@aws/nx-plugin 1.0.0-rc.91 → 1.0.0-rc.92

package/src/py/agent/__snapshots__/generator.protocols.spec.ts.snap

@@ -60,6 +60,16 @@ variable "appconfig_application_id" {
   type        = string
 }
 
+variable "asset_ecr_repository_url" {
+  description = "URL of the shared asset ECR repository the agent's image is published to. Instantiate the \`core/asset-ecr\` module once per deployment and pass its \`repository_url\` output here."
+  type        = string
+}
+
+variable "asset_ecr_repository_arn" {
+  description = "ARN of the shared asset ECR repository (from \`core/asset-ecr.repository_arn\`), used to scope the runtime's image pull grant to it."
+  type        = string
+}
+
 variable "session_force_destroy" {
   description = "Whether to allow the session bucket to be destroyed even if it still contains objects."
   type        = bool
@@ -255,9 +265,11 @@ resource "aws_dynamodb_table" "session" {
 }
 
 module "agent_core_runtime" {
-  source = "../../../core/agent-core"
+  source = "../../../core/agent-core-container"
   agent_runtime_name = "DynamodbTerraformAgent"
   docker_image_tag = "proj-dynamodb-terraform-agent:latest"
+  asset_ecr_repository_url = var.asset_ecr_repository_url
+  asset_ecr_repository_arn = var.asset_ecr_repository_arn
   server_protocol = "HTTP"
   enable_vpc = var.enable_vpc
   vpc_id = var.vpc_id
@@ -424,6 +436,16 @@ variable "appconfig_application_id" {
   type        = string
 }
 
+variable "asset_ecr_repository_url" {
+  description = "URL of the shared asset ECR repository the agent's image is published to. Instantiate the \`core/asset-ecr\` module once per deployment and pass its \`repository_url\` output here."
+  type        = string
+}
+
+variable "asset_ecr_repository_arn" {
+  description = "ARN of the shared asset ECR repository (from \`core/asset-ecr.repository_arn\`), used to scope the runtime's image pull grant to it."
+  type        = string
+}
+
 variable "session_force_destroy" {
   description = "Whether to allow the session bucket to be destroyed even if it still contains objects."
   type        = bool
@@ -576,9 +598,11 @@ resource "aws_cloudwatch_log_delivery" "session" {
 }
 
 module "agent_core_runtime" {
-  source = "../../../core/agent-core"
+  source = "../../../core/agent-core-container"
   agent_runtime_name = "TerraformSnapshotAgent"
   docker_image_tag = "proj-terraform-snapshot-agent:latest"
+  asset_ecr_repository_url = var.asset_ecr_repository_url
+  asset_ecr_repository_arn = var.asset_ecr_repository_arn
   server_protocol = "HTTP"
   enable_vpc = var.enable_vpc
   vpc_id = var.vpc_id
@@ -682,10 +706,6 @@ exports[`py#agent generator > should match snapshot for Terraform generated file
       source  = "hashicorp/aws"
       version = "6.62.0"
     }
-    external = {
-      source  = "hashicorp/external"
-      version = "2.4.1"
-    }
     null = {
       source  = "hashicorp/null"
       version = "3.3.1"
@@ -729,9 +749,36 @@ variable "authorizer_configuration" {
   default = null
 }
 
-variable "docker_image_tag" {
-  description = "Name of the docker image tag to use as the agent core runtime"
-  type        = string
+variable "container_configuration" {
+  description = "Container artifact for this runtime. Set exactly one of this or \`code_configuration\`; the \`agent-core-container\` module renders it."
+  type = object({
+    container_uri = string
+  })
+  default = null
+}
+
+variable "code_configuration" {
+  description = "Code artifact for this runtime. Set exactly one of this or \`container_configuration\`; the \`agent-core-code\` module renders it."
+  type = object({
+    entry_point = list(string)
+    runtime     = string
+    s3_bucket   = string
+    s3_key      = string
+  })
+  default = null
+
+  validation {
+    # Evaluated at plan time, since Terraform defers validation that reads
+    # another variable.
+    condition     = (var.code_configuration == null) != (var.container_configuration == null)
+    error_message = "Set exactly one of code_configuration or container_configuration."
+  }
+}
+
+variable "artifact_dependencies" {
+  description = "Resources the artifact is produced by (an image push or a code upload), so the runtime is created only once they exist."
+  type        = list(any)
+  default     = []
 }
 
 variable "env" {
@@ -794,47 +841,6 @@ resource "random_id" "unique_suffix" {
   byte_length = 4
 }
 
