Sunset audit — 2026-09-11

Snapshot of every AWS resource this stack operates, with pre-sunset vs post-P0-flip state, plus a paying-customer-access probe. Companion to SUNSET_PLAN.md — this is what's actually on the ground after Phase 0 executed.

KEEP-set file-access probe

For each of the 4 paying-customer GUIDs, pulled the newest file CID from prod-BWS_BLOCKCHAIN_IPFS and did a HEAD https://ipfs.ninja/ipfs/{cid}/. All four resolved.

GUID	Customer	CID (sample)	HTTP
b428d488-…5ea38	Daniel Monks (karma)	QmWzgpCNVTprHv5fUXKiXBTxZZj2KPF27wLhLvphibtGDn	200
c418d448-…30cb	saori (karma)	QmcxfPh5weKQiF9PgRXabtZJWnBoVfzmA6PydQhvjDrJZz	200
74888468-…e6b0	Simon / tatout (bodhi)	bafybeiazhpzm2tmxw2dqqlbcjahcafaqioeeg2si3atx6rbz4t2krs2szi	200
14c80498-…5ffd	Ignacio Test (nirvana)	QmSFdUjxVgFHDsG7ECvaKkZBS4ydmkdAkDyaKyF71RYvh8	200
d4980408-…9904	Muhammad (trial, TK-…59249)	bafybeifxyvxwao3xxgbof5qgfegvdyxqb5wbzun4ybh5pyr6q7huhjw65i	200 (verified earlier)

The apex gateway's KEEP_USER_GUIDS filter is serving KEEP-owned CIDs and 410-ing everything else — behaviour matches design.

Resource inventory

1 — Lambda functions (169 total)

• Before: all invocable
• Now: all still deployed, but:
  • 6 lambdas carry SUNSET_UPLOADS_LOCKED=1 (New-Call, New-Api-Call, Upload-Large-Init, Upload-Large-Complete, Pin-CID-Call, Folder-Snapshot-Call) → reject non-KEEP callers with a 402
  • 1 lambda carries SIGNUPS_DISABLED=1 (User-Presignup) → rejects every Cognito PreSignUp trigger regardless of flow
  • 1 lambda carries SUNSET_CHECKOUT_LOCKED=1 (Stripe-Checkout-Call) → rejects all new checkout sessions
  • The Apex_gateway Lambda@Edge has the hardcoded KEEP set in code
• Phase 4 candidate: ~40 lambdas that only exist for acquisition/retention/SEO/marketing (Trial_expire, Trial_reactivation_nudge, Retention_day*, Lifecycle_emails, Followup_email, No_upload_reminder, Newsletter_send, Weekly_digest_send, Power_user_tease, Hour1_recovery, GSC_snapshot, Behavior_track, Behavior_aggregate, Attribution_sync, Auto_close_stale_tickets, SLA_breach_pager, Bandwidth/Storage_warning, Bandwidth_forecast, WAF_metrics_replayer, Cid_bw_quota_enforcer, IP_reputation_sync, Abuse_ip_scan, Paid_user_allowlist_sweeper, Dht_announce_canary, Gateway_customdomain_canary, User_status_sync, Threat_hash_import, Checkout_help_watcher, Trial_signup_rate_check, Manual_grant_reconciler)

2 — EventBridge rules (53 total)

• Before P0: 52 ENABLED (1 pre-existing DISABLED)
• After P0: 24 ENABLED · 29 DISABLED

Still enabled (paying-customer maintenance + billing + health + ops + safety): stripe-reconciler-daily · manual-grant-reconciler-daily · ipns-republish-daily · pin-resolve-10min · pin-safety-scan-10min · badbits-sync-hourly · threat-hash-import-hourly · gateway-bandwidth-hourly · gateway-bandwidth-monthly-reset · cid-bw-aggregate-hourly · bandwidth-reconcile-weekly · storage-reconcile-weekly · dedupe-reconcile-weekly · cost-rate-watcher-daily · codepipeline-failure · deploy-status-updater · auto-code-deploy-watcher-5min · health-canary-5min · health-cleanup-hourly · health-heavy-15min · health-infra-1min · health-logs-5min · health-rollup-1min

Disabled by P0: 29 rules — acquisition/retention/marketing/quota-enforcer (see SUNSET_PLAN.md for the full list).

