Editing Openai/694ab010-3e7c-8000-b0e8-b98c22b7a063 (section)

=== You will use: ===
* Secrets Manager for OPENAI_API_KEY
* ECR for two images
* ECS Fargate for two services
'' One ALB with path routing: - / → Streamlit UI target group (8501) - /api/'' → FastAPI target group (8000)
'' API Gateway (HTTP API) in front of the ALB only for <code>/api/''</code>

==== 1. Console → Secrets Manager ====
# Store a new secret
# Secret type: Other type of secret
# Key/value: - Key: OPENAI_API_KEY - Value: (paste your OpenAI key)
# Next
# Secret name: prod/ml-chatbot/openai
# Next → leave rotation off → Next
# Store

Copy the Secret ARN from the secret details page.

==== 1. Console → ECR ====
# Create repository - Name: ml-chatbot-api - Create
# Create repository - Name: ml-chatbot-ui - Create

==== You already use EC2 Instance Connect browser terminal and upload zip. Do the same with two zips: ====
* ml-chatbot-api.zip
* ml-chatbot-ui.zip

On EC2 browser shell:
* Unzip each into its folder
* Build docker image
* Push using ECR “View push commands” (Console)

===== 1. Console → ECR → repo ml-chatbot-api =====
# Click View push commands
# In EC2 shell: - docker build -t ml-chatbot-api . inside ~/ml-chatbot-api - Copy/paste the ECR login command from “View push commands” - Copy/paste tag command - Copy/paste push command

===== 1. Console → ECR → repo ml-chatbot-ui =====
# View push commands
# In EC2 shell inside ~/ml-chatbot-ui: - docker build -t ml-chatbot-ui . - Paste login/tag/push commands

Result: ECR has two images.

==== 1. Console → ECS ====
# Clusters → Create cluster
# Choose Networking only (Fargate)
# Name: ml-chatbot-cluster
# Create

==== 1. ECS → Task definitions → Create new task definition ====
# Choose Fargate
# Task definition name: ml-chatbot-api-task
# Task size: - CPU: 0.5 vCPU - Memory: 1 GB
# Execution role: - Choose existing ecsTaskExecutionRole if present, or create new

===== - Name: ml-chatbot-api =====
* Image: pick from ECR: ml-chatbot-api:latest
* Port mapping: - Container port: 8000

===== - Find Secrets section =====
* Add secret - Name: OPENAI_API_KEY - ValueFrom: - Select secret prod/ml-chatbot/openai - Select JSON key OPENAI_API_KEY (if prompted)

===== - Enable CloudWatch Logs =====
* Log group: /ecs/ml-chatbot-api

Click Create

==== 1. ECS → Task definitions → Create new task definition ====
# Fargate
# Name: ml-chatbot-ui-task
# CPU/mem: 0.25–0.5 vCPU, 0.5–1 GB

===== - Name: ml-chatbot-ui =====
* Image: ml-chatbot-ui:latest
* Port mapping: 8501
* Environment variable: - Name: API_BASE_URL - Value: (leave blank for now; you will set it after API Gateway exists)

Logging:
* Log group /ecs/ml-chatbot-ui

Create

==== ### ====
# Console → EC2 → Target Groups
# Create target group
# Target type: IP addresses
# Name: tg-ml-chatbot-ui
# Protocol: HTTP
# Port: 8501
# Health check path: /
# Create

===== 1. EC2 → Target Groups → Create target group =====
# Target type: IP addresses
# Name: tg-ml-chatbot-api
# Protocol: HTTP
# Port: 8000
# Health check path: /api/health
# Create

===== 1. EC2 → Load Balancers → Create load balancer =====
# Application Load Balancer
# Name: alb-ml-chatbot
# Scheme: Internet-facing
# IP type: IPv4
# VPC: default
# Subnets: select at least 2

Security group:
* Create or select SG allowing: - Inbound HTTP 80 from 0.0.0.0/0 (for testing) - Later you can lock down

Listeners:
* HTTP :80

Create load balancer

===== 1. EC2 → Load Balancers → select alb-ml-chatbot =====
# Listeners tab → click HTTP:80
# View/edit rules
# Create rules: - Rule 1 (top priority): - IF Path is /api/* - THEN Forward to tg-ml-chatbot-api - Default rule: - Forward to tg-ml-chatbot-ui

Save

==== ### ====
# ECS → Clusters → ml-chatbot-cluster
# Create (Service)
# Launch type: Fargate
# Task definition: ml-chatbot-api-task
# Desired tasks: 1

Networking:
* Choose VPC + subnets
* Security group for tasks: - inbound allow from ALB SG to port 8000
* Public IP: ENABLED (simplifies; later you can disable with private subnets)

Load balancing:
* Enable load balancing
* Type: ALB
* Load balancer: alb-ml-chatbot
* Listener: 80
* Target group: tg-ml-chatbot-api
* Container to load balance: ml-chatbot-api:8000

Create service

===== Repeat: =====
* Task definition: ml-chatbot-ui-task
* Task SG inbound allow from ALB SG to port 8501
* Attach to target group tg-ml-chatbot-ui with container port 8501

Create service

==== This is the correct “API Gateway usage”: it fronts FastAPI, not Streamlit UI. ====
# Console → API Gateway
# Create API
# Choose HTTP API → Build

Integration:
* Type: HTTP
* Endpoint URL: http://<ALB-DNS-NAME>
* Method: ANY

Routes:
* Add route: ANY /api/{proxy+}
* Integration: the HTTP integration to ALB

Stage:
* Name: prod
* Auto-deploy: enabled

Create

Now you have:
https://xxxx.execute-api.<region>.amazonaws.com/prod/api/...

==== Now set API_BASE_URL in the UI task definition to the API Gateway stage URL. ====
# ECS → Task definitions → ml-chatbot-ui-task
# Create new revision
# Container ml-chatbot-ui → Edit
# Environment variables: - API_BASE_URL = https://xxxx.execute-api.<region>.amazonaws.com/prod
# Update → Create revision

Deploy it:
# ECS → Cluster → Services → select UI service
# Update
# Choose latest task revision
# Update