Conan Scott
78d67a2469
Build the AWS side of the HNCB demo end to end (region ap-southeast-1): - T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap resolution so a ROC ID stays TW_ROC_ID. - T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB gateway endpoint); only /tokenize + /restore are public. - T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4); agentcore_setup.sh + a SigV4 MCP invoke test. - T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac inference profile, pinned deps. - T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo) chaining tokenize -> runtime -> restore. - T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR. Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the real name. Secrets stay in gitignored local.auto.tfvars. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
46 lines
2.0 KiB
Bash
46 lines
2.0 KiB
Bash
#!/usr/bin/env bash
|
|
# One-pass-ish deploy of the AWS side. Fusion is shared SaaS and is NOT deployed
|
|
# here -- it is configured in its console (fusion/POLICY_SETUP.md) to call the
|
|
# endpoints this stack exposes. Assumes aws-cli (creds + region), docker,
|
|
# terraform, and the AgentCore CLI are installed. Review before running.
|
|
set -euo pipefail
|
|
cd "$(dirname "$0")/.."
|
|
|
|
REGION="${REGION:-us-east-1}"
|
|
ACCOUNT="$(aws sts get-caller-identity --query Account --output text)"
|
|
ECR="${ACCOUNT}.dkr.ecr.${REGION}.amazonaws.com"
|
|
|
|
echo "==> Step 1: core infra (DynamoDB + RAG Lambda + IAM)"
|
|
terraform -chdir=terraform init
|
|
terraform -chdir=terraform apply -target=aws_lambda_function.rag -auto-approve
|
|
|
|
echo "==> Step 2: build + push the Presidio detector image"
|
|
aws ecr describe-repositories --repository-names hncb-presidio --region "$REGION" >/dev/null 2>&1 \
|
|
|| aws ecr create-repository --repository-name hncb-presidio --region "$REGION" \
|
|
--tags Key=Owner,Value="conan hncb demo" >/dev/null
|
|
aws ecr get-login-password --region "$REGION" | docker login --username AWS --password-stdin "$ECR"
|
|
docker build -t "$ECR/hncb-presidio:latest" ./presidio
|
|
docker push "$ECR/hncb-presidio:latest"
|
|
|
|
echo "==> Step 3: full apply (Presidio Fargate service + tables)"
|
|
terraform -chdir=terraform apply \
|
|
-var "presidio_image_uri=$ECR/hncb-presidio:latest" \
|
|
-auto-approve
|
|
|
|
echo "==> Step 4: seed data"
|
|
export CUSTOMERS_TABLE="$(terraform -chdir=terraform output -raw customers_table)"
|
|
export VAULT_TABLE="$(terraform -chdir=terraform output -raw vault_table)"
|
|
python seed/seed.py --with-demo-token
|
|
|
|
echo "==> Step 5: AgentCore (Gateway + Runtime)"
|
|
export RAG_LAMBDA_ARN="$(terraform -chdir=terraform output -raw rag_lambda_arn)"
|
|
export REGION
|
|
bash scripts/agentcore_setup.sh
|
|
|
|
echo ""
|
|
echo "Remaining steps (see CLAUDE.md task backlog):"
|
|
echo " - Build the /tokenize + /restore HTTPS endpoints Fusion SaaS will call (T1, T2)"
|
|
echo " - Configure the shared Fusion SaaS instance -> fusion/POLICY_SETUP.md"
|
|
echo " - Point ui/index.html GATEWAY_URL at the Fusion SaaS entrypoint, then host it"
|
|
echo "Done."
|