Step 1: Understanding the Deletion Failure
The most likely reason why the CloudFormation stack failed to delete is that the S3 bucket was not empty. AWS CloudFormation cannot delete an S3 bucket that contains objects, so if the website files are still in the bucket, the deletion will fail.
Issue: The S3 bucket is not empty during deletion, preventing the stack from being deleted.
Step 2: Modifying the Custom Resource to Handle Deletion
To mitigate this issue, you can modify the Lambda function associated with the custom resource to automatically empty the S3 bucket when the stack is being deleted. By adding logic to handle the RequestType: Delete event, the function can recursively delete all objects in the bucket before allowing the stack to be deleted.
Action: Modify the Lambda function to recursively delete the objects in the S3 bucket when RequestType is set to Delete.
Why: This ensures that the S3 bucket is empty before CloudFormation tries to delete it, preventing the stack deletion failure.
Reference:
This corresponds to Option B: Deletion has failed because the S3 bucket is not empty. Modify the custom resource's AWS Lambda function code to recursively empty the bucket when RequestType is Delete.

because of "as few maintenance tasks as possible on the underlying infrastructure". Fargate does that better than "one centralized application server"

* Step 1: Centralizing Image Scanning in a Shared Services Account
The first requirement is to centralize the image scanning process, ensuring pre-scan and post-scan images are stored separately. This can be achieved by creating separate pre-scan and post-scan repositories in the shared services account, with the appropriate resource-based policies to control access.
Action: Create separate ECR repositories for pre-scan and post-scan images in the shared services account. Configure resource-based policies to allow write access to pre-scan repositories and read access to post-scan repositories.
Why: This ensures that images are isolated before and after the scan, following the compliance requirements.
Reference:
This corresponds to Option A: Create Amazon Elastic Container Registry (Amazon ECR) repositories in the shared services account: one repository for each pre-scan image and one repository for each post-scan image. Configure Amazon ECR image scanning to run on new image pushes to the pre-scan repositories. Use resource-based policies to grant the organization write access to the pre-scan repositories and read access to the post-scan repositories.
* Step 2: Replication between Pre-Scan and Post-Scan Repositories
To automate the transfer of images from the pre-scan repositories to the post-scan repositories (after they pass the security scan), you can configure image replication between the two repositories.
Action: Set up image replication between the pre-scan and post-scan repositories to move images that have passed the security scan.
Why: Replication ensures that only scanned and compliant images are available for deployment, streamlining the process with minimal administrative overhead.
This corresponds to Option C: Configure image replication for each image from the image's pre-scan repository to the image's post-scan repository.

Configure the Systems Manager Document to Use the aws-downloadContent Plugin with a sourceType of GitHub and sourcelnfo with the Repository Details:
The aws-downloadContent plugin can download content from various sources, including GitHub, which is necessary for bootstrapping the laptops with the code stored in the GitHub repository.
schemaVersion: '2.2'
description: "Download and run bootstrap script from GitHub"
mainSteps:
- action: aws:downloadContent
name: downloadBootstrapScript
inputs:
sourceType: GitHub
sourceInfo: '{"owner":"my-org","repository":"my-repo","path":"scripts/bootstrap.sh","getOptions":"branch:main"}' destinationPath: /tmp/bootstrap.sh
- action: aws:runShellScript
name: runBootstrapScript
inputs:
runCommand:
- chmod +x /tmp/bootstrap.sh
- /tmp/bootstrap.sh
This setup ensures that the bootstrap code is downloaded from GitHub and executed on the laptops using Systems Manager.
Reference:
AWS Systems Manager aws-downloadContent Plugin
Running Commands Using Systems Manager