Second discovery pass over the Scrivas EC2 estate (716468089330, us-east-2,
7 instances), prompted by the client reporting reliability issues and by their
lack of access to source code held under contract by the incumbent vendor.
Source code recovery
- All 10 application repositories exist as complete git checkouts on
Scrivas-owned instances, with full history rather than deployed artifacts:
4 app repos on Scrivas_dev_env, 6 ML repos on ML_dev.
- Every remote points at git@git.devteam.space (the contractor's self-hosted
GitLab), which Scrivas does not control. The on-instance checkouts are the
client's only independent leverage over their own source.
- Gap: both /var/www frontends are build output with no .git, so frontend
source is not recoverable from EC2.
- Time-sensitive: scrivas_backend received a commit on the assessment date.
Reliability triage
- Production runs 23 containers on a single 15 GiB host, including 3 Postgres
instances, Kafka and OpenSearch, at 73% memory at rest with no per-container
memory limits and no swap on any of the 7 instances.
- Kafka, OpenSearch and search-api carry restart policy `no`, so a host reboot
yields a partially-recovered stack.
- Recorded as a structural exposure, not an observed root cause: no OOM event
is present in retained logs and RestartCount is 0 on every prod container.
Confirming the hypothesis needs CloudWatch history the boxes do not retain.
Contents
- scripts/ec2_code_discovery.py EC2 inventory (describe + user data)
- scripts/ec2_code_inspect.py read-only SSM probe set, reviewable in PROBES
- findings/ec2_code_discovery_report.md narrative writeup
- findings/code_dashboard.html client-facing dashboard
- findings/ec2_code_inspect*.json raw probe output
- index.html links the new dashboard and evidence
All access was read-only: no writes, restarts or config changes on any
instance. Probe output was scanned for credentials before commit; git metadata
was read as the owning user rather than by writing a safe.directory entry.
Claude-Session: https://claude.ai/code/session_01YMxVaHXJsqpqKwncNQ9b1e
Expand the levers table from 5 to 8 workstreams, grounding each driver in
verified counts from the Prowler run:
- Add backup & resilience (0 of 9 EBS volumes have snapshots or a backup plan)
- Add secrets & key management (19 secrets without rotation or resource policy,
2 KMS keys without auto-rotation, unencrypted log groups)
- Add compliance acceleration (363 failures; SOC 2 at 81% against existing
Secureframe program)
- Note Config alongside GuardDuty and Security Hub in the delegated-admin gap
- Add the two criticals and hardware-MFA gaps to identity hardening
- Add internet-facing instances with instance profiles and IMDSv2 to exposure
- Order by priority and add a framing note
Read-only cloud discovery of the Scrivas AWS Organization (o-qfj0pvhhv7)
to inform a proposal.
- scripts/: boto3 org assessment, member-account assessment, fast discovery
- findings/: self-contained HTML dashboards, written report, summary JSON,
and the rendered Prowler benchmark report
- docs/full_discovery_plan.md: phased full-discovery plan
- index.html: landing page linking all reports
- Pipfile/.python-version: reproducible pipenv env (Python 3.12.11)
Large raw scans (OCSF JSON, CSV, compliance/) are git-ignored.
Alvaro Del Valle
adelvalle