Skip to content

Commit bf26cbd

Browse files
rstrahanrstrahan
committed
Merge branch 'fix/add-marketplace-permsissions' into 'develop'
Fix/add marketplace permissions See merge request genaiic-reusable-assets/engagement-artifacts/genaiic-idp-accelerator!406
2 parents 567bb0f + c26983d commit bf26cbd

File tree

7 files changed

+122
-2
lines changed

7 files changed

+122
-2
lines changed

‎.github/workflows/developer-tests.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ jobs:
2020
contents: read
2121
issues: read
2222
checks: write
23-
pull-requests: write
23+
# pull-requests: write - Not needed: PR comments are disabled (see line 115)
2424

2525
# Use Python 3.13 to match GitLab configuration
2626
container:

‎CHANGELOG.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ SPDX-License-Identifier: MIT-0
55

66
## [Unreleased]
77

8+
89
### Fixed
910

1011
- **IDP CLI Deploy Command Parameter Preservation Bug**

‎options/bedrockkb/template.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -675,6 +675,11 @@ Resources:
675675
#
676676
KnowledgeBaseServiceRole:
677677
Type: AWS::IAM::Role
678+
Metadata:
679+
cfn_nag:
680+
rules_to_suppress:
681+
- id: W11
682+
reason: "Role requires * resource access for Marketplace"
678683
Properties:
679684
AssumeRolePolicyDocument:
680685
Version: "2012-10-17"
@@ -701,6 +706,12 @@ Resources:
701706
Action:
702707
- bedrock:InvokeModel
703708
Resource: !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}::foundation-model/${pEmbedModel}"
709+
- Effect: Allow
710+
Action:
711+
- aws-marketplace:Subscribe
712+
- aws-marketplace:Unsubscribe
713+
- aws-marketplace:ViewSubscriptions
714+
Resource: "*"
704715
- !If
705716
- UseOpenSearchServerless
706717
- PolicyName: oss-api-access

‎patterns/pattern-1/template.yaml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1033,6 +1033,12 @@ Resources:
10331033
Resource:
10341034
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
10351035
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
1036+
- Effect: Allow
1037+
Action:
1038+
- aws-marketplace:Subscribe
1039+
- aws-marketplace:Unsubscribe
1040+
- aws-marketplace:ViewSubscriptions
1041+
Resource: "*"
10361042
- !If
10371043
- HasGuardrailConfig
10381044
- Effect: Allow

‎patterns/pattern-2/template.yaml‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1567,6 +1567,12 @@ Resources:
15671567
Resource:
15681568
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
15691569
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
1570+
- Effect: Allow
1571+
Action:
1572+
- aws-marketplace:Subscribe
1573+
- aws-marketplace:Unsubscribe
1574+
- aws-marketplace:ViewSubscriptions
1575+
Resource: "*"
15701576
# AppSync permissions for updating document status (only if AppSync API is available)
15711577
- !If
15721578
- HasAppSyncApi
@@ -1682,6 +1688,12 @@ Resources:
16821688
- HasCustomClassificationModelARN
16831689
- !Ref CustomClassificationModelARN
16841690
- !Ref AWS::NoValue
1691+
- Effect: Allow
1692+
Action:
1693+
- aws-marketplace:Subscribe
1694+
- aws-marketplace:Unsubscribe
1695+
- aws-marketplace:ViewSubscriptions
1696+
Resource: "*"
16851697
- !If
16861698
- HasGuardrailConfig
16871699
- Effect: Allow
@@ -1797,6 +1809,12 @@ Resources:
17971809
- HasCustomExtractionModelARN
17981810
- !Ref CustomExtractionModelARN
17991811
- !Ref AWS::NoValue
1812+
- Effect: Allow
1813+
Action:
1814+
- aws-marketplace:Subscribe
1815+
- aws-marketplace:Unsubscribe
1816+
- aws-marketplace:ViewSubscriptions
1817+
Resource: "*"
18001818
- Effect: Allow
18011819
Action: lambda:InvokeFunction
18021820
Resource:
@@ -1907,6 +1925,12 @@ Resources:
19071925
Resource:
19081926
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
19091927
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
1928+
- Effect: Allow
1929+
Action:
1930+
- aws-marketplace:Subscribe
1931+
- aws-marketplace:Unsubscribe
1932+
- aws-marketplace:ViewSubscriptions
1933+
Resource: "*"
19101934
- !If
19111935
- HasGuardrailConfig
19121936
- Effect: Allow
@@ -2394,6 +2418,12 @@ Resources:
23942418
Resource:
23952419
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
23962420
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
2421+
- Effect: Allow
2422+
Action:
2423+
- aws-marketplace:Subscribe
2424+
- aws-marketplace:Unsubscribe
2425+
- aws-marketplace:ViewSubscriptions
2426+
Resource: "*"
23972427
- !If
23982428
- HasGuardrailConfig
23992429
- Effect: Allow

‎patterns/pattern-3/template.yaml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1202,6 +1202,12 @@ Resources:
12021202
Resource:
12031203
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
12041204
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
1205+
- Effect: Allow
1206+
Action:
1207+
- aws-marketplace:Subscribe
1208+
- aws-marketplace:Unsubscribe
1209+
- aws-marketplace:ViewSubscriptions
1210+
Resource: "*"
12051211
- Effect: Allow
12061212
Action: lambda:InvokeFunction
12071213
Resource:
@@ -1306,6 +1312,12 @@ Resources:
13061312
Resource:
13071313
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
13081314
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
1315+
- Effect: Allow
1316+
Action:
1317+
- aws-marketplace:Subscribe
1318+
- aws-marketplace:Unsubscribe
1319+
- aws-marketplace:ViewSubscriptions
1320+
Resource: "*"
13091321
- !If
13101322
- HasGuardrailConfig
13111323
- Effect: Allow
@@ -1455,6 +1467,12 @@ Resources:
14551467
Resource:
14561468
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
14571469
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
1470+
- Effect: Allow
1471+
Action:
1472+
- aws-marketplace:Subscribe
1473+
- aws-marketplace:Unsubscribe
1474+
- aws-marketplace:ViewSubscriptions
1475+
Resource: "*"
14581476
# AppSync permissions for updating document status (only if AppSync API is available)
14591477
- !If
14601478
- HasAppSyncApi

