Conan Scott
78d67a2469
Build the AWS side of the HNCB demo end to end (region ap-southeast-1): - T1 /tokenize + T2 /restore: Lambdas behind a public API Gateway (shared-secret auth), Presidio detection, random per-request tokens, DynamoDB vault; overlap resolution so a ROC ID stays TW_ROC_ID. - T3: Presidio made private (SG-locked to the tokenize Lambda in-VPC; DynamoDB gateway endpoint); only /tokenize + /restore are public. - T4: RAG Lambda registered as an MCP tool on an AgentCore Gateway (AWS_IAM/SigV4); agentcore_setup.sh + a SigV4 MCP invoke test. - T5: Strands agent deployed to AgentCore Runtime; SigV4 gateway auth, apac inference profile, pinned deps. - T6: advisor UI on S3+CloudFront with a Fusion-less demo orchestrator (/demo) chaining tokenize -> runtime -> restore. - T7: README runbook + trace check; teardown deletes gateway/runtime/memory/ECR. Verified live: the cloud AgentCore/Bedrock trace shows only tokens, never the real name. Secrets stay in gitignored local.auto.tfvars. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
53 lines
1.9 KiB
HCL
53 lines
1.9 KiB
HCL
variable "region" {
|
|
description = "AWS region. Bedrock + AgentCore have the widest quotas in us-east-1 / us-west-2."
|
|
type = string
|
|
default = "us-east-1"
|
|
}
|
|
|
|
variable "project" {
|
|
description = "Name prefix for all resources."
|
|
type = string
|
|
default = "hncb-deid-demo"
|
|
}
|
|
|
|
variable "bedrock_model_id" {
|
|
description = "Bedrock model the agent reasons with."
|
|
type = string
|
|
default = "anthropic.claude-3-5-sonnet-20241022-v2:0"
|
|
}
|
|
|
|
# Fusion is a shared SaaS instance (NOT deployed here). Only the Presidio detector
|
|
# is self-hosted. TODO: set after scripts/deploy.sh builds + pushes the image.
|
|
variable "presidio_image_uri" {
|
|
description = "ECR URI for the Presidio detector image built from ./presidio."
|
|
type = string
|
|
default = "REPLACE_ME_PRESIDIO_IMAGE_URI"
|
|
}
|
|
|
|
# Where the /tokenize Lambda reaches the Presidio detector. After deploy this is
|
|
# the Presidio Fargate task's public endpoint (http://<public-ip>:5001). Kept a
|
|
# variable so a laptop rehearsal can point at a local/ngrok detector.
|
|
variable "presidio_url" {
|
|
description = "Base URL of the Presidio detector /analyze service."
|
|
type = string
|
|
default = "http://localhost:5001"
|
|
}
|
|
|
|
# Shared secret Fusion SaaS presents to the public endpoints (bearer / x-api-key).
|
|
# NEVER commit a real value -- pass via TF_VAR_tokenize_api_key or a .tfvars file
|
|
# that is gitignored. Empty default leaves the endpoint open (dev only).
|
|
variable "tokenize_api_key" {
|
|
description = "Shared secret required on /tokenize (and /restore) requests."
|
|
type = string
|
|
default = ""
|
|
sensitive = true
|
|
}
|
|
|
|
# AgentCore Runtime ARN (created out-of-band by `agentcore launch`, see T5). The
|
|
# demo orchestrator (T6) invokes it. Empty -> orchestrator skips the agent step.
|
|
variable "agent_runtime_arn" {
|
|
description = "Bedrock AgentCore Runtime ARN the demo orchestrator invokes."
|
|
type = string
|
|
default = ""
|
|
}
|