Overview
Resources · L0
34
2 unmanaged, 1 never provisioned
Services · L1
27
1 shadow service observed
Active drift
2
1 critical — root cause of the incident
Monthly spend
$9,244
$776 recoverable waste
Env parity
0.81
below 0.85 warning line
Open changes
6
1 blocked by freeze window
Critical now · 3
SLO BREACHService breaching its SLO — the cause is two layers below itpayments-service
p99 is 812ms against a 250ms target and the error rate is 4.2%, degraded since 14:04 UTC. Nothing changed in payments-service itself — it inherits the latency from rds-payments, which started refusing connections when sg-payments-db drifted open two minutes earlier. checkout-service is degraded in turn, one hop further up.
DRIFTSecurity group opened to the internet outside IaCsg-payments-db
ingress[5432].source is 0.0.0.0/0 in the cloud and sg-eks-nodes in Terraform. The change was made in the console at 14:02 UTC and is the root cause of the open payments incident.
EXPOSUREPostgres reachable from the internetrds-payments
A complete network path exists from the internet node to a data store: internet → alb-public → sg-payments-db → rds-payments. The path opened when the security group drifted; it is a consequence of sig-1, not an independent finding.
Latest events
14:06 UTCSEV-2 routed to payments-team
14:04 UTCpayments-service p99 breached SLO
14:02 UTCsg-payments-db drifted from declared state
13:40 UTCPR #481 applied — catalog search index tuning
Guided tour
Service map →
Search a service, see what it calls and the infra resolved beneath it
Infra map →
The same estate from the resource side — recolour it by cost, ownership, or exposure
Changes →
A routine change scored SAFE, a risky change flagged BLOCK — verdicts posted to the PR, never applied
Signals →
Drift, shadow services and dark infra — each with the fix that closes it
Cost →
$776/mo recoverable — found by the join, not a detector
Security →
An internet→Postgres path that is also the incident root cause
Ask →
“Why is checkout slow?” answered from the model