Decision: Approve the cost-aware sandbox network topology

[alexeygrigorev]

Normative decision: Open decision 14

Decision needed

Approve dedicated two-AZ VPC, public ALB, tightly restricted public-IP ECS tasks, isolated private RDS, and no NAT gateway for sandbox; keep production inputs capable of private tasks plus NAT/endpoints.

Non-goals

Do not reuse the default VPC implicitly or weaken task/database security-group boundaries.

Acceptance criteria

• Cost/security tradeoff is approved with expected recurring cost.
• Task ingress is ALB-only and database ingress task-only.
• Production portability inputs are identified.
• Terraform policy tests encode the approved topology.

Validation scenarios

Review plan/network reachability: internet cannot reach task ports or RDS; tasks can reach locked dependencies; origin bypass is controlled.

Dependencies

Blocks sandbox Terraform implementation under #9.

[alexeygrigorev]

Decision resolved for the first scaffold deployment

The owner's explicit instruction is to deploy the first scaffold now at web.dtcdev.click using portable Terraform in the sandbox. To execute that without waiting on later feature infrastructure, the documented recommended sandbox topology is accepted as the safe implementation assumption:

• dedicated two-AZ VPC;
• public ALB;
• tightly restricted public-IP ECS tasks with ingress only from the ALB security group;
• isolated private RDS subnets with PostgreSQL ingress only from the task security group;
• no NAT gateway in the sandbox profile;
• production inputs retain private-task plus NAT/VPC-endpoint options.

This selection is encoded and cost-documented in re-groomed #67. It does not weaken origin/task/RDS isolation and does not authorize default-VPC reuse. If the owner later requests a NAT-backed sandbox, that is a separately costed infrastructure change rather than a blocker for the first deploy.