@composurecdk/bedrock 0.10.1 → 0.10.2

package/dist/commonjs/model-alarms.d.ts

@@ -2,10 +2,10 @@ import type { FoundationModelIdentifier } from "aws-cdk-lib/aws-bedrock";
 import { Metric, type MetricOptions } from "aws-cdk-lib/aws-cloudwatch";
 import type { IConstruct } from "constructs";
 import type { AlarmDefinition } from "@composurecdk/cloudwatch";
-import type { InferenceProfile } from "./inference-profile.js";
+import type { ApplicationInferenceProfile, InferenceProfile } from "./inference-profile.js";
 import type { ModelAlarmConfig } from "./model-alarm-config.js";
 /** A model whose `AWS/Bedrock` metrics an alarm can read. */
-export type ModelAlarmTarget = FoundationModelIdentifier | InferenceProfile;
+export type ModelAlarmTarget = FoundationModelIdentifier | InferenceProfile | ApplicationInferenceProfile;
 /** `AWS/Bedrock` metrics for one model, for alarms added with `addAlarm()`. */
 export interface ModelMetrics {
     /** The `ModelId` dimension value: the model or inference profile id invoked. */

package/dist/commonjs/model-alarms.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"model-alarms.d.ts","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAsB,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAEV,eAAe,EAEhB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAE/D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,yBAAyB,GAAG,gBAAgB,CAAC;AAE5E,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CAC7D;AAID,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,YAAY,CAanE;AA6GD,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,EAAE,CA6BnB"}
+{"version":3,"file":"model-alarms.d.ts","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAOhE,OAAO,KAAK,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC5F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAC1B,yBAAyB,GAAG,gBAAgB,GAAG,2BAA2B,CAAC;AAE7E,+EAA+E;AAC/E,MAAM,WAAW,YAAY;IAC3B,gFAAgF;IAChF,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC;CAC7D;AAID,sDAAsD;AACtD,wBAAgB,YAAY,CAAC,MAAM,EAAE,gBAAgB,GAAG,YAAY,CAanE;AAoFD,0EAA0E;AAC1E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,gBAAgB,GAAG,SAAS,GACnC,eAAe,EAAE,CAUnB"}

