fintechner audit v3

28-audit-v3.sh

#!/bin/bash
set -euo pipefail
export AWS_PAGER=""
REGION=ap-northeast-1
INSTANCE_ID=i-089ad4a6b76132ba2

# Bundle the SQL queries into a single shell script, run it via base64 on
# the EC2. Avoids all the JSON-in-SSM-in-bash escape hell.
SCRIPT_B64=$(base64 -w0 <<'INNER'
psql() { sudo docker exec timescale psql -U fintechner -d fintechner -c "$1" 2>&1 | head -15; }
echo "=== hl_credentials ==="
psql "SELECT env, account_addr, agent_addr, instruments, last_auth_ok, last_auth_err FROM hl_credentials;"
echo
echo "=== strategy_configs ==="
psql "SELECT id, name, type, status, created_at FROM strategy_configs;"
echo
echo "=== recent strategy_decisions ==="
psql "SELECT ts, strategy_id, coin, side, price, size, reason, state FROM strategy_decisions ORDER BY ts DESC LIMIT 10;"
echo
echo "=== orders ==="
psql "SELECT cloid, origin, owner_id, coin, side, status, error_msg FROM orders ORDER BY submitted_at DESC LIMIT 10;"
echo
echo "=== connector journal (strategy/intent/risk/halt) ==="
sudo journalctl -u fintechner-connector --since "30 min ago" --no-pager 2>&1 | grep -iE "strategy|intent|risk|halt|reject|kill" | tail -30
INNER
)

cat > /tmp/ssm-audit.json <<JSON
{"commands": ["echo '$SCRIPT_B64' | base64 -d | bash"]}
JSON

CMD_ID=$(aws --region "$REGION" ssm send-command \
  --instance-ids "$INSTANCE_ID" \
  --document-name AWS-RunShellScript \
  --parameters file:///tmp/ssm-audit.json \
  --query Command.CommandId --output text)
rm -f /tmp/ssm-audit.json

for i in $(seq 1 25); do
  sleep 4
  STATUS=$(aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query Status --output text 2>/dev/null || echo Pending)
  case "$STATUS" in Success|Failed|Cancelled|TimedOut) echo "  $STATUS"; break ;; *) echo "  $STATUS";; esac
done

echo
aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query StandardOutputContent --output text
echo
echo "--- STDERR ---"
aws --region "$REGION" ssm get-command-invocation --command-id "$CMD_ID" --instance-id "$INSTANCE_ID" --query StandardErrorContent --output text