Implement reversible PII de-identification round trip (T1–T7)
Build the AWS side of the HNCB demo end to end (region ap-southeast-1): - T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap resolution so a ROC ID stays TW_ROC_ID. - T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB gateway endpoint); only /tokenize + /restore are public. - T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4); agentcore_setup.sh + a SigV4 MCP invoke test. - T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac inference profile, pinned deps. - T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo) chaining tokenize -> runtime -> restore. - T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR. Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the real name. Secrets stay in gitignored local.auto.tfvars. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
57
README.md
57
README.md
@@ -62,30 +62,53 @@ fusion/ POLICY_SETUP.md (SaaS console config — the manual part)
|
||||
```
|
||||
|
||||
## Prerequisites
|
||||
`aws-cli` configured (creds + region), `terraform >= 1.5`, `docker`, `python3`,
|
||||
the AgentCore CLI (`npm i -g @aws/agentcore`), Bedrock model access enabled for
|
||||
`bedrock_model_id`, and access to the shared **Fusion SaaS** instance.
|
||||
`aws-cli` (creds + region — this demo runs in `ap-southeast-1`), `terraform >= 1.5`,
|
||||
`podman` or `docker` (Presidio image), `python3` + a venv with `boto3`,
|
||||
`bedrock-agentcore-starter-toolkit` (`pip install`, provides `agentcore`), Bedrock
|
||||
access for the **apac** Claude 3.5 Sonnet v2 *inference profile*
|
||||
(`apac.anthropic.claude-3-5-sonnet-20241022-v2:0` — the raw id is not on-demand in
|
||||
this region), and — for the production path — the shared **Fusion SaaS** instance.
|
||||
|
||||
## Deploy
|
||||
```bash
|
||||
bash scripts/deploy.sh # infra -> presidio image -> ECS -> seed -> AgentCore
|
||||
# then: build /tokenize + /restore (gateway_api/, tasks T1/T2)
|
||||
# then: configure the shared Fusion SaaS instance (fusion/POLICY_SETUP.md)
|
||||
# then: point ui/index.html GATEWAY_URL at the Fusion SaaS entrypoint and open it
|
||||
```
|
||||
The live stack was brought up in this order (authoritative runbook: the task notes
|
||||
in `CLAUDE.md`, which record the exact sequencing and gotchas):
|
||||
1. `terraform -chdir=terraform apply` core infra (DynamoDB, RAG + tokenize/restore/
|
||||
orchestrator Lambdas, API Gateway, Presidio on Fargate, UI on S3+CloudFront).
|
||||
Presidio needs its image in ECR and `presidio_url` set to the task's **private** IP.
|
||||
2. Seed the synthetic customer + the demo vault token (`seed/seed.py`).
|
||||
3. `scripts/agentcore_setup.sh` → MCP Gateway + RAG tool target.
|
||||
4. `agentcore configure` + `agentcore launch` → Runtime ARN; then grant the runtime
|
||||
execution role `bedrock-agentcore:InvokeGateway` (command in `agentcore_setup.sh`).
|
||||
5. Put the Runtime ARN in `terraform/local.auto.tfvars` (`agent_runtime_arn`) and
|
||||
re-apply so `/demo` can invoke it.
|
||||
|
||||
## Demo script (maps to the 8 steps)
|
||||
1. Advisor UI: submit *"請幫我整理王小明最近三個月的理財往來，並給我下次拜訪話術。"*
|
||||
2. Fusion (via `/tokenize`) detects `王小明` + `A123456789`, tokenizes, logs tokens only.
|
||||
3. Show the Bedrock/AgentCore trace — the prompt the cloud saw contains `CUST_000123`.
|
||||
4-6. Agent tool-calls back on-prem; RAG resolves the token, returns a summary.
|
||||
7. Agent writes talking points (no PII).
|
||||
8. Fusion (via `/restore`) restores `王小明`; the UI shows restored beside tokenized.
|
||||
## Demo script (Fusion-less dry run — maps to the 8 steps)
|
||||
```bash
|
||||
cd terraform && DEMO=$(terraform output -raw demo_url) && UI=$(terraform output -raw ui_url); cd ..
|
||||
|
||||
# 1-2, 4-8: advisor query -> tokenize -> agent (on tokens) -> restore, in one call:
|
||||
curl -s -X POST "$DEMO" -H 'content-type: application/json' \
|
||||
-d '{"query":"請幫我整理王小明最近三個月的理財往來，並給我下次拜訪話術。"}' | python3 -m json.tool
|
||||
# -> deidentified_prompt: "...CUST_xxxxxx..." (what left for the cloud)
|
||||
# agent_tokenized: talking points, tokens only
|
||||
# final: "（客戶：王小明）..." (identity restored on-prem)
|
||||
|
||||
# 3. money shot — the cloud runtime trace only ever shows the token:
|
||||
LG=/aws/bedrock-agentcore/runtimes/<runtime-id>-DEFAULT
|
||||
aws logs filter-log-events --log-group-name "$LG" --filter-pattern '"王小明"' --query 'length(events)' # 0
|
||||
aws logs filter-log-events --log-group-name "$LG" --filter-pattern '"CUST_"' --query 'length(events)' # >0
|
||||
|
||||
# 8 (visual): open the split-view UI and submit the same query
|
||||
echo "$UI"
|
||||
```
|
||||
|
||||
## Teardown
|
||||
```bash
|
||||
bash scripts/teardown.sh # stop paying for Fargate / AgentCore
|
||||
bash scripts/teardown.sh # deletes Gateway/Runtime/Memory + `terraform destroy` + ECR repos
|
||||
```
|
||||
Leftover-but-free after teardown: the hand-made default VPC, the
|
||||
`AmazonBedrockAgentCoreSDKRuntime-*` role, and a CodeBuild project (delete by hand
|
||||
if you want it spotless).
|
||||
|
||||
## Honest caveats
|
||||
- **zh-TW detection is demo-narrow** — tuned to the scripted entities, not
|
||||
|
||||
Reference in New Issue
Block a user