package/dist/commonjs/model-alarms.js

@@ -5,12 +5,12 @@ exports.resolveModelAlarmDefinitions = resolveModelAlarmDefinitions;
 const aws_cdk_lib_1 = require("aws-cdk-lib");
 const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
 const cloudwatch_1 = require("@composurecdk/cloudwatch");
-const inference_target_js_1 = require("./inference-target.js");
+const alarm_definition_js_1 = require("./alarm-definition.js");
 const model_alarm_defaults_js_1 = require("./model-alarm-defaults.js");
 const PERIOD = aws_cdk_lib_1.Duration.minutes(1);
 /** Returns the `AWS/Bedrock` metrics for `target`. */
 function modelMetrics(target) {
-    const modelId = (0, inference_target_js_1.isInferenceProfile)(target) ? target.profileId : target.modelId;
+    const modelId = "profileId" in target ? target.profileId : target.modelId;
     return {
         modelId,
         metric: (metricName, options) => new aws_cloudwatch_1.Metric({
@@ -22,49 +22,38 @@ function modelMetrics(target) {
         }),
     };
 }
-const THRESHOLD_ALARMS = {
-    invocationThrottles: {
-        metricName: "InvocationThrottles",
-        statistic: "Sum",
-        defaults: model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.invocationThrottles,
-        describe: (id, t) => `Bedrock is throttling requests to ${id}; the account's quota for the model is exhausted. ` +
-            `Threshold: > ${String(t)} per minute.`,
-    },
-    invocationServerErrors: {
-        metricName: "InvocationServerErrors",
-        statistic: "Sum",
-        defaults: model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.invocationServerErrors,
-        describe: (id, t) => `Bedrock is returning server errors for ${id}. Threshold: > ${String(t)} per minute.`,
-    },
-    invocationClientErrors: {
-        metricName: "InvocationClientErrors",
-        statistic: "Sum",
-        defaults: model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.invocationClientErrors,
-        describe: (id, t) => `Requests to ${id} are failing with client errors, such as AccessDenied or validation ` +
-            `errors. Threshold: > ${String(t)} per minute.`,
-    },
-    invocationLatency: {
-        metricName: "InvocationLatency",
-        statistic: "p90",
-        describe: (id, t) => `p90 invocation latency for ${id} exceeds ${String(t)} ms.`,
-    },
-    timeToFirstToken: {
-        metricName: "TimeToFirstToken",
-        statistic: "p90",
-        describe: (id, t) => `p90 time to first token for ${id} exceeds ${String(t)} ms.`,
-    },
-};
-function toDefinition(key, metric, cfg, description) {
+function thresholdAlarms(modelId) {
     return {
-        key,
-        alarmName: cfg.alarmName,
-        metric,
-        threshold: cfg.threshold,
-        comparisonOperator: aws_cloudwatch_1.ComparisonOperator.GREATER_THAN_THRESHOLD,
-        evaluationPeriods: cfg.evaluationPeriods,
-        datapointsToAlarm: cfg.datapointsToAlarm,
-        treatMissingData: cfg.treatMissingData,
-        description,
+        invocationThrottles: {
+            metricName: "InvocationThrottles",
+            statistic: "Sum",
+            defaults: model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.invocationThrottles,
+            describe: (t) => `Bedrock is throttling requests to ${modelId}; the account's quota for the model is ` +
+                `exhausted. Threshold: > ${String(t)} per minute.`,
+        },
+        invocationServerErrors: {
+            metricName: "InvocationServerErrors",
+            statistic: "Sum",
+            defaults: model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.invocationServerErrors,
+            describe: (t) => `Bedrock is returning server errors for ${modelId}. Threshold: > ${String(t)} per minute.`,
+        },
+        invocationClientErrors: {
+            metricName: "InvocationClientErrors",
+            statistic: "Sum",
+            defaults: model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.invocationClientErrors,
+            describe: (t) => `Requests to ${modelId} are failing with client errors, such as AccessDenied or ` +
+                `validation errors. Threshold: > ${String(t)} per minute.`,
+        },
+        invocationLatency: {
+            metricName: "InvocationLatency",
+            statistic: "p90",
+            describe: (t) => `p90 invocation latency for ${modelId} exceeds ${String(t)} ms.`,
+        },
+        timeToFirstToken: {
+            metricName: "TimeToFirstToken",
+            statistic: "p90",
+            describe: (t) => `p90 time to first token for ${modelId} exceeds ${String(t)} ms.`,
+        },
     };
 }
 function quotaAlarm(scope, metrics, config) {
@@ -89,7 +78,7 @@ function quotaAlarm(scope, metrics, config) {
     }
     const cfg = (0, cloudwatch_1.resolveAlarmConfig)({ ...config, threshold: Math.floor(quota * percent) }, { ...model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.optIn, threshold: 0 });
     return [
-        toDefinition("estimatedTpmQuotaUsage", metrics.metric("EstimatedTPMQuotaUsage", { statistic: "Maximum" }), cfg, `Estimated token usage for ${metrics.modelId} exceeds ${String(percent * 100)}% of the ` +
+        (0, alarm_definition_js_1.toDefinition)("estimatedTpmQuotaUsage", metrics.metric("EstimatedTPMQuotaUsage", { statistic: "Maximum" }), cfg, `Estimated token usage for ${metrics.modelId} exceeds ${String(percent * 100)}% of the ` +
             `${String(quota)} tokens-per-minute quota.`),
     ];
 }
@@ -97,19 +86,7 @@ function quotaAlarm(scope, metrics, config) {
 function resolveModelAlarmDefinitions(scope, metrics, config) {
     if (config?.enabled === false)
         return [];
-    const definitions = Object.entries(THRESHOLD_ALARMS).flatMap(([key, spec]) => {
-        const userConfig = config?.[key];
-        if (userConfig === false || (userConfig === undefined && !spec.defaults))
-            return [];
-        if (!spec.defaults && userConfig?.threshold === undefined) {
-            throw new Error(`The "${key}" alarm has no default threshold. Supply one, e.g. ` +
-                `recommendedAlarms({ ${key}: { threshold: … } }).`);
-        }
-        const cfg = (0, cloudwatch_1.resolveAlarmConfig)(userConfig, spec.defaults ?? { ...model_alarm_defaults_js_1.MODEL_ALARM_DEFAULTS.optIn, threshold: 0 });
-        return [
-            toDefinition(key, metrics.metric(spec.metricName, { statistic: spec.statistic }), cfg, spec.describe(metrics.modelId, cfg.threshold)),
-        ];
-    });
+    const definitions = (0, alarm_definition_js_1.resolveThresholdAlarms)(thresholdAlarms(metrics.modelId), config, (metricName, statistic) => metrics.metric(metricName, { statistic }));
     return [...definitions, ...quotaAlarm(scope, metrics, config?.estimatedTpmQuotaUsage)];
 }
 //# sourceMappingURL=model-alarms.js.map

