Skip to content

Commit 654866a

Browse files
anajmi07anajmi07
committed
Initial commit
1 parent f74393d commit 654866a

File tree

25 files changed

+1003
-1
lines changed

25 files changed

+1003
-1
lines changed

‎infra/modules/agentcore-iam-role/bedrock-agentcore-policy.tf‎

Lines changed: 213 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,213 @@
1+
resource "aws_iam_policy" "bedrock_permissions" {
2+
name = "${var.role_name}-bedrock-policy"
3+
4+
policy = jsonencode({
5+
Version = "2012-10-17"
6+
Statement = [
7+
{
8+
Sid = "BedrockPermissions"
9+
Effect = "Allow"
10+
Action = [
11+
"bedrock:InvokeModel",
12+
"bedrock:InvokeModelWithResponseStream"
13+
]
14+
Resource = "*"
15+
}
16+
]
17+
})
18+
}
19+
20+
resource "aws_iam_policy" "ecr_permissions" {
21+
name = "${var.role_name}-ecr-policy"
22+
23+
policy = jsonencode({
24+
Version = "2012-10-17"
25+
Statement = [
26+
{
27+
Sid = "ECRImageAccess"
28+
Effect = "Allow"
29+
Action = [
30+
"ecr:BatchGetImage",
31+
"ecr:GetDownloadUrlForLayer",
32+
"ecr:GetAuthorizationToken"
33+
]
34+
Resource = [
35+
"arn:aws:ecr:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:repository/*"
36+
]
37+
},
38+
{
39+
Sid = "ECRTokenAccess"
40+
Effect = "Allow"
41+
Action = [
42+
"ecr:GetAuthorizationToken"
43+
]
44+
Resource = "*"
45+
}
46+
]
47+
})
48+
}
49+
50+
resource "aws_iam_policy" "logging_permissions" {
51+
name = "${var.role_name}-logging-policy"
52+
53+
policy = jsonencode({
54+
Version = "2012-10-17"
55+
Statement = [
56+
{
57+
Effect = "Allow"
58+
Action = [
59+
"logs:DescribeLogStreams",
60+
"logs:CreateLogGroup"
61+
]
62+
Resource = [
63+
"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*"
64+
]
65+
},
66+
{
67+
Effect = "Allow"
68+
Action = [
69+
"logs:DescribeLogGroups"
70+
]
71+
Resource = [
72+
"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:*"
73+
]
74+
},
75+
{
76+
Effect = "Allow"
77+
Action = [
78+
"logs:CreateLogStream",
79+
"logs:PutLogEvents"
80+
]
81+
Resource = [
82+
"arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/bedrock-agentcore/runtimes/*:log-stream:*"
83+
]
84+
}
85+
]
86+
})
87+
}
88+
89+
resource "aws_iam_policy" "monitoring_permissions" {
90+
name = "${var.role_name}-monitoring-policy"
91+
92+
policy = jsonencode({
93+
Version = "2012-10-17"
94+
Statement = [
95+
{
96+
Effect = "Allow"
97+
Action = [
98+
"xray:PutTraceSegments",
99+
"xray:PutTelemetryRecords",
100+
"xray:GetSamplingRules",
101+
"xray:GetSamplingTargets"
102+
]
103+
Resource = "*"
104+
},
105+
{
106+
Effect = "Allow"
107+
Resource = "*"
108+
Action = "cloudwatch:PutMetricData"
109+
Condition = {
110+
StringEquals = {
111+
"cloudwatch:namespace" = "bedrock-agentcore"
112+
}
113+
}
114+
}
115+
]
116+
})
117+
}
118+
119+
resource "aws_iam_policy" "agentcore_permissions" {
120+
name = "${var.role_name}-agentcore-policy"
121+
122+
policy = jsonencode({
123+
Version = "2012-10-17"
124+
Statement = [
125+
{
126+
Sid = "GetAgentAccessToken"
127+
Effect = "Allow"
128+
Action = [
129+
"bedrock-agentcore:GetWorkloadAccessToken",
130+
"bedrock-agentcore:GetWorkloadAccessTokenForJWT",
131+
"bedrock-agentcore:GetWorkloadAccessTokenForUserId"
132+
]
133+
Resource = [
134+
"arn:aws:bedrock-agentcore:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:workload-identity-directory/default",
135+
"arn:aws:bedrock-agentcore:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:workload-identity-directory/default/workload-identity/*"
136+
]
137+
}
138+
]
139+
})
140+
}
141+
142+
resource "aws_iam_policy" "config_permissions" {
143+
name = "${var.role_name}-config-policy"
144+
145+
policy = jsonencode({
146+
Version = "2012-10-17"
147+
Statement = [
148+
{
149+
Effect = "Allow"
150+
Action = [
151+
"ssm:GetParameter",
152+
"ssm:GetParameters"
153+
]
154+
Resource = [
155+
"arn:aws:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/amazon/*",
156+
"arn:aws:ssm:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:parameter/cognito/*"
157+
]
158+
},
159+
{
160+
Effect = "Allow"
161+
Action = [
162+
"secretsmanager:GetSecretValue"
163+
]
164+
Resource = [
165+
"arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:cognito_client_secret*",
166+
"arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:zendesk_credentials*",
167+
"arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:langfuse_credentials*",
168+
"arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:gateway_credentials*",
169+
"arn:aws:secretsmanager:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:secret:tavily_key*"
170+
]
171+
}
172+
]
173+
})
174+
}
175+
176+
resource "aws_iam_policy" "bedrock_services_permissions" {
177+
name = "${var.role_name}-bedrock-services-policy"
178+
179+
policy = jsonencode({
180+
Version = "2012-10-17"
181+
Statement = [
182+
{
183+
Effect = "Allow"
184+
Action = [
185+
"bedrock:Retrieve",
186+
"bedrock:RetrieveAndGenerate"
187+
]
188+
Resource = [
189+
"arn:aws:bedrock:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:knowledge-base/${var.knowledge_base_id}"
190+
]
191+
},
192+
{
193+
Effect = "Allow"
194+
Action = [
195+
"bedrock:ApplyGuardrail"
196+
]
197+
Resource = [
198+
"arn:aws:bedrock:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:guardrail/${var.guardrail_id}"
199+
]
200+
},
201+
{
202+
Effect = "Allow"
203+
Action = [
204+
"bedrock:InvokeModel",
205+
"bedrock:InvokeModelWithResponseStream"
206+
]
207+
Resource = [
208+
"arn:aws:bedrock:${data.aws_region.current.name}::foundation-model/*"
209+
]
210+
}
211+
]
212+
})
213+
}

‎infra/modules/agentcore-iam-role/main.tf‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
data "aws_caller_identity" "current" {}
2+
data "aws_region" "current" {}
3+
4+
resource "aws_iam_role" "bedrock_agentcore_role" {
5+
name = var.role_name
6+
7+
assume_role_policy = jsonencode({
8+
Version = "2012-10-17"
9+
Statement = [
10+
{
11+
Sid = "AssumeRolePolicy"
12+
Effect = "Allow"
13+
Principal = {
14+
Service = "bedrock-agentcore.amazonaws.com"
15+
}
16+
Action = "sts:AssumeRole"
17+
Condition = {
18+
StringEquals = {
19+
"aws:SourceAccount" = data.aws_caller_identity.current.account_id
20+
}
21+
ArnLike = {
22+
"aws:SourceArn" = "arn:aws:bedrock-agentcore:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:*"
23+
}
24+
}
25+
}
26+
]
27+
})
28+
}
29+
30+
resource "aws_iam_role_policy_attachment" "bedrock_permissions" {
31+
role = aws_iam_role.bedrock_agentcore_role.name
32+
policy_arn = aws_iam_policy.bedrock_permissions.arn
33+
}
34+
35+
resource "aws_iam_role_policy_attachment" "ecr_permissions" {
36+
role = aws_iam_role.bedrock_agentcore_role.name
37+
policy_arn = aws_iam_policy.ecr_permissions.arn
38+
}
39+
40+
resource "aws_iam_role_policy_attachment" "logging_permissions" {
41+
role = aws_iam_role.bedrock_agentcore_role.name
42+
policy_arn = aws_iam_policy.logging_permissions.arn
43+
}
44+
45+
resource "aws_iam_role_policy_attachment" "monitoring_permissions" {
46+
role = aws_iam_role.bedrock_agentcore_role.name
47+
policy_arn = aws_iam_policy.monitoring_permissions.arn
48+
}
49+
50+
resource "aws_iam_role_policy_attachment" "agentcore_permissions" {
51+
role = aws_iam_role.bedrock_agentcore_role.name
52+
policy_arn = aws_iam_policy.agentcore_permissions.arn
53+
}
54+
55+
resource "aws_iam_role_policy_attachment" "config_permissions" {
56+
role = aws_iam_role.bedrock_agentcore_role.name
57+
policy_arn = aws_iam_policy.config_permissions.arn
58+
}
59+
60+
resource "aws_iam_role_policy_attachment" "bedrock_services_permissions" {
61+
role = aws_iam_role.bedrock_agentcore_role.name
62+
policy_arn = aws_iam_policy.bedrock_services_permissions.arn
63+
}