-# ECR Repository
-resource "aws_ecr_repository" "agent_core_repository" {
-  #checkov:skip=CKV_AWS_136:AES256 encryption is sufficient for ECR repositories
-  name = "\${lower(var.agent_runtime_name)}_repository_\${random_id.unique_suffix.hex}"
-
-  image_tag_mutability = "IMMUTABLE"
-  force_delete         = true
-
-  image_scanning_configuration {
-    scan_on_push = true
-  }
-
-  tags = var.tags
-}
-
-# ECR Repository Policy
-resource "aws_ecr_repository_policy" "agent_core_ecr_policy" {
-  repository = aws_ecr_repository.agent_core_repository.name
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "AllowPushPull"
-        Effect = "Allow"
-        Principal = {
-          AWS = "arn:aws:iam::\${local.aws_account_id}:root"
-        }
-        Action = [
-          "ecr:GetDownloadUrlForLayer",
-          "ecr:BatchGetImage",
-          "ecr:BatchCheckLayerAvailability",
-          "ecr:PutImage",
-          "ecr:InitiateLayerUpload",
-          "ecr:UploadLayerPart",
-          "ecr:CompleteLayerUpload"
-        ]
-      }
-    ]
-  })
-}
 
 # IAM Role for Agent Core Runtime
 resource "aws_iam_role" "agent_core_runtime_role" {
@@ -873,27 +879,6 @@ resource "aws_iam_policy" "agent_core_runtime_policy" {
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = concat([
-      {
-        Sid    = "ECRImageAccess"
-        Effect = "Allow"
-        Action = [
-          "ecr:BatchGetImage",
-          "ecr:GetDownloadUrlForLayer"
-        ]
-        Resource = [
-          aws_ecr_repository.agent_core_repository.arn
-        ]
-      },
-      {
-        Sid    = "ECRTokenAccess"
-        Effect = "Allow"
-        Action = [
-          "ecr:GetAuthorizationToken"
-        ]
-        Resource = [
-          "*"
-        ]
-      },
       {
         "Effect" : "Allow",
         "Action" : [
@@ -968,46 +953,6 @@ resource "aws_iam_role_policy_attachment" "agent_core_policy" {
   policy_arn = aws_iam_policy.agent_core_runtime_policy.arn
 }
 
-# Data source to get container image digest
-data "external" "docker_digest" {
-  program = ["sh", "-c", "echo '{\\"digest\\":\\"'$(docker inspect \${var.docker_image_tag} --format '{{.Id}}')'\\"}' "]
-}
-
-locals {
-  # Content-based, immutable image tag derived from the local image digest
-  image_tag = replace(data.external.docker_digest.result.digest, "sha256:", "")
-}
-
-# Null resource for container image publish
-resource "null_resource" "docker_publish" {
-  triggers = {
-    docker_digest    = data.external.docker_digest.result.digest
-    repository_url   = aws_ecr_repository.agent_core_repository.repository_url
-    docker_image_tag = var.docker_image_tag
-    image_tag        = local.image_tag
-  }
-
-  provisioner "local-exec" {
-    command = <<-EOT
-      # Get ECR login token
-      aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REPOSITORY_URL"
-
-      # Tag the image with the immutable content-based tag
-      docker tag "$DOCKER_IMAGE_TAG" "$REPOSITORY_URL:$IMAGE_TAG"
-
-      # Push the image
-      docker push "$REPOSITORY_URL:$IMAGE_TAG"
-    EOT
-    environment = {
-      AWS_REGION       = local.aws_region
-      REPOSITORY_URL   = self.triggers.repository_url
-      DOCKER_IMAGE_TAG = self.triggers.docker_image_tag
-      IMAGE_TAG        = self.triggers.image_tag
-    }
-  }
-
-  depends_on = [aws_ecr_repository_policy.agent_core_ecr_policy]
-}
 
