Funny that you mention cleanup. Our service doesn't clean up in any circumstance. Originally we had a cleanup operation in case of errors. But then we found th

Funny that you mention cleanup. Our service doesn't clean up in any circumstance. Originally we had a cleanup operation in case of errors. But then we found those could fail as well. As it turns out, we need a catch-all way to clean up resources if anything else fails. The solution is simple. The main service never cleans up, and a secondary service (I like to call it The Reaper) just cleans up orphaned resources. This keeps both services simpler and more resilient. Of course this pattern works in our particular circumstances. In other domains it might lead to resource leaks and such, so apply your best judgement.