| Resource | Type | Age | Deletable |
|---|---|---|---|
vf-prod-nat-b left by an interrupted destroy · $32/mo |
nat_gateway | 41d | yes |
vf-prod-snap-0612 orphaned EBS snapshot · $4/mo |
ebs_snapshot | 54d | yes |
vf-prod-role-ingest-old IAM role · no generic delete-by-ARN on AWS |
iam_role | 78d | skipped — reported |
arn:aws:sgr:…/sgr-09ab security-group rule — identifier not projectable from state |
unknown — never deletable |
vf-prod-tfstate (S3) state backend — protected: deleting it strands the state describing every deploy |
protected |
proxy-body-size 8m → 64m, changed out-of-band 3d ago (kubectl, unaudited). ingress:
annotations:
- nginx.ingress.kubernetes.io/proxy-body-size: 8m # declared
+ nginx.ingress.kubernetes.io/proxy-body-size: 64m # live
Out-of-band changes are surfaced and asked about — never silently reverted.
| Pri | Rule | Source | Dest / port | Action | Owner |
|---|---|---|---|---|---|
| 100 | allow-https-inbound | Internet | LB · 443/tcp | allow | cf-managed |
| 110 | allow-health-probe | AzureLB | nodes · 10254/tcp | allow | cf-managed |
| 200 | allow-vnet-internal | VNet | VNet · any | allow | cf-managed |
| 300 | allow-nat-egress | snet-apps | allow-list · 443/tcp | allow | cf-managed |
| 350 | temp-allow-vendor-vpn added manually in the Azure portal · Aug 1 · not in declared state |
203.0.113.40/32 | nodes · 22/tcp | allow | manual · drift |
| 4000 | deny-ssh-inbound | Internet | any · 22/tcp | deny | cf-managed |
| 4096 | deny-all-inbound | any | any | deny | cf-managed |
| Environment | Cloud | Last scan | Managed | Orphaned | Unknown | Config drift | Reconcile capability |
|---|---|---|---|---|---|---|---|
| verde-foods / prod | aws | 13:47 today | 128 | 3 | 2 | 1 | report + best-effort clean |
| meridian-health / prod | azure | 13:02 today | 141 | 0 | 0 | 0 | full clean available |
| helios-energy / prod | azure | 12:40 today | 139 | 0 | 0 | 0 | full clean available |
| osaka-robotics / prod | aws | 11:15 today | 117 | 0 | 1 | 0 | report + best-effort clean |
| cobalt-mining / prod | air-gapped | bundle · 3d ago | 96 | 0 | 0 | 0 | report via bundle |
This is the exact deletion set that will execute — it is not recomputed after you confirm:
DELETE nat_gateway vf-prod-nat-b (~$32/mo) DELETE ebs_snapshot vf-prod-snap-0612 (~$4/mo) SKIP iam_role vf-prod-role-ingest-old — not deletable on AWS; reported
Type delete to confirm: