Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(bedrock): inference profiles permissions #994

Merged
merged 3 commits into from
Feb 27, 2025
Merged

fix(bedrock): inference profiles permissions #994

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0c65da6
fix(bedrock): modify iam policies
aws-rafams Feb 27, 2025
4c7e229
fix(bedrock): working integ test
aws-rafams Feb 27, 2025
1f69bdb
chore(build): fix build and add sonnet 3 7
krokoko Feb 27, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions .gitignore
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

1 change: 1 addition & 0 deletions .npmignore
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

69 changes: 69 additions & 0 deletions .projen/tasks.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 6 additions & 0 deletions apidocs/namespaces/bedrock/classes/BedrockFoundationModel.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,12 @@ The ARN of the Bedrock invokable abstraction.

> `readonly` `static` **ANTHROPIC\_CLAUDE\_3\_5\_SONNET\_V2\_0**: [`BedrockFoundationModel`](BedrockFoundationModel.md)

***

### ANTHROPIC\_CLAUDE\_3\_7\_SONNET\_V1\_0

> `readonly` `static` **ANTHROPIC\_CLAUDE\_3\_7\_SONNET\_V1\_0**: [`BedrockFoundationModel`](BedrockFoundationModel.md)

*************************************************************************
ANTHROPIC
*************************************************************************
Expand Down
5 changes: 5 additions & 0 deletions package.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

2 changes: 1 addition & 1 deletion src/cdk-lib/bedrock/inference-profiles/cross-region-inference-profile.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -151,7 +151,7 @@
grantProfileUsage(grantee: IGrantable): Grant {
const grant = Grant.addToPrincipal({
grantee: grantee,
actions: ['bedrock:GetInferenceProfile', 'bedrock:InvokeModel'],
actions: ['bedrock:GetInferenceProfile', 'bedrock:InvokeModel*'],

Check warning on line 154 in src/cdk-lib/bedrock/inference-profiles/cross-region-inference-profile.ts

View check run for this annotation

Codecov / codecov/patch

src/cdk-lib/bedrock/inference-profiles/cross-region-inference-profile.ts#L154 

Added line #L154 was not covered by tests
resourceArns: [this.inferenceProfileArn],
});
return grant;
Expand Down
9 changes: 7 additions & 2 deletions src/cdk-lib/bedrock/models.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,6 +138,11 @@
/****************************************************************************
* ANTHROPIC
***************************************************************************/
public static readonly ANTHROPIC_CLAUDE_3_7_SONNET_V1_0 = new BedrockFoundationModel(
'anthropic.claude-3-7-sonnet-20250219-v1:0',
{ supportsAgents: true, supportsCrossRegion: true },
);

public static readonly ANTHROPIC_CLAUDE_3_5_SONNET_V2_0 = new BedrockFoundationModel(
'anthropic.claude-3-5-sonnet-20241022-v2:0',
{ supportsAgents: true, supportsCrossRegion: true },
Expand Down Expand Up @@ -293,7 +298,7 @@
public grantInvoke(grantee: IGrantable): Grant {
const grant = Grant.addToPrincipal({
grantee: grantee,
actions: ['bedrock:InvokeModel'],
actions: ['bedrock:InvokeModel*', 'bedrock:GetFoundationModel'],
resourceArns: [this.invokableArn],
});
return grant;
Expand All @@ -315,7 +320,7 @@

return Grant.addToPrincipal({
grantee: grantee,
actions: ['bedrock:InvokeModel'],
actions: ['bedrock:InvokeModel*', 'bedrock:GetFoundationModel'],

Check warning on line 323 in src/cdk-lib/bedrock/models.ts

View check run for this annotation

Codecov / codecov/patch

src/cdk-lib/bedrock/models.ts#L323 

Added line #L323 was not covered by tests
resourceArns: [invokableArn],
});
}
Expand Down
4 changes: 2 additions & 2 deletions ...integ/inference-profiles.integ.snapshot/aws-cdk-bedrock-guardrails-integ-test.assets.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
{
"version": "39.0.0",
"files": {
"fc1142f404eb5443446b22592dc6d75ae8c80055bfb9474da78f4254ae394a4f": {
"ea52821b2f897f4747652193704dc57b09f387d548e94159a698de2d27cca5ca": {
"source": {
"path": "aws-cdk-bedrock-guardrails-integ-test.template.json",
"packaging": "file"
},
"destinations": {
"current_account-eu-central-1": {
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-eu-central-1",
"objectKey": "fc1142f404eb5443446b22592dc6d75ae8c80055bfb9474da78f4254ae394a4f.json",
"objectKey": "ea52821b2f897f4747652193704dc57b09f387d548e94159a698de2d27cca5ca.json",
"region": "eu-central-1",
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-eu-central-1"
}
Expand Down
19 changes: 14 additions & 5 deletions ...teg/inference-profiles.integ.snapshot/aws-cdk-bedrock-guardrails-integ-test.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,10 @@
"PolicyDocument": {
"Statement": [
{
"Action": "bedrock:InvokeModel",
"Action": [
"bedrock:InvokeModel*",
"bedrock:GetFoundationModel"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
Expand Down Expand Up @@ -178,7 +181,10 @@
"PolicyDocument": {
"Statement": [
{
"Action": "bedrock:InvokeModel",
"Action": [
"bedrock:InvokeModel*",
"bedrock:GetFoundationModel"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
Expand All @@ -196,7 +202,7 @@
{
"Action": [
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel"
"bedrock:InvokeModel*"
],
"Effect": "Allow",
"Resource": {
Expand Down Expand Up @@ -368,7 +374,10 @@
"PolicyDocument": {
"Statement": [
{
"Action": "bedrock:InvokeModel",
"Action": [
"bedrock:InvokeModel*",
"bedrock:GetFoundationModel"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
Expand All @@ -386,7 +395,7 @@
{
"Action": [
"bedrock:GetInferenceProfile",
"bedrock:InvokeModel"
"bedrock:InvokeModel*"
],
"Effect": "Allow",
"Resource": {
Expand Down
4 changes: 2 additions & 2 deletions test/integ/issue747.integ.snapshot/aws-cdk-bedrock-agents-integ-test.assets.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
{
"version": "39.0.0",
"files": {
"edce2cdca448655b4baa3a3f25397547640d54472ced24d6b7c09954e1b4a72c": {
"7e760cbfec7bfb0f842abf3934b793e311a38bd24c9810f722b3e1b8ac300b23": {
"source": {
"path": "aws-cdk-bedrock-agents-integ-test.template.json",
"packaging": "file"
},
"destinations": {
"current_account-eu-central-1": {
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-eu-central-1",
"objectKey": "edce2cdca448655b4baa3a3f25397547640d54472ced24d6b7c09954e1b4a72c.json",
"objectKey": "7e760cbfec7bfb0f842abf3934b793e311a38bd24c9810f722b3e1b8ac300b23.json",
"region": "eu-central-1",
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-eu-central-1"
}
Expand Down
10 changes: 8 additions & 2 deletions test/integ/issue747.integ.snapshot/aws-cdk-bedrock-agents-integ-test.template.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,10 @@
"PolicyDocument": {
"Statement": [
{
"Action": "bedrock:InvokeModel",
"Action": [
"bedrock:InvokeModel*",
"bedrock:GetFoundationModel"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
Expand Down Expand Up @@ -220,7 +223,10 @@
"PolicyDocument": {
"Statement": [
{
"Action": "bedrock:InvokeModel",
"Action": [
"bedrock:InvokeModel*",
"bedrock:GetFoundationModel"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
Expand Down
20 changes: 20 additions & 0 deletions test/integ/issue991.integ.snapshot/Claude37Test.assets.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,20 @@
{
"version": "39.0.0",
"files": {
"1f9354e3c8c90e6a6e4f3adf164e2746481f44ff6494e937f784a37964b01274": {
"source": {
"path": "Claude37Test.template.json",
"packaging": "file"
},
"destinations": {
"current_account-us-east-1": {
"bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-us-east-1",
"objectKey": "1f9354e3c8c90e6a6e4f3adf164e2746481f44ff6494e937f784a37964b01274.json",
"region": "us-east-1",
"assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-us-east-1"
}
}
}
},
"dockerImages": {}
}
Loading
Loading