 # Security group for the agent core runtime, used when running inside a VPC
 resource "aws_security_group" "agent_core_runtime" {
@@ -1038,8 +983,26 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   role_arn           = aws_iam_role.agent_core_runtime_role.arn
 
   agent_runtime_artifact {
-    container_configuration {
-      container_uri = "\${aws_ecr_repository.agent_core_repository.repository_url}:\${local.image_tag}"
+    dynamic "container_configuration" {
+      for_each = var.container_configuration != null ? [var.container_configuration] : []
+      content {
+        container_uri = container_configuration.value.container_uri
+      }
+    }
+
+    dynamic "code_configuration" {
+      for_each = var.code_configuration != null ? [var.code_configuration] : []
+      content {
+        entry_point = code_configuration.value.entry_point
+        runtime     = code_configuration.value.runtime
+
+        code {
+          s3 {
+            bucket = code_configuration.value.s3_bucket
+            prefix = code_configuration.value.s3_key
+          }
+        }
+      }
     }
   }
 
@@ -1083,7 +1046,7 @@ resource "aws_bedrockagentcore_agent_runtime" "agent_runtime" {
   tags = var.tags
 
   depends_on = [
-    null_resource.docker_publish,
+    var.artifact_dependencies,
     aws_iam_role_policy_attachment.agent_core_policy
   ]
 }
@@ -1241,15 +1204,27 @@ variable "appconfig_application_id" {
   type        = string
 }
 
+variable "asset_ecr_repository_url" {
+  description = "URL of the shared asset ECR repository the agent's image is published to. Instantiate the \`core/asset-ecr\` module once per deployment and pass its \`repository_url\` output here."
+  type        = string
+}
+
+variable "asset_ecr_repository_arn" {
+  description = "ARN of the shared asset ECR repository (from \`core/asset-ecr.repository_arn\`), used to scope the runtime's image pull grant to it."
+  type        = string
+}
+
 variable "appconfig_application_arn" {
   description = "ARN of the shared runtime-config AppConfig application (from \`core/runtime-config/appconfig.application_arn\`). Used to scope the IAM read permission granted to the agent runtime."
   type        = string
 }
 
 module "agent_core_runtime" {
-  source = "../../../core/agent-core"
+  source = "../../../core/agent-core-container"
   agent_runtime_name = "InMemoryTerraformAgent"
   docker_image_tag = "proj-in-memory-terraform-agent:latest"
+  asset_ecr_repository_url = var.asset_ecr_repository_url
+  asset_ecr_repository_arn = var.asset_ecr_repository_arn
   server_protocol = "HTTP"
   enable_vpc = var.enable_vpc
   vpc_id = var.vpc_id

package/src/py/agent/files/package/main.py.template

@@ -0,0 +1,13 @@
+"""AgentCore Runtime entry point.
+
+Runs at the root of the deployment package, where the managed runtime executes
+it by file path. The agent is imported absolutely so its own relative imports
+resolve.
+"""
+
+import uvicorn
+
+from <%- moduleName %>.<%- agentNameSnakeCase %>.main import app
+
+if __name__ == "__main__":
+    uvicorn.run(app, host="0.0.0.0", port=<%- port %>)

