# Exercise 1: Build an ALB in Front of an ECS Service

```
STEP 1. Security groups: alb-sg (443 from 0.0.0.0/0) and app-sg (3000 ONLY from alb-sg).
STEP 2. Create an internet-facing ALB in two PUBLIC subnets.
STEP 3. Create an IP target group for port 3000 with health check /healthz
        (interval 10 s, healthy 2, unhealthy 3, matcher 200), deregistration delay 30 s.
STEP 4. HTTPS listener on 443 with an ACM certificate and a TLS 1.3 policy;
        an HTTP listener on 80 that REDIRECTS to HTTPS (301).
STEP 5. A rule: host api.shop.co AND path /v1/* → forward to the target group;
        default action → fixed 404 JSON {"error":"not found"}.
STEP 6. Explain (comment) why the deregistration delay should be longer than
        your slowest request but shorter than the deploy's patience.
```

Config-only exercise (CLI) — verify with the checklist.

## Security groups (TODO)

```bash
aws ec2 create-security-group --group-name alb-sg --description "ALB" --vpc-id vpc-0abc
aws ec2 authorize-security-group-ingress --group-id TODO-alb-sg --protocol tcp --port 443 --cidr 0.0.0.0/0
aws ec2 create-security-group --group-name app-sg --description "app" --vpc-id vpc-0abc
aws ec2 authorize-security-group-ingress --group-id TODO-app-sg --protocol tcp --port 3000 --TODO
```

## Load balancer and target group (TODO)

```bash
aws elbv2 create-load-balancer --name shop-alb --type application --scheme TODO \
  --subnets TODO TODO --security-groups TODO

aws elbv2 create-target-group --name api-tg --protocol HTTP --port 3000 --vpc-id vpc-0abc \
  --target-type TODO --health-check-path TODO --health-check-interval-seconds TODO \
  --healthy-threshold-count TODO --unhealthy-threshold-count TODO --matcher HttpCode=TODO

aws elbv2 modify-target-group-attributes --target-group-arn $TG \
  --attributes Key=deregistration_delay.timeout_seconds,Value=TODO
```

## Listeners and rules (TODO)

```bash
aws elbv2 create-listener --load-balancer-arn $ALB --protocol HTTPS --port 443 \
  --certificates CertificateArn=TODO --ssl-policy TODO \
  --default-actions 'Type=fixed-response,FixedResponseConfig={StatusCode=404,ContentType=application/json,MessageBody="{\"error\":\"not found\"}"}'

aws elbv2 create-listener --load-balancer-arn $ALB --protocol HTTP --port 80 \
  --default-actions 'Type=redirect,RedirectConfig={TODO}'

aws elbv2 create-rule --listener-arn $HTTPS_LISTENER --priority 10 \
  --conditions TODO-host-condition TODO-path-condition \
  --actions Type=forward,TargetGroupArn=$TG
```

## STEP 6 answer (TODO)

```
#
```

## Requirements Checklist

- [ ] app-sg ingress uses `--source-group <alb-sg>`; tasks have no public IPs.
- [ ] ALB scheme `internet-facing`, two public subnets in different AZs.
- [ ] Target type `ip` (required for awsvpc ECS tasks), health check `/healthz` with the given thresholds and matcher 200.
- [ ] HTTPS listener uses an ACM certificate and a TLS 1.3 policy (e.g. `ELBSecurityPolicy-TLS13-1-2-2021-06`).
- [ ] Port 80 redirects to HTTPS with `Protocol=HTTPS,Port=443,StatusCode=HTTP_301`.
- [ ] The rule combines `host-header` and `path-pattern` conditions.
- [ ] STEP 6 explains draining: too short cuts in-flight requests; too long slows deployments and scale-in.