3 — DynamoDB tables (32 total)

• Before: every table active, PAY_PER_REQUEST
• After: unchanged (data purge is Phase 3, not P0)

Categorization for Phase 4:

• Keep — prod-BWS_BLOCKCHAIN_IPFS (files), prod-BWS_IPFS_FOLDERS, prod-BWS_IPFS_USERS, prod-BWS_IPFS_API_KEYS, prod-BWS_IPFS_GATEWAYS, prod-BWS_IPFS_IPNS_KEYS, prod-BWS_IPFS_UPLOAD_TOKENS, prod-BWS_IPFS_SUPPORT_TICKETS, prod-BWS_IPFS_GATE, prod-MIDDLEWARE_SOLUTION_CREDITS, prod-SOLUTIONS
• Purge non-KEEP rows at Day 33 — the KEEP-write ones above
• Delete outright — prod-E2eRuns, prod-BWS_IPFS_BEHAVIOR_EVENTS, seo-tracking mirror (if any), prod-HEALTH_HISTORY (keep LATEST only), prod-DEPLOY_STATUS, prod-IP_REPUTATION, prod-CAMPAIGN_VISITS, prod-RATE_LIMIT_EVENTS, prod-BWS_IPFS_STATS (SIGNUP_IP counters)

4 — S3 buckets (15 total)

• Before: all in use
• After: unchanged
• Notable:
  • ${AccountId}-prod-bws-ipfs-content — mirror of small uploaded content, keep
  • ${AccountId}-prod-e2e-runs — E2E screenshots, Phase 4 delete (I just shipped this two days ago)
  • ${AccountId}-prod-folder-snapshot-jobs — chunk-staging, keep (7-day lifecycle already prunes it)
  • Devops build-artifact buckets — keep (still needed by pipeline)
  • Static-site buckets for blog/, docs/, admin/, frontend/ — keep for now; blog + docs eligible for Phase 4 delete

5 — CloudFront distributions (5 total)

Id	Aliases	Enabled	Sunset action
E2V22RZSULORO9	(no alias — origin only?)	yes	investigate, likely delete in P4
E3M6BVCACQKLZR	ipfs.bws.ninja	yes	keep (paying customers may use this)
E12I8PIFQ4KSUC	ipfs.ninja	yes	keep — apex gateway, this is where KEEP filter runs
E1XZLXC6IQP3KV	*.gw.ipfs.ninja	yes	keep (paying-customer dedicated gateways)
EB10TTGHDXXVR	admin.ipfs.ninja	yes	keep (admin dashboard)

6 — ECS / Kubo cluster

• Before: 3 Fargate services (us-east-1a, -1b, -1c), desired=1 running=1 each, 3 tasks total
• After: unchanged — 3 running
• Cost impact: ~$163/mo — biggest single line
• Phase 4 candidate: 3 → 1 task once data purge lets us repo/gc down to KEEP-set pins only. Est. saving ~$110/mo. Migration risk: need to verify KEEP customers' CIDs are still pinned on the remaining node before scaling other two down.

7 — EFS filesystems (3, one per Kubo task AZ)

ID	Size	Note
fs-0aeabbb8efd02cb37	138.9 GB	us-east-1a Kubo repo
fs-0f16eb3d5cc4c7f5a	129.3 GB	us-east-1b Kubo repo
fs-0c0ddd219d635002b	131.3 GB	us-east-1c Kubo repo

• Combined ~400 GB across the fleet — post-Day-33 gc + drop-2-tasks would collapse to ~10 GB on one fs
• Cost impact: ~$50/mo now → ~$1-3/mo after Phase 4

8 — API Gateway HttpApis

• d96r9s9pgc — prod-ipfs-s3-api (S3-compatible upload adapter for paying users) → keep
• xsl5wr7i82 — prod-bws-ipfs-api (main SaaS API) → keep, but many routes underneath are sunset-locked already

9 — Step Functions state machines (7)

• Keep: account-deletion (needed for Day-33 purge), folder-snapshot (paying users' feature), stripe-* state machines (activate-user, cancel-user, check-last-day-of-month, credits-*-update)
• Phase 4 candidate: could consolidate the credits-* pair; low priority

10 — Cognito user pools (2)

• prod-bws-ipfs-users — SaaS user pool, KEEP (paying customers sign in)
• prod-bws-ipfs-admins — admin pool, KEEP

11 — SNS topics (5)

• prod-abuse-alerts — kept, still fires from Pin-Safety-Scan / Badbits
• prod-e2e-alerts — could deleted (E2E workflow disabled), but the topic hosts the Slack Lambda used by health-rollup too — KEEP as our unified sunset alerting channel
• prod-health-alerts — kept
• prod-ops-alerts — kept
• prod-platform-kill-switch — kept

12 — WAF Web ACLs (2)

• prod-public-gateway-waf (CLOUDFRONT scope) — kept, still gates apex distribution
• prod-cognito-waf (REGIONAL) — kept, still allows KEEP-set signins
• PaidUserAllowlist IPSets — the sweeper Lambda is disabled but the IPSets still exist. Phase 4: shrink to just KEEP-set IPs, or delete the WAF rule that uses them.

