Conan Scott
78d67a2469
Build the AWS side of the HNCB demo end to end (region ap-southeast-1): - T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap resolution so a ROC ID stays TW_ROC_ID. - T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB gateway endpoint); only /tokenize + /restore are public. - T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4); agentcore_setup.sh + a SigV4 MCP invoke test. - T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac inference profile, pinned deps. - T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo) chaining tokenize -> runtime -> restore. - T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR. Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the real name. Secrets stay in gitignored local.auto.tfvars. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
42 lines
1.5 KiB
HCL
42 lines
1.5 KiB
HCL
# ---------------------------------------------------------------------------
|
|
# AgentCore Gateway support (task T4). Terraform's AgentCore coverage lags, so the
|
|
# Gateway + target themselves are created by scripts/agentcore_setup.sh via
|
|
# `aws bedrock-agentcore-control`. What IS declarative here is the IAM role the
|
|
# Gateway assumes to invoke the RAG tool Lambda -- kept in Terraform so it is
|
|
# tagged, auditable, and torn down with the rest of the stack.
|
|
# ---------------------------------------------------------------------------
|
|
|
|
resource "aws_iam_role" "agentcore_gateway" {
|
|
name = "${local.name}-gateway-role"
|
|
assume_role_policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [{
|
|
Effect = "Allow"
|
|
Principal = { Service = "bedrock-agentcore.amazonaws.com" }
|
|
Action = "sts:AssumeRole"
|
|
Condition = {
|
|
StringEquals = { "aws:SourceAccount" = data.aws_caller_identity.current.account_id }
|
|
}
|
|
}]
|
|
})
|
|
tags = local.cloud_tag # the Gateway is a cloud-zone component
|
|
}
|
|
|
|
resource "aws_iam_role_policy" "agentcore_gateway" {
|
|
name = "${local.name}-gateway-policy"
|
|
role = aws_iam_role.agentcore_gateway.id
|
|
policy = jsonencode({
|
|
Version = "2012-10-17"
|
|
Statement = [{
|
|
# The Gateway only needs to invoke the one RAG tool Lambda.
|
|
Effect = "Allow"
|
|
Action = ["lambda:InvokeFunction"]
|
|
Resource = [aws_lambda_function.rag.arn]
|
|
}]
|
|
})
|
|
}
|
|
|
|
data "aws_caller_identity" "current" {}
|
|
|
|
output "gateway_role_arn" { value = aws_iam_role.agentcore_gateway.arn }
|