‎template.yaml‎

Lines changed: 55 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2917,7 +2917,7 @@ Resources:
29172917
cfn_nag:
29182918
rules_to_suppress:
29192919
- id: W11
2920-
reason: "Role requires * resource access for CloudWatch Metrics and Logs"
2920+
reason: "Role requires * resource access for CloudWatch Metrics and Logs, and MarketPlace Subscriptions"
29212921
- id: W89
29222922
reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
29232923
- id: W92
@@ -2998,6 +2998,13 @@ Resources:
29982998
Resource:
29992999
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
30003000
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
3001+
- Effect: Allow
3002+
Action:
3003+
- aws-marketplace:Subscribe
3004+
- aws-marketplace:Unsubscribe
3005+
- aws-marketplace:ViewSubscriptions
3006+
Resource: "*"
3007+
30013008

30023009
EvaluationFunctionLogGroup:
30033010
Type: AWS::Logs::LogGroup
@@ -3614,6 +3621,21 @@ Resources:
36143621
# Lambda function for agent chat resolver
36153622
AgentChatResolverFunction:
36163623
Type: AWS::Serverless::Function
3624+
Metadata:
3625+
cfn_nag:
3626+
rules_to_suppress:
3627+
- id: W89
3628+
reason: "Function does not require VPC access as it only interacts with AWS services via APIs"
3629+
- id: W92
3630+
reason: "Function does not require reserved concurrency as it scales based on demand"
3631+
- id: W58
3632+
reason: "DLQ not required for AppSeync Resolver function"
3633+
- id: W11
3634+
reason: "Role requires * resource access for Marketplace, CloudWatch Metrics and Logs"
3635+
# checkov:skip=CKV_AWS_116: "DLQ not required for analytics processor as it's invoked asynchronously by request handler with error handling and job status tracking in DynamoDB"
3636+
# checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
3637+
# checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
3638+
# checkov:skip=CKV_AWS_173: "Environment variables do not contain sensitive data - only configuration values like feature flags and non-sensitive settings"
36173639
Properties:
36183640
PermissionsBoundary:
36193641
!If [
@@ -3770,6 +3792,12 @@ Resources:
37703792
Resource:
37713793
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
37723794
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
3795+
- Effect: Allow
3796+
Action:
3797+
- aws-marketplace:Subscribe
3798+
- aws-marketplace:Unsubscribe
3799+
- aws-marketplace:ViewSubscriptions
3800+
Resource: "*"
37733801
- !If
37743802
- HasGuardrailConfig
37753803
- Effect: Allow
@@ -4422,6 +4450,12 @@ Resources:
44224450
Resource:
44234451
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
44244452
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
4453+
- Effect: Allow
4454+
Action:
4455+
- aws-marketplace:Subscribe
4456+
- aws-marketplace:Unsubscribe
4457+
- aws-marketplace:ViewSubscriptions
4458+
Resource: "*"
44254459
- !If
44264460
- HasGuardrailConfig
44274461
- Effect: Allow
@@ -6661,6 +6695,12 @@ Resources:
66616695
Resource:
66626696
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
66636697
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
6698+
- Effect: Allow
6699+
Action:
6700+
- aws-marketplace:Subscribe
6701+
- aws-marketplace:Unsubscribe
6702+
- aws-marketplace:ViewSubscriptions
6703+
Resource: "*"
66646704

66656705
DiscoveryProcessorFunctionLogGroup:
66666706
Type: AWS::Logs::LogGroup
@@ -6683,6 +6723,8 @@ Resources:
66836723
reason: "Function does not require reserved concurrency as it scales based on demand"
66846724
- id: W12
66856725
reason: "Lambda requires CloudWatch logs permissions"
6726+
- id: W11
6727+
reason: "Role requires * resource access for Marketplace and CloudWatch Metrics and Logs"
66866728
# checkov:skip=CKV_AWS_116: "DLQ not required for AppSync resolver function"
66876729
# checkov:skip=CKV_AWS_117: "Function does not require VPC access as it only interacts with AWS services via APIs"
66886730
# checkov:skip=CKV_AWS_115: "Function does not require reserved concurrency as it scales based on demand"
@@ -6739,6 +6781,12 @@ Resources:
67396781
- "bedrock:GetInferenceProfile"
67406782
Resource:
67416783
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
6784+
- Effect: Allow
6785+
Action:
6786+
- aws-marketplace:Subscribe
6787+
- aws-marketplace:Unsubscribe
6788+
- aws-marketplace:ViewSubscriptions
6789+
Resource: "*"
67426790
- !If
67436791
- HasGuardrailConfig
67446792
- Effect: Allow
@@ -6852,6 +6900,12 @@ Resources:
68526900
Resource:
68536901
- !Sub "arn:${AWS::Partition}:bedrock:*::foundation-model/*"
68546902
- !Sub "arn:${AWS::Partition}:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*"
6903+
- Effect: Allow
6904+
Action:
6905+
- aws-marketplace:Subscribe
6906+
- aws-marketplace:Unsubscribe
6907+
- aws-marketplace:ViewSubscriptions
6908+
Resource: "*"
68556909
- Effect: Allow
68566910
Action:
68576911
- cloudwatch:PutMetricData

0 commit comments

Comments
 (0)