source IP, update the three rules on golemsec-sg-public; for true zero-inbound, remove them and use SSM only.)

Disaster recovery (snapshots)

A full set of DR AMIs (golemsec-dr-<host>-<date>, tagged DR=true) is captured for all 21 instances from a clean stopped state — a point-in-time recovery image of the whole environment (OS + all data: AD, mailboxes, the PII DB, app state).

• Restore a host: launch a new instance from its golemsec-dr-* AMI into the same subnet/SG (re-assign the private IP if needed).
• Refresh DR: re-run while the fleet is parked for a clean snapshot.
• Prune (stop snapshot cost): deregister old AMIs + delete their snapshots — snapshot storage (~$0.05/GB-mo of used data) is the only ongoing cost.
• DNS: VPC DHCP options point at the domain controllers; DCs forward to 169.254.169.253. Public golemsec.io zone lives in Cloudflare.

Subnets (per-tier segmentation = "VLANs" via subnets + SGs)

Subnet	CIDR	Security Group	Tier purpose
golemsec-public	10.50.0.0/24	sg-014f555a3a8b2dfc1	Edge — pfSense, EIP
golemsec-dmz	10.50.10.0/24	sg-0606f4f745cf716e8	Internet-facing-style apps (Nextcloud)
golemsec-server	10.50.20.0/24	sg-0d4e58b5e79103183	Core servers (AD, Exchange, Keycloak, app servers, dev)
golemsec-data	10.50.30.0/24	sg-01263b76858fc0006	Databases — isolated route table
golemsec-security	10.50.40.0/24	sg-08813dfe0f55430e3	Security tooling (Wazuh)
golemsec-mgmt	10.50.50.0/24	sg-0cae08e03887bf98e	Management/NOC (Zabbix, WSUS, Veeam)
golemsec-endpoint	10.50.60.0/24	sg-087a1717214a536dd	Workstations (Windows endpoints)

Segmentation is real and enforced. Example: the DMZ subnet (Nextcloud) cannot reach the data-tier databases — that's the isolated data route table doing its job, not a fault. Data-tier provisioning requires a temporary egress route that is reverted afterward to restore isolation.

Egress & provisioning notes

• Egress path: instance → pfSense LAN ENI → hybrid NAT → IGW. SSM agents that boot before egress is up go into long backoff — reboot to force re-registration.
• Provisioning: all OS/app config is pushed via SSM Run Command (AWS-RunShellScript for Linux, AWS-RunPowerShellScript for Windows). Payloads must be ASCII-only and delivered via file:// JSON.
• S3 transfer: large artifacts (e.g. the Veeam ISO) move via the golemsec-transfer-517798688500 bucket through an S3 Gateway VPC endpoint on the private route table (the AMIs lack the AWS CLI, so use Read-S3Object).

Key fixed identifiers

Resource	Value
VPC	vpc-018f15d8bc3e88255
pfSense instance / EIP	i-0c779ea25c7dd773c / 35.170.40.167
pfSense SSH	key D:\golemsec\golemsec-key.pem, user ec2-user
SSM IAM role	golemsec-ssm-role (+ inline s3-read)
S3 transfer bucket	golemsec-transfer-517798688500

See Systems Inventory for the full instance list with IDs and IPs.