13 — Secrets Manager (11 secrets)

Secret	Sunset relevance
ipfs/keys	Kubo cluster creds — KEEP
cognito/keys	Cognito — KEEP
stripe/keys	Stripe live — KEEP
alerts/keys	admin_phone for SMS — KEEP
safety/keys	Google Safe Browsing — KEEP
health/keys	health alerts webhook — KEEP
seo/gsc	Google Search Console — Phase 4 delete
captcha/keys	Turnstile — Phase 4 delete (signups off)
ipfs/github/auto-code-dispatch-pat	auto-code loop — Phase 4 candidate
ipfs/e2e-test-user	E2E creds — Phase 4 delete
chain/keys	NFT chain reader — KEEP for now (curator feature)

Secrets cost $0.40/mo each ≈ $4.40/mo total. Trimming 3 = ~$1/mo.

14 — CloudWatch alarms (51 total)

• 49 in OK, 2 in ALARM
• Alarms currently in ALARM:
  • prod-e2e-missing-nightly — expected, we disabled the E2E workflow this session
  • prod-pubgw-bandwidth-anomaly — bears investigation; may be the Sep 4 crawler tail or a fresh spike since sunset started
• Phase 4 candidate: ~30 alarms tied to disabled Lambdas (Trial_expire, Retention_day*, etc.) can be deleted with their targets

15 — CodePipeline + CodeBuild

• devops-bws-api-ipfs-upload-prod — the deploy pipeline, KEEP
• 3 CodeBuild projects — KEEP; needed for deploys

16 — Stripe subscriptions (live)

Sub	Customer	Plan	Status	cancel_at_period_end
sub_1UATIJR4uaue5JVBd6y8ojvs	Daniel	karma $19/mo	active	true (P1)
sub_1TeIGHR4uaue5JVBxSf27GJa	saori	karma $19/mo	active	true (P1)
sub_1TNE0PR4uaue5JVBqAE2TJYN	Simon	bodhi $5/mo	active	true (P1)
sub_1UDyGiR4uaue5JVBTwgmKae6	Muhammad	bodhi trial	active	(kept until trial expires ~09-16)
(no sub)	Ignacio Test	nirvana (manual-grant)	—	n/a

Simon received a $5 courtesy refund (re_3U5T6QR4uaue5JVB1sjBF5E7).

What's live on the site right now

Signed-out visitors to ipfs.ninja → redirect to /signin (not the marketing landing page). /signup → renders "Signups are closed" notice. /pricing → renders plan cards with "Not available — service winding down" CTAs. /signin → sign-in form, no "Sign up" prompt, no "View plans" link, one-line sunset message underneath. /signin → after auth → /dashboard normal SaaS UI (paying customers work as before). /ipfs/<cid>/ → serves KEEP-owned CIDs, 410 for everyone else.

Alarms + open findings worth noting

1. prod-pubgw-bandwidth-anomaly is currently ALARM — worth a look. Could be the Sep 4 tail, or new scraper activity. Since the KEEP filter is now live at apex, any bandwidth spike from non-KEEP CIDs should have collapsed within the last hour. Recommend running the daily cost check tomorrow.
2. prod-e2e-missing-nightly — will stay in ALARM forever unless we delete the alarm. Suggest deleting in P4 sweep.
3. Kvs-Sync ESM watchdog we added yesterday is one of the 49 OK alarms — good.

Projected cost delta

Component	Before	After P0 (est)	After P4 (est)
ECS (Kubo, 3 tasks)	$163	$163 (unchanged)	~$55 (1 task)
EFS	$50	$50	~$3
CloudFront	$27	~$5 (only KEEP-owned CIDs served)	~$5
API Gateway	$50+	~$5 (no free-tier abuse)	~$3
Lambda invocations	~$30	~$5 (29 rules off)	~$3
WAF	$27	$27	~$10
Secrets	~$4	~$4	~$3
Others (CB/CP/S3/DDB/CW/SM/ELB)	~$100	~$95	~$25
Total	~$450-700/mo	~$400/mo projected	~$100/mo projected

Real signal in ~48h once CloudFront cache turns over. Cost-Rate-Watcher (kept enabled) will surface the actual number.

Next natural steps

• Monitor prod-pubgw-bandwidth-anomaly for a day; run daily cost check tomorrow to see the P0 saving take shape
• Await deploy of /signin + / redirect (last commit still deploying at time of audit)
• Phase 1 emails already sent (Daniel, saori, Simon). Optional next: draft the trial + expired cohort emails
• Phase 4 delete pass (~40 Lambdas, ~15 tables, ~30 alarms) — each with its own cost analysis per CLAUDE.md