‎infra/modules/agentcore-iam-role/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "role_arn" {
2+
description = "ARN of the IAM role"
3+
value = aws_iam_role.bedrock_agentcore_role.arn
4+
}
5+
6+
output "role_name" {
7+
description = "Name of the IAM role"
8+
value = aws_iam_role.bedrock_agentcore_role.name
9+
}

‎infra/modules/agentcore-iam-role/variables.tf‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
variable "role_name" {
2+
description = "Name of the IAM role"
3+
type = string
4+
}
5+
6+
variable "knowledge_base_id" {
7+
description = "Knowledge Base ID to restrict access to"
8+
type = string
9+
default = "*"
10+
}
11+
12+
variable "guardrail_id" {
13+
description = "Guardrail ID to restrict access to"
14+
type = string
15+
default = "*"
16+
}

‎infra/modules/bedrock-guardrails/main.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
resource "aws_bedrock_guardrail" "guardrail" {
2+
name = var.guardrail_name
3+
blocked_input_messaging = var.blocked_input_messaging
4+
blocked_outputs_messaging = var.blocked_outputs_messaging
5+
description = var.description
6+
7+
content_policy_config {
8+
filters_config {
9+
input_strength = "MEDIUM"
10+
output_strength = "MEDIUM"
11+
type = "HATE"
12+
}
13+
}
14+
15+
sensitive_information_policy_config {
16+
pii_entities_config {
17+
action = "ANONYMIZE"
18+
type = "US_BANK_ROUTING_NUMBER"
19+
}
20+
21+
pii_entities_config {
22+
action = "ANONYMIZE"
23+
type = "US_SOCIAL_SECURITY_NUMBER"
24+
}
25+
}
26+
27+
topic_policy_config {
28+
topics_config {
29+
name = "investment_topic"
30+
examples = ["Where should I invest my money ?"]
31+
type = "DENY"
32+
definition = "Investment advice refers to inquiries, guidance, or recommendations regarding the management or allocation of funds or assets with the goal of generating returns ."
33+
}
34+
}
35+
36+
word_policy_config {
37+
managed_word_lists_config {
38+
type = "PROFANITY"
39+
}
40+
words_config {
41+
text = "HATE"
42+
}
43+
}
44+
}

‎infra/modules/bedrock-guardrails/outputs.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
output "guardrail_id" {
2+
description = "ID of the Bedrock guardrail"
3+
value = aws_bedrock_guardrail.guardrail.guardrail_id
4+
}
5+
6+
output "guardrail_arn" {
7+
description = "ARN of the Bedrock guardrail"
8+
value = aws_bedrock_guardrail.guardrail.guardrail_arn
9+
}

‎infra/modules/bedrock-guardrails/variables.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
variable "guardrail_name" {
2+
description = "Name of the Bedrock guardrail"
3+
type = string
4+
}
5+
6+
variable "blocked_input_messaging" {
7+
description = "Message to display when input is blocked"
8+
type = string
9+
}
10+
11+
variable "blocked_outputs_messaging" {
12+
description = "Message to display when output is blocked"
13+
type = string
14+
}
15+
16+
variable "description" {
17+
description = "Description of the guardrail"
18+
type = string
19+
}
20+

0 commit comments

Comments
 (0)