Capstone mission 10: Kedai Kancil in the cloud

🎯 Real mission

1. Sign in as your everyday admin user (World A1), never root. MFA on.
2. Billing and Cost Management → Budgets → a template budget. Send alerts to your email.
3. Pick one Region for everything. Malaysia (ap-southeast-5) must be turned on first.
4. Check who the CLI is. It must not say root.
   aws sts get-caller-identityCopy

0 of 4 steps done · Your ticks are saved.

🎯 Real mission

1. Make the shelf, with scans on push.
   aws ecr create-repository --repository-name kedai-kancil --image-scanning-configuration scanOnPush=trueCopy
2. Log in (lesson A4-1), then tag and push your Kedai Kancil image from Docker World D4.
   docker push ACCOUNT_ID.dkr.ecr.REGION.amazonaws.com/kedai-kancil:1.0Copy
3. Make the cluster. ECS itself is free.
   aws ecs create-cluster --cluster-name kedaiCopy
4. Save taskdef.json: cpu 256, memory 512, your image, port 80, the ecsTaskExecutionRole. Register it.
   aws ecs register-task-definition --cli-input-json file://taskdef.jsonCopy
5. Make a door guard in the default VPC. Allow port 80 from YOUR_IP/32 only.
   aws ec2 authorize-security-group-ingress --group-id SG_ID --protocol tcp --port 80 --cidr YOUR_IP/32Copy
6. Start a service with one task and a public IP.
   aws ecs create-service --cluster kedai --service-name shop --task-definition kedai-web --desired-count 1 --launch-type FARGATE --network-configuration "awsvpcConfiguration={subnets=[SUBNET_ID],securityGroups=[SG_ID],assignPublicIp=ENABLED}"Copy
7. Find the task’s public IP in the ECS console. Open it in your browser.

0 of 7 steps done · Your ticks are saved.

🎯 Real mission

1. IAM → Identity providers → add OpenID Connect. Paste this provider URL. Audience: sts.amazonaws.com.
   https://token.actions.githubusercontent.comCopy
2. Make the kedai-deploy role. Trust only your repo’s production environment (World A2).
3. Give it only: push to your shelf, register the card, update the shop service, pass the task roles.
4. In your GitHub repo, create the production environment.
5. Save the workflow from lesson A4-7, plus taskdef.json. Commit and push.
   git add .github/workflows/deploy.yml taskdef.json && git commit -m "ci: deploy to ECS" && git pushCopy
6. Watch the run go green. Reload your shop: the new task answers.

0 of 6 steps done · Your ticks are saved.

🎯 Real mission

1. Your shop page opened on the task’s public IP.
2. Port 80 is open to your IP only. No port 22 anywhere.
3. The deploy role trusts only your repo and its production environment.
4. No AWS access keys sit in your repo or its secrets.
5. Your budget alarm is still there.

0 of 5 steps done · Your ticks are saved.

🎯 Real mission

1. Delete the service. Its task stops.
   aws ecs delete-service --cluster kedai --service shop --forceCopy
2. Delete the empty cluster.
   aws ecs delete-cluster --cluster kedaiCopy
3. Deregister each recipe card revision you made.
   aws ecs deregister-task-definition --task-definition kedai-web:1Copy
4. Delete the shelf and every image on it. Check the name twice.
   aws ecr delete-repository --repository-name kedai-kancil --forceCopy
5. Delete the door guard, once the task is gone.
   aws ec2 delete-security-group --group-id SG_IDCopy
6. Added logging? Delete the CloudWatch log group too.
7. Optional: delete the kedai-deploy role and the GitHub identity provider. They cost nothing.
8. Keep the budget alarm. It guards your next mission.
9. Tomorrow: open Bills and Cost Explorer. Today’s small charge is fine. Nothing new should appear.

0 of 9 steps done · Your ticks are saved.