package/dist/commonjs/model-alarms.js.map

@@ -1 +1 @@
-{"version":3,"file":"model-alarms.js","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":";;AA6BA,oCAaC;AA8GD,oEAiCC;AAzLD,6CAAuC;AAEvC,+DAA4F;AAO5F,yDAA0F;AAE1F,+DAA2D;AAE3D,uEAAiE;AAajE,MAAM,MAAM,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEnC,sDAAsD;AACtD,SAAgB,YAAY,CAAC,MAAwB;IACnD,MAAM,OAAO,GAAG,IAAA,wCAAkB,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC/E,OAAO;QACL,OAAO;QACP,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,uBAAM,CAAC;YACT,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,GAAG,OAAO;SACX,CAAC;KACL,CAAC;AACJ,CAAC;AAYD,MAAM,gBAAgB,GAAyC;IAC7D,mBAAmB,EAAE;QACnB,UAAU,EAAE,qBAAqB;QACjC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,8CAAoB,CAAC,mBAAmB;QAClD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAClB,qCAAqC,EAAE,oDAAoD;YAC3F,gBAAgB,MAAM,CAAC,CAAC,CAAC,cAAc;KAC1C;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,8CAAoB,CAAC,sBAAsB;QACrD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAClB,0CAA0C,EAAE,kBAAkB,MAAM,CAAC,CAAC,CAAC,cAAc;KACxF;IACD,sBAAsB,EAAE;QACtB,UAAU,EAAE,wBAAwB;QACpC,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,8CAAoB,CAAC,sBAAsB;QACrD,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAClB,eAAe,EAAE,sEAAsE;YACvF,wBAAwB,MAAM,CAAC,CAAC,CAAC,cAAc;KAClD;IACD,iBAAiB,EAAE;QACjB,UAAU,EAAE,mBAAmB;QAC/B,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,8BAA8B,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;KACjF;IACD,gBAAgB,EAAE;QAChB,UAAU,EAAE,kBAAkB;QAC9B,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,+BAA+B,EAAE,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;KAClF;CACF,CAAC;AAEF,SAAS,YAAY,CACnB,GAAW,EACX,MAAc,EACd,GAAwB,EACxB,WAAmB;IAEnB,OAAO;QACL,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,kBAAkB,EAAE,mCAAkB,CAAC,sBAAsB;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,KAAiB,EACjB,OAAqB,EACrB,MAAkD;IAElD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAA,uCAA0B,EAAC;QACvC,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,SAAS,EAAE,6CAA6C;QACxD,UAAU,EAAE,mCAAmC;QAC/C,YAAY,EAAE,sDAAsD;KACrE,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,IAAI,8CAAoB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC;IAC1F,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE,MAAM,CAAC,KAAK,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mEAAmE,MAAM,CAAC,OAAO,CAAC,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,+BAAkB,EAC5B,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,EACrD,EAAE,GAAG,8CAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAChD,CAAC;IACF,OAAO;QACL,YAAY,CACV,wBAAwB,EACxB,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAClE,GAAG,EACH,6BAA6B,OAAO,CAAC,OAAO,YAAY,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW;YACtF,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAgB,4BAA4B,CAC1C,KAAiB,EACjB,OAAqB,EACrB,MAAoC;IAEpC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GACf,MAAM,CAAC,OAAO,CAAC,gBAAgB,CAChC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,qDAAqD;gBAC9D,uBAAuB,GAAG,wBAAwB,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAA,+BAAkB,EAC5B,UAAU,EACV,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,8CAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CACjE,CAAC;QACF,OAAO;YACL,YAAY,CACV,GAAG,EACH,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAC9D,GAAG,EACH,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,CAAC,CAC9C;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACzF,CAAC"}