package/src/py/agent/generator.d.ts

@@ -5,7 +5,7 @@
 import { type GeneratorCallback, type Tree } from '@nx/devkit';
 import { type NxGeneratorInfo } from '../../utils/nx.js';
 import type { IacMetadata } from '../../utils/shared-constructs-constants.js';
-import type { AgentProtocol, PyAgentFramework, PyAgentGeneratorSchema, PyAgentSession } from './schema';
+import type { AgentProtocol, PyAgentFramework, PyAgentGeneratorSchema, PyAgentInfra, PyAgentSession } from './schema';
 /** The metadata this generator records, which its predicates read. */
 export interface PyAgentMetadata extends IacMetadata {
     readonly port: number;
@@ -18,6 +18,11 @@ export interface PyAgentMetadata extends IacMetadata {
      */
     readonly framework: PyAgentFramework;
     readonly session: PyAgentSession;
+    /**
+     * How this component is packaged and hosted, so a consumer can tell a
+     * code-packaged runtime from a container-packaged one without re-deriving it.
+     */
+    readonly infra: PyAgentInfra;
 }
 export declare const DEPENDENCIES: import("../../utils/declared-dependencies.js").DependencyDeclaration<readonly [{
     readonly name: "agent-chat-cli";

package/src/py/agent/generator.js

@@ -8,6 +8,7 @@ import { addPyDependencies, addTsDependencies } from "../../utils/add-dependenci
 import { addAgentChatScripts } from "../../utils/agent-chat/agent-chat.js";
 import { AGENT_CONNECTION_PY_DEPENDENCIES, addPythonFrameworkBase, ensureLangchainS3CheckpointSaver, ensurePythonAgentConnectionProject, getPythonAgentConnectionModuleName, getPythonAgentConnectionProject } from "../../utils/agent-connection/agent-connection.js";
 import { addAgentInfra } from "../../utils/agent-core-constructs/agent-core-constructs.js";
+import { addPythonCodePackageTarget, agentCorePythonRuntime, isAgentCoreHosted, isContainerHosted } from "../../utils/agent-core-packaging.js";
 import { addPythonBundleTarget } from "../../utils/bundle/bundle.js";
 import { resolveContainers } from "../../utils/containers.js";
 import { declareDependencies, ownedElsewhere } from "../../utils/declared-dependencies.js";
@@ -289,55 +290,91 @@ export const pyAgentGenerator = async (tree, options)=>{
     generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', framework, protocolLower), targetSourceDir, templateContext, {
         overwriteStrategy: OverwriteStrategy.KeepExisting
     });
-    if (infra === 'agentcore') {
+    if (isAgentCoreHosted(infra)) {
+        const container = isContainerHosted(infra);
         const containers = await resolveContainers(tree, 'inherit');
         const dockerImageTag = `${getNpmScope(tree)}-${name}:latest`;
         // Add bundle target
         const { bundleTargetName, bundleOutputDir } = addPythonBundleTarget(project, {
             pythonPlatform: 'aarch64-manylinux_2_28'
         });
-        // Add the Dockerfile
-        generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'deploy'), targetSourceDir, {
-            agentNameSnakeCase,
-            moduleName,
-            bundleOutputDir,
-            protocol,
-            pythonBaseImage: BASE_IMAGES.python
-        }, {
-            overwriteStrategy: OverwriteStrategy.KeepExisting
-        });
-        const dockerOutputDir = joinPathFragments('dist', project.root, 'docker', name);
-        const dockerTargetName = `${agentTargetPrefix}-docker`;
-        // Add a docker target that prepares the docker context and builds the image
-        const fs = new FsCommands(tree, DEPENDENCIES);
-        project.targets[dockerTargetName] = {
-            cache: IMAGE_BUILD_CACHE,
-            executor: 'nx:run-commands',
-            options: {
-                commands: [
-                    fs.rm(dockerOutputDir),
-                    fs.mkdir(dockerOutputDir),
-                    fs.cp(bundleOutputDir, dockerOutputDir),
-                    fs.cp(`${targetSourceDir}/Dockerfile`, `${dockerOutputDir}/Dockerfile`),
-                    `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`
-                ],
-                parallel: false
-            },
-            dependsOn: [
-                bundleTargetName
-            ]
-        };
-        addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);
-        addArtifactDependencyToTargets(project, 'docker');
-        addDockerScanTarget(tree, {
-            project,
-            containerEngine: containers,
