World map

 

BM

World A4: Containers in the Cloud · Boss challenge

Move into the mall

You will learn: to pick AWS services for Kedai Kancil, guard them, guess what bills idle, and write the clean-up list.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Boss: Kedai Kancil moves in for real. A web page, an orders API, a database and nightly reports. Pick the parts, guard them, know the bill, and plan the way out. Where do you start?

Try it

Room 1: which AWS service runs each part?

Drag a card into a box. Or tap the card, then tap the box.

        Try it

        Room 2: the deploy role pushes to the wrong shelf. Change the pink line so it may push to kedai-kancil. Keep it narrow.

        Change the pink line so AWS says Allow.

        The request

        Who
        kedai-deploy (role session)arn:aws:sts::111122223333:assumed-role/kedai-deploy/run-9
        Wants to
        ecr:PutImage
        On
        arn:aws:ecr:ap-southeast-5:111122223333:repository/kedai-kancil
        Identity policy (key ring) · push-one-shelf
        {
        "Version": "2012-10-17",
        "Statement": [
        {
        "Effect": "Allow",
        "Action": "ecr:PutImage",
        }
        ]
        }

        Try it

        Room 3: the database door. Only API tasks in sg-api may use port 5432. Not the reports job, not your laptop.

        Set the door guard's rules. Only the right visitors get in.

        Visitors

        • Orders API taskshould get inTCP 5432 from 10.0.1.30, a server in sg-apiIts replies go back to ports 32768–61000.
        • Reports jobkeep outTCP 5432 from 10.0.1.40, a server in sg-reportsIts replies go back to ports 32768–61000.
        • Your laptopkeep outTCP 5432 from 203.0.113.9Its replies go back to ports 32768–61000.

        Unit door · security group (the server)

        Allow rules only. It remembers who came in, so replies always go out.

        In

        No In rules yet: nothing gets in.

        Out: all traffic (a new group starts this way).

        Check

        Room 4: the bill. In production you added a NAT gateway, a load balancer and a secret. What bills while the shop sleeps?

        One at a time: does it keep costing money while it sits idle?

        1 of 8

        Load balancer with no visitors

        On the bill (costs even when idle)

        Nothing here yet.

        Free shelf (free when idle)

        Nothing here yet.

        Try it

        Room 5: closing day. Put the clean-up in a safe order. Things that use others go first.

        First step at the top. Put these in order. Use the arrows, or drag.

        • Delete the ECR repository and the secret
        • Delete the RDS database (final snapshot first)
        • Release its Elastic IP
        • Delete the empty VPC
        • Delete the NAT gateway
        • Delete the ECS service (tasks stop)
        • Delete the load balancer

        Predict

        Last room: you finished the clean-up tonight. How do you know it worked?

        You did it!

        You can now move a shop into the cloud, guard it, and leave cleanly.