Explicitly set AWS credentials and endpoint URL in ECS task definition

LocalStack may not reliably inject AWS_ENDPOINT_URL into ECS task
containers in all environments. Setting it explicitly to
localhost.localstack.cloud:4566 ensures the fulfillment container
always reaches LocalStack regardless of runtime injection.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: whummer

01-serverless-app/services/fulfillment/fulfill.py

@@ -9,7 +9,9 @@
 TABLE_NAME      = os.environ["ORDERS_TABLE"]
 RECEIPTS_BUCKET = os.environ["RECEIPTS_BUCKET"]
 
-# LocalStack injects AWS_ENDPOINT_URL automatically into ECS task containers.
+endpoint = os.environ.get("AWS_ENDPOINT_URL", "")
+print(f"Connecting to endpoint: {endpoint or '(default AWS)'}", flush=True)
+
 dynamodb = boto3.resource("dynamodb")
 s3       = boto3.client("s3")
 

01-serverless-app/terraform/main.tf

@@ -140,8 +140,12 @@ resource "aws_ecs_task_definition" "fulfillment" {
     name  = "fulfillment"
     image = "${aws_ecr_repository.fulfillment.repository_url}:latest"
     environment = [
-      { name = "ORDERS_TABLE",    value = aws_dynamodb_table.orders.name },
-      { name = "RECEIPTS_BUCKET", value = aws_s3_bucket.receipts.bucket },
+      { name = "ORDERS_TABLE",         value = aws_dynamodb_table.orders.name },
+      { name = "RECEIPTS_BUCKET",      value = aws_s3_bucket.receipts.bucket },
+      { name = "AWS_ENDPOINT_URL",     value = "http://localhost.localstack.cloud:4566" },
+      { name = "AWS_DEFAULT_REGION",   value = "us-east-1" },
+      { name = "AWS_ACCESS_KEY_ID",    value = "test" },
+      { name = "AWS_SECRET_ACCESS_KEY", value = "test" },
     ]
   }])
 }