Home/Templates/An analysis machine that cannot reach production
An analysis machine that cannot reach production
A clean-room virtual machine for looking at suspicious files, with no route to anything live.
Terraform
Why bother
Opening malware or reviewing a disk image on a machine that can reach production turns one incident into two. This builds a workstation with no way out and a snapshot taken when it shuts down.
How you know it worked
From the workstation, try to reach a production subnet. It should fail.
Not written yet
No code exists for this one. It is listed so the gap shows on the coverage table. When it is written, each platform will use:
| Platform | Service |
|---|---|
| AWS | An isolated VPC with no internet gateway, reached through SSM only |
| Azure | An isolated virtual network with an Azure Virtual Desktop pool and no peering |