Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 2 additions & 5 deletions packages/@aws-cdk/aws-bedrock-alpha/bedrock/agents/agent.ts
Original file line number Diff line number Diff line change
Expand Up @@ -563,11 +563,8 @@ export class Agent extends AgentBase implements IAgent {

// Add explicit dependency between the agent resource and the agent's role default policy
// See https://github.com/awslabs/generative-ai-cdk-constructs/issues/899
if (!props.existingRole) {
// add the appropriate permissions to use the FM
const grant = this.foundationModel.grantInvoke(this.role);
grant.applyBefore(this.__resource);
}
const grant = this.foundationModel.grantInvoke(this.role);
grant.applyBefore(this.__resource);

this.testAlias = AgentAlias.fromAttributes(this, 'DefaultAlias', {
aliasId: 'TSTALIASID',
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -768,5 +768,34 @@ describe('Agent', () => {
],
});
});

test('applies dependency for existing role', () => {
const existingRole = new iam.Role(stack, 'ExistingRole', {
assumedBy: new iam.ServicePrincipal('bedrock.amazonaws.com'),
});

new bedrock.Agent(stack, 'Agent', {
instruction: 'This is a test instruction that must be at least 40 characters long to be valid',
foundationModel: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V2_0,
existingRole,
});

// Verify CloudFormation template has DependsOn
Template.fromStack(stack).hasResource('AWS::Bedrock::Agent', {
DependsOn: [Match.stringLikeRegexp('ExistingRoleDefaultPolicy.*')],
});
});

test('applies dependency for role created by Agent', () => {
new bedrock.Agent(stack, 'Agent', {
instruction: 'This is a test instruction that must be at least 40 characters long to be valid',
foundationModel: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V2_0,
});

// Verify CloudFormation template has DependsOn
Template.fromStack(stack).hasResource('AWS::Bedrock::Agent', {
DependsOn: [Match.stringLikeRegexp('AgentRoleDefaultPolicy.*')],
});
});
});
});

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Original file line number Diff line number Diff line change
@@ -0,0 +1,144 @@
{
"Resources": {
"AgentRoleF4A42D6B": {
"Type": "AWS::IAM::Role",
"Properties": {
"AssumeRolePolicyDocument": {
"Statement": [
{
"Action": "sts:AssumeRole",
"Effect": "Allow",
"Principal": {
"Service": "bedrock.amazonaws.com"
}
}
],
"Version": "2012-10-17"
}
}
},
"AgentRoleDefaultPolicy1027F5D2": {
"Type": "AWS::IAM::Policy",
"Properties": {
"PolicyDocument": {
"Statement": [
{
"Action": [
"bedrock:GetFoundationModel",
"bedrock:InvokeModel*"
],
"Effect": "Allow",
"Resource": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":bedrock:",
{
"Ref": "AWS::Region"
},
"::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0"
]
]
}
}
],
"Version": "2012-10-17"
},
"PolicyName": "AgentRoleDefaultPolicy1027F5D2",
"Roles": [
{
"Ref": "AgentRoleF4A42D6B"
}
]
}
},
"Agent255F68E9": {
"Type": "AWS::Bedrock::Agent",
"Properties": {
"ActionGroups": [
{
"ActionGroupName": "UserInputAction",
"ActionGroupState": "DISABLED",
"ParentActionGroupSignature": "AMAZON.UserInput",
"SkipResourceInUseCheckOnDelete": false
},
{
"ActionGroupName": "CodeInterpreterAction",
"ActionGroupState": "DISABLED",
"ParentActionGroupSignature": "AMAZON.CodeInterpreter",
"SkipResourceInUseCheckOnDelete": false
}
],
"AgentName": "agent-awscdkbedrockagentistingrole1-agent-70062d50-bedrockagent",
"AgentResourceRoleArn": {
"Fn::GetAtt": [
"AgentRoleF4A42D6B",
"Arn"
]
},
"AutoPrepare": false,
"FoundationModel": {
"Fn::Join": [
"",
[
"arn:",
{
"Ref": "AWS::Partition"
},
":bedrock:",
{
"Ref": "AWS::Region"
},
"::foundation-model/anthropic.claude-3-5-sonnet-20241022-v2:0"
]
]
},
"IdleSessionTTLInSeconds": 600,
"Instruction": "This is a test agent that uses an existing IAM role.",
"OrchestrationType": "DEFAULT",
"SkipResourceInUseCheckOnDelete": true
},
"DependsOn": [
"AgentRoleDefaultPolicy1027F5D2"
]
}
},
"Parameters": {
"BootstrapVersion": {
"Type": "AWS::SSM::Parameter::Value<String>",
"Default": "/cdk-bootstrap/hnb659fds/version",
"Description": "Version of the CDK Bootstrap resources in this environment, automatically retrieved from SSM Parameter Store. [cdk:skip]"
}
},
"Rules": {
"CheckBootstrapVersion": {
"Assertions": [
{
"Assert": {
"Fn::Not": [
{
"Fn::Contains": [
[
"1",
"2",
"3",
"4",
"5"
],
{
"Ref": "BootstrapVersion"
}
]
}
]
},
"AssertDescription": "CDK bootstrap stack version 6 required. Please run 'cdk bootstrap' with a recent version of the CDK CLI."
}
]
}
}
}

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading
Loading