NBCB Internal Server Metrics

EC2 CPU

17%

Load low, vibes high

EC2 Memory

42%

No swap, no stress

Root Disk

68%

/var/log a bit thicc

Network (in/out)

2.6 / 0.9 MBps

Last 60s average

HTTP 5xx

0.9%

Mostly fine, mostly

Active Sessions

128

pod-talk-web + storage-panel

CloudFront Hits

92%

Cache doing overtime

Origin Pulls (S3)

8%

Assets mostly cached

S3 Storage Used

14.2 GB

nbcb-static-files

public-read: yes

IAM Risk Score

MEDIUM

Least privilege pending

Instance Info RUNNING

InstanceId: i-0nbcb12345f00dbabe InstanceType: t3.small Region: ap-southeast-1 AZ: ap-southeast-1a PrivateIP: 10.0.2.41 Uptime: 4d 07h 12m AMI: ubuntu-22.04-lts IMDS: v1 enabled (legacy)

Note: values may be delayed due to “migration mode”.

Service Health GREEN

Service	Status	Notes
pod-talk-web	OK	responding normally
trend-scraper	DEGRADED	rate limiting by “someone”
very-secure-storage	OK	vault locked (probably)
cdn-origin	OK	static assets served fast
metrics-panel	OK	definitely not leaking anything

Heads up: we’re still moving old on-prem stuff into cloud storage. If you see folders like /backup/ or /static-archive/, pretend you didn’t.

Traffic SnapshotLast 5 mins

Requests/min380

Error rate0.9%

p95 latency210ms

Top endpoint/api/fetch?url=

Totally harmless URL fetcher

Recent Logs (sanitized)tail -n 14

[INFO] 2025-12-02 08:01:12 healthcheck OK [INFO] 2025-12-02 08:02:09 /static/style.css served via CDN [WARN] 2025-12-02 08:03:44 backup sync retrying: s3://nbcb-static-files/backup/ [INFO] 2025-12-02 08:04:01 migration job: onprem-export.xml copied [WARN] 2025-12-02 08:04:55 IMDS v1 still enabled for legacy app [INFO] 2025-12-02 08:05:13 user "chan-ma-li" tested least privilege [INFO] 2025-12-02 08:05:57 /secrets/flag1 access denied (as expected) [WARN] 2025-12-02 08:06:30 cloudfront dir listing blocked in browser

Sanitized means “we removed the scary parts”. Mostly.

Security Group Snapshotsg-0nbcb00badbeef

Port	Source	Reason
22/tcp	0.0.0.0/0	temporary admin access (will close later)
80/tcp	0.0.0.0/0	pod-talk web
443/tcp	0.0.0.0/0	cdn + storage panel
9100/tcp	10.0.0.0/16	node exporter

“Temporary” since 2023-eh.

IAM Findingslast scan: 6h ago

Finding	Severity	Notes
iam:AddUserToGroup detected	HIGH	needed for migration scripts (??? maybe idk)
Access keys older than 90 days	MED	rotate after launch
MFA missing on 1 user	LOW	user said “later lah”

S3 Hot Foldersnbcb-static-files

Prefix	Objects	Notes
/static/	1,204	public CDN assets
/backup/	12	old exports + “final_final.zip”
/admin/	4	requires authenticated access
/secrets/	1	do not touch pls

Scheduled Jobssystemd timers

02:00 backup-sync.service s3://nbcb-static-files/backup/ 03:30 log-rotate.service /var/log/nginx/* 04:15 metrics-push.service pushgateway:9091 05:00 migration-retry.service /opt/migrate_secrets.ps1

Some jobs run with “elevated” roles for convenience.

Search Resultstype anything above