+{"version":3,"file":"model-alarms.js","sourceRoot":"","sources":["../../src/model-alarms.ts"],"names":[],"mappings":";;AA8BA,oCAaC;AAqFD,oEAcC;AA9ID,6CAAuC;AAEvC,+DAAwE;AAGxE,yDAA0F;AAC1F,+DAI+B;AAG/B,uEAAiE;AAcjE,MAAM,MAAM,GAAG,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEnC,sDAAsD;AACtD,SAAgB,YAAY,CAAC,MAAwB;IACnD,MAAM,OAAO,GAAG,WAAW,IAAI,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;IAC1E,OAAO;QACL,OAAO;QACP,MAAM,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAC9B,IAAI,uBAAM,CAAC;YACT,SAAS,EAAE,aAAa;YACxB,UAAU;YACV,aAAa,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE;YACnC,MAAM,EAAE,MAAM;YACd,GAAG,OAAO;SACX,CAAC;KACL,CAAC;AACJ,CAAC;AAID,SAAS,eAAe,CAAC,OAAe;IACtC,OAAO;QACL,mBAAmB,EAAE;YACnB,UAAU,EAAE,qBAAqB;YACjC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,8CAAoB,CAAC,mBAAmB;YAClD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,qCAAqC,OAAO,yCAAyC;gBACrF,2BAA2B,MAAM,CAAC,CAAC,CAAC,cAAc;SACrD;QACD,sBAAsB,EAAE;YACtB,UAAU,EAAE,wBAAwB;YACpC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,8CAAoB,CAAC,sBAAsB;YACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,0CAA0C,OAAO,kBAAkB,MAAM,CAAC,CAAC,CAAC,cAAc;SAC7F;QACD,sBAAsB,EAAE;YACtB,UAAU,EAAE,wBAAwB;YACpC,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,8CAAoB,CAAC,sBAAsB;YACrD,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CACd,eAAe,OAAO,2DAA2D;gBACjF,mCAAmC,MAAM,CAAC,CAAC,CAAC,cAAc;SAC7D;QACD,iBAAiB,EAAE;YACjB,UAAU,EAAE,mBAAmB;YAC/B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,8BAA8B,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;SAClF;QACD,gBAAgB,EAAE;YAChB,UAAU,EAAE,kBAAkB;YAC9B,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,+BAA+B,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,MAAM;SACnF;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CACjB,KAAiB,EACjB,OAAqB,EACrB,MAAkD;IAElD,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,MAAM,KAAK,GAAG,IAAA,uCAA0B,EAAC;QACvC,KAAK;QACL,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjB,SAAS,EAAE,6CAA6C;QACxD,UAAU,EAAE,mCAAmC;QAC/C,YAAY,EAAE,sDAAsD;KACrE,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GACX,MAAM,CAAC,gBAAgB,IAAI,8CAAoB,CAAC,sBAAsB,CAAC,gBAAgB,CAAC;IAC1F,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gEAAgE,MAAM,CAAC,KAAK,CAAC,GAAG,CACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,mEAAmE,MAAM,CAAC,OAAO,CAAC,GAAG,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAA,+BAAkB,EAC5B,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,EAAE,EACrD,EAAE,GAAG,8CAAoB,CAAC,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,CAChD,CAAC;IACF,OAAO;QACL,IAAA,kCAAY,EACV,wBAAwB,EACxB,OAAO,CAAC,MAAM,CAAC,wBAAwB,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAClE,GAAG,EACH,6BAA6B,OAAO,CAAC,OAAO,YAAY,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW;YACtF,GAAG,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAgB,4BAA4B,CAC1C,KAAiB,EACjB,OAAqB,EACrB,MAAoC;IAEpC,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,WAAW,GAAG,IAAA,4CAAsB,EACxC,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAChC,MAAM,EACN,CAAC,UAAU,EAAE,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,CAAC,CACrE,CAAC;IAEF,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,sBAAsB,CAAC,CAAC,CAAC;AACzF,CAAC"}

