# Exercise 1: Write a Production Task Definition and Service

```
STEP 1. Create an ECR repository "petpal/worker" with immutable tags, scan on push,
        and a lifecycle policy keeping the 20 most recent images tagged "sha-*"
        and expiring untagged images after 3 days.
STEP 2. Write the task definition JSON for a Fargate ARM64 task (1 vCPU, 2 GB) with:
        - container "worker" from the repo at tag sha-abc123
        - environment QUEUE_URL; secret DATABASE_URL from Secrets Manager (valueFrom)
        - awslogs log configuration (group /ecs/petpal-worker, 30-day retention)
        - a container health check
        - separate execution and task roles
STEP 3. Write the IAM policies: execution role (managed policy + read ONE secret),
        task role (sqs:ReceiveMessage/DeleteMessage/ChangeMessageVisibility on ONE queue).
STEP 4. Create the service: 2 tasks, private subnets, no public IP, capacity provider
        strategy using FARGATE_SPOT (weight 3) with FARGATE (base 1, weight 1),
        deployment circuit breaker with rollback.
STEP 5. Explain (comment) why Fargate Spot is acceptable for this worker but risky
        for the public API, and what the worker must do on SIGTERM.
```

Config-only exercise — verify against the checklist.

## STEP 1 (TODO)

```bash
aws ecr create-repository --repository-name petpal/worker TODO
aws ecr put-lifecycle-policy --repository-name petpal/worker --lifecycle-policy-text '{"rules":[TODO]}'
```

## STEP 2 (TODO)

```json
{
  "family": "petpal-worker",
  "requiresCompatibilities": ["FARGATE"],
  "networkMode": "TODO",
  "cpu": "TODO",
  "memory": "TODO",
  "runtimePlatform": { "cpuArchitecture": "TODO", "operatingSystemFamily": "LINUX" },
  "executionRoleArn": "TODO",
  "taskRoleArn": "TODO",
  "containerDefinitions": [ { "name": "worker", "image": "TODO" } ]
}
```

## STEP 3 (TODO)

```json
{ "Version": "2012-10-17", "Statement": [ ] }
```

## STEP 4 (TODO)

```bash
aws ecs create-service --cluster petpal-prod --service-name worker --task-definition petpal-worker \
  --desired-count 2 TODO
```

## STEP 5 answer (TODO)

## Requirements Checklist

- [ ] Repository: `IMMUTABLE`, `scanOnPush=true`, lifecycle rules (keep 20 `sha-*` by `imageCountMoreThan`; untagged `sinceImagePushed` 3 days).
- [ ] Task definition: `awsvpc`, `"1024"`/`"2048"`, `ARM64`, `secrets: [{ name: "DATABASE_URL", valueFrom: "<secret arn>" }]`, `logConfiguration` awslogs, `healthCheck`, image by SHA tag.
- [ ] Execution role: `AmazonECSTaskExecutionRolePolicy` + `secretsmanager:GetSecretValue` on that one secret ARN; task role scoped to the one queue ARN.
- [ ] Service: `awsvpcConfiguration` with private subnets, `assignPublicIp=DISABLED`, capacity provider strategy (FARGATE base 1/weight 1, FARGATE_SPOT weight 3), `deploymentCircuitBreaker={enable=true,rollback=true}`.
- [ ] STEP 5: Spot tasks can be stopped with a 2-minute warning; workers handle SIGTERM by stopping polling, finishing/abandoning in-flight messages (visibility timeout returns them); the API needs stable capacity and graceful connection draining.