Prerequisites

Before you follow this workshop hands-on, make sure you have everything below in place. Skipping any item will cause the deployment or tests to fail partway through.

AWS Account and IAM Access

You need an AWS account and an IAM identity that has the permissions below. Do not use the root account for any deployment step.

Create a dedicated IAM user (e.g. camgiacntn as used in this project) and attach a custom policy that grants the actions below:

The live deployment uses IAM user camgiacntn (account 720459752315). The ECS Fargate task uses a task role so it can call Transcribe, Translate, and S3 at runtime without any credentials in the container image.

Local Toolchain

Install the following tools before starting. Exact versions matter for Terraform and Python.

Configure your AWS profile for the ap-southeast-1 region:

In this guide, <aws-profile> means the operator’s local AWS CLI profile. For the LiveCap demonstration, we use livecap-camgiacntn to run and present the commands. Readers should replace the placeholder with their own profile; never place access keys or secret keys in source code, Git, or screenshots.

aws configure --profile <aws-profile>
# AWS Access Key ID:     <your key>
# AWS Secret Access Key: <your secret>
# Default region:        ap-southeast-1
# Default output format: json

Verify access:

aws sts get-caller-identity --profile <aws-profile>

Expected output:

{
  "UserId": "AIDA...",
  "Account": "720459752315",
  "Arn": "arn:aws:iam::720459752315:user/camgiacntn"
}

Background Knowledge

This workshop moves faster if you already know:

• Docker basics: build, tag, push an image.
• AWS ECS/Fargate concepts: cluster, service, task definition, task role.
• WebSocket basics: how a browser upgrades HTTP to a bidirectional socket.
• S3 basics: buckets, objects, policies, presigned URLs.
• CloudFront basics: distributions, origins, behaviors, OAC.
• Terraform basics: init, plan, apply, providers — enough to read the existing .tf files without getting lost.
• Python basics: enough to read FastAPI route handlers and pytest tests.

You do not need to be an expert in any of these. The workshop explains each step in detail.

Estimated Cost

Running LiveCap in AWS for a short workshop session costs very little, but some resources have fixed baseline costs while provisioned.

Tip: Run the Clean-up section at the end of the workshop to delete all resources and avoid ongoing charges. NAT Gateway and ALB are the largest fixed-cost items.

Safety Checklist Before Starting

• Not using the root account.
• IAM credentials are in ~/.aws/credentials, not in any .env file.
• Real .env, terraform.tfvars, backend.hcl, and *.tfstate files are gitignored and will not be committed.
• Gitleaks is installed and you will run it before every git push.
• You understand that terraform destroy is a separate, reviewed step and must not be run automatically.