-            trivyTargetName: `${agentTargetPrefix}-trivy`,
-            dockerTargetName,
-            imageTags: [
-                dockerImageTag
-            ]
-        }, DEPENDENCIES);
+        let artifact;
+        if (container) {
+            // Add the Dockerfile
+            generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'deploy'), targetSourceDir, {
+                agentNameSnakeCase,
+                moduleName,
+                bundleOutputDir,
+                protocol,
+                pythonBaseImage: BASE_IMAGES.python
+            }, {
+                overwriteStrategy: OverwriteStrategy.KeepExisting
+            });
+            const dockerOutputDir = joinPathFragments('dist', project.root, 'docker', name);
+            const dockerTargetName = `${agentTargetPrefix}-docker`;
+            // Add a docker target that prepares the docker context and builds the image
+            const fs = new FsCommands(tree, DEPENDENCIES);
+            project.targets[dockerTargetName] = {
+                cache: IMAGE_BUILD_CACHE,
+                executor: 'nx:run-commands',
+                options: {
+                    commands: [
+                        fs.rm(dockerOutputDir),
+                        fs.mkdir(dockerOutputDir),
+                        fs.cp(bundleOutputDir, dockerOutputDir),
+                        fs.cp(`${targetSourceDir}/Dockerfile`, `${dockerOutputDir}/Dockerfile`),
+                        `${containers} build --platform linux/arm64 -t ${dockerImageTag} ${dockerOutputDir}`
+                    ],
+                    parallel: false
+                },
+                dependsOn: [
+                    bundleTargetName
+                ]
+            };
+            addDependencyToTargetIfNotPresent(project, 'docker', dockerTargetName);
+            addArtifactDependencyToTargets(project, 'docker');
+            addDockerScanTarget(tree, {
+                project,
+                containerEngine: containers,
+                trivyTargetName: `${agentTargetPrefix}-trivy`,
+                dockerTargetName,
+                imageTags: [
+                    dockerImageTag
+                ]
+            }, DEPENDENCIES);
+            artifact = {
+                type: 'container',
+                dockerImageTag,
+                outputDir: dockerOutputDir
+            };
+        } else {
+            // The entry point the managed runtime runs, at the package root.
+            generateFiles(tree, joinPathFragments(import.meta.dirname, 'files', 'package'), joinPathFragments(project.root, 'package', agentNameSnakeCase), {
+                agentNameSnakeCase,
+                moduleName,
+                port: protocol === 'a2a' ? 9000 : 8080
+            }, {
+                overwriteStrategy: OverwriteStrategy.KeepExisting
+            });
+            const packageOutputDir = joinPathFragments('dist', project.root, 'package', name);
+            addPythonCodePackageTarget(tree, {
+                project,
+                targetName: `${agentTargetPrefix}-package`,
+                bundleTargetName,
+                bundleOutputDir,
+                packageOutputDir,
+                sourceRoot: project.sourceRoot,
+                moduleName,
+                entryPointPath: joinPathFragments(project.root, 'package', agentNameSnakeCase, 'main.py'),
+                entryPointFileName: 'main.py'
+            }, DEPENDENCIES);
+            artifact = {
+                type: 'code',
+                outputDir: packageOutputDir,
+                runtime: agentCorePythonRuntime(),
+                entryPoint: 'main.py'
+            };
+        }
         // Add shared constructs
         await sharedConstructsGenerator(tree, {
             iac
@@ -348,8 +385,7 @@ export const pyAgentGenerator = async (tree, options)=>{
         await addAgentInfra(tree, {
             agentNameKebabCase: name,
             agentNameClassName,
-            dockerImageTag,
-            dockerOutputDir,
+            artifact,
             iac,
             projectName: project.name,
             auth,
@@ -370,6 +406,7 @@ export const pyAgentGenerator = async (tree, options)=>{
     // Recorded below and read by the declaration's predicates, so the packages
     // added here are exactly the ones the version sync will own.
     const metadata = {
+        infra,
         port: localDevPort,
         rc: agentNameClassName,
         auth,