package/dist/commonjs/model-invocation-logging-alarms.d.ts

@@ -0,0 +1,42 @@
+import type { AlarmConfig, AlarmConfigDefaults, AlarmDefinition } from "@composurecdk/cloudwatch";
+/**
+ * Controls the recommended alarms for model invocation logging. Set an alarm
+ * to `false` to disable it, or provide a config to tune it.
+ *
+ * The delivery metrics are account-wide for the Region, in the `AWS/Bedrock`
+ * namespace with no dimensions.
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/monitoring-runtime-metrics.html
+ */
+export interface ModelInvocationLoggingAlarmConfig {
+    /**
+     * Master switch: set to `false` to disable all recommended alarms.
+     * @default true
+     */
+    enabled?: boolean;
+    /**
+     * Alarm when invocation logs fail to reach the log group.
+     *
+     * Metric: `ModelInvocationLogsCloudWatchDeliveryFailure`, statistic Sum.
+     */
+    cloudWatchDeliveryFailure?: AlarmConfig | false;
+    /**
+     * Alarm when large or binary bodies fail to reach the large-data bucket.
+     * Created only when a large-data bucket is configured.
+     *
+     * Metric: `ModelInvocationLargeDataS3DeliveryFailure`, statistic Sum.
+     */
+    largeDataS3DeliveryFailure?: AlarmConfig | false;
+}
+type DeliveryAlarmKey = Exclude<keyof ModelInvocationLoggingAlarmConfig, "enabled">;
+/**
+ * Default alarm configuration for model invocation logging. AWS publishes no
+ * Bedrock thresholds.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export declare const MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS: Record<DeliveryAlarmKey, AlarmConfigDefaults>;
+/** Resolves the recommended delivery-failure alarms. */
+export declare function resolveModelInvocationLoggingAlarmDefinitions(config: ModelInvocationLoggingAlarmConfig | false | undefined, hasLargeDataBucket: boolean): AlarmDefinition[];
+export {};
+//# sourceMappingURL=model-invocation-logging-alarms.d.ts.map

package/dist/commonjs/model-invocation-logging-alarms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-alarms.d.ts","sourceRoot":"","sources":["../../src/model-invocation-logging-alarms.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAIlG;;;;;;;;GAQG;AACH,MAAM,WAAW,iCAAiC;IAChD;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;;OAIG;IACH,yBAAyB,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;IAEhD;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC;CAClD;AAED,KAAK,gBAAgB,GAAG,OAAO,CAAC,MAAM,iCAAiC,EAAE,SAAS,CAAC,CAAC;AAUpF;;;;;GAKG;AACH,eAAO,MAAM,uCAAuC,EAAE,MAAM,CAC1D,gBAAgB,EAChB,mBAAmB,CAIpB,CAAC;AAkBF,wDAAwD;AACxD,wBAAgB,6CAA6C,CAC3D,MAAM,EAAE,iCAAiC,GAAG,KAAK,GAAG,SAAS,EAC7D,kBAAkB,EAAE,OAAO,GAC1B,eAAe,EAAE,CA4BnB"}

package/dist/commonjs/model-invocation-logging-alarms.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS = void 0;
+exports.resolveModelInvocationLoggingAlarmDefinitions = resolveModelInvocationLoggingAlarmDefinitions;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_cloudwatch_1 = require("aws-cdk-lib/aws-cloudwatch");
+const cloudwatch_1 = require("@composurecdk/cloudwatch");
+const alarm_definition_js_1 = require("./alarm-definition.js");
+/** A failed delivery is an invocation missing from the audit record. */
+const ANY_FAILURE = {
+    threshold: 0,
+    evaluationPeriods: 1,
+    datapointsToAlarm: 1,
+    treatMissingData: aws_cloudwatch_1.TreatMissingData.NOT_BREACHING,
+};
+/**
+ * Default alarm configuration for model invocation logging. AWS publishes no
+ * Bedrock thresholds.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+exports.MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS = {
+    cloudWatchDeliveryFailure: ANY_FAILURE,
+    largeDataS3DeliveryFailure: ANY_FAILURE,
+};
+const DELIVERY_ALARMS = {
+    cloudWatchDeliveryFailure: {
+        metricName: "ModelInvocationLogsCloudWatchDeliveryFailure",
+        destination: "the log group",
+        requiresBucket: false,
+    },
+    largeDataS3DeliveryFailure: {
+        metricName: "ModelInvocationLargeDataS3DeliveryFailure",
+        destination: "the large-data bucket",
+        requiresBucket: true,
+    },
+};
+/** Resolves the recommended delivery-failure alarms. */
+function resolveModelInvocationLoggingAlarmDefinitions(config, hasLargeDataBucket) {
+    if (config === false || config?.enabled === false)
+        return [];
+    return Object.entries(DELIVERY_ALARMS).flatMap(([key, spec]) => {
+        const userConfig = config?.[key];
+        if (userConfig === false || (spec.requiresBucket && !hasLargeDataBucket))
+            return [];
+        const cfg = (0, cloudwatch_1.resolveAlarmConfig)(userConfig, exports.MODEL_INVOCATION_LOGGING_ALARM_DEFAULTS[key]);
+        const metric = new aws_cloudwatch_1.Metric({
+            namespace: "AWS/Bedrock",
+            metricName: spec.metricName,
+            statistic: "Sum",
+            period: aws_cdk_lib_1.Duration.minutes(1),
+        });
+        return [
+            (0, alarm_definition_js_1.toDefinition)(key, metric, cfg, `Bedrock model invocation logs are failing to reach ${spec.destination}; ` +
+                `invocations are missing from the audit record. Threshold: > ${String(cfg.threshold)} per minute.`),
+        ];
+    });
+}
+//# sourceMappingURL=model-invocation-logging-alarms.js.map

package/dist/commonjs/model-invocation-logging-alarms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-alarms.js","sourceRoot":"","sources":["../../src/model-invocation-logging-alarms.ts"],"names":[],"mappings":";;;AA+EA,sGA+BC;AA9GD,6CAAuC;AACvC,+DAAsE;AAEtE,yDAA8D;AAC9D,+DAAqD;AAoCrD,wEAAwE;AACxE,MAAM,WAAW,GAAwB;IACvC,SAAS,EAAE,CAAC;IACZ,iBAAiB,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,iCAAgB,CAAC,aAAa;CACjD,CAAC;AAEF;;;;;GAKG;AACU,QAAA,uCAAuC,GAGhD;IACF,yBAAyB,EAAE,WAAW;IACtC,0BAA0B,EAAE,WAAW;CACxC,CAAC;AAEF,MAAM,eAAe,GAGjB;IACF,yBAAyB,EAAE;QACzB,UAAU,EAAE,8CAA8C;QAC1D,WAAW,EAAE,eAAe;QAC5B,cAAc,EAAE,KAAK;KACtB;IACD,0BAA0B,EAAE;QAC1B,UAAU,EAAE,2CAA2C;QACvD,WAAW,EAAE,uBAAuB;QACpC,cAAc,EAAE,IAAI;KACrB;CACF,CAAC;AAEF,wDAAwD;AACxD,SAAgB,6CAA6C,CAC3D,MAA6D,EAC7D,kBAA2B;IAE3B,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,EAAE,CAAC;IAE7D,OACE,MAAM,CAAC,OAAO,CAAC,eAAe,CAI/B,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,kBAAkB,CAAC;YAAE,OAAO,EAAE,CAAC;QACpF,MAAM,GAAG,GAAG,IAAA,+BAAkB,EAAC,UAAU,EAAE,+CAAuC,CAAC,GAAG,CAAC,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,IAAI,uBAAM,CAAC;YACxB,SAAS,EAAE,aAAa;YACxB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,SAAS,EAAE,KAAK;YAChB,MAAM,EAAE,sBAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,IAAA,kCAAY,EACV,GAAG,EACH,MAAM,EACN,GAAG,EACH,sDAAsD,IAAI,CAAC,WAAW,IAAI;gBACxE,+DAA+D,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,cAAc,CACrG;SACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/commonjs/model-invocation-logging-builder.d.ts

@@ -0,0 +1,84 @@
+import type { Alarm } from "aws-cdk-lib/aws-cloudwatch";
+import { type IRole } from "aws-cdk-lib/aws-iam";
+import type { ILogGroup } from "aws-cdk-lib/aws-logs";
+import type { IBucket } from "aws-cdk-lib/aws-s3";
+import { type AwsCustomResource } from "aws-cdk-lib/custom-resources";
+import type { IConstruct } from "constructs";
+import { type Lifecycle, type Resolvable } from "@composurecdk/core";
+import { type ITaggedBuilder } from "@composurecdk/cloudformation";
+import { type ILogGroupBuilder } from "@composurecdk/logs";
+import { type ModelInvocationLoggingAlarmConfig } from "./model-invocation-logging-alarms.js";
+/** Which request and response modalities are logged. */
+export interface ModelInvocationLoggingModalities {
+    textDataDeliveryEnabled?: boolean;
+    imageDataDeliveryEnabled?: boolean;
+    embeddingDataDeliveryEnabled?: boolean;
+    videoDataDeliveryEnabled?: boolean;
+}
+/** Configuration properties for {@link createModelInvocationLoggingBuilder}. */
+export interface ModelInvocationLoggingBuilderProps extends ModelInvocationLoggingModalities {
+    /** The log group the builder creates, from `@composurecdk/logs`' defaults. */
+    logGroup?: {
+        /** Customises the log group sub-builder. */
+        configure?: (builder: ILogGroupBuilder) => ILogGroupBuilder;
+    };
+    /**
+     * Receives bodies over 100 KB and binary data, such as images, which
+     * CloudWatch Logs cannot hold; without it, those bodies are not logged. The
+     * builder adds the bucket and key policy statements Bedrock needs to write.
+     */
+    largeDataBucket?: Resolvable<IBucket>;
+    /** Key prefix within {@link largeDataBucket}. */
+    largeDataKeyPrefix?: string;
+    /**
+     * Configuration for the recommended delivery-failure alarms. Set to
+     * `false` to disable them.
+     */
+    recommendedAlarms?: ModelInvocationLoggingAlarmConfig | false;
+}
+/** The build output of an {@link IModelInvocationLoggingBuilder}. */
+export interface ModelInvocationLoggingBuilderResult {
+    /** The log group invocation logs are delivered to. */
+    logGroup: ILogGroup;
+    /** The role Bedrock assumes to write to {@link logGroup}. */
+    role: IRole;
+    /** The custom resource that applies the account's logging configuration. */
+    configuration: AwsCustomResource;
+    /** The CloudWatch alarms created, keyed by alarm key. */
+    alarms: Record<string, Alarm>;
+}
+/**
+ * A fluent builder for Amazon Bedrock model invocation logging.
+ *
+ * @see {@link createModelInvocationLoggingBuilder}
+ */
+export type IModelInvocationLoggingBuilder = ITaggedBuilder<ModelInvocationLoggingBuilderProps, ModelInvocationLoggingBuilder>;
+/**
+ * Every modality is logged, so the record covers every invocation.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export declare const MODEL_INVOCATION_LOGGING_DEFAULTS: Required<ModelInvocationLoggingModalities>;
+declare class ModelInvocationLoggingBuilder implements Lifecycle<ModelInvocationLoggingBuilderResult> {
+    props: Partial<ModelInvocationLoggingBuilderProps>;
+    build(scope: IConstruct, id: string, context?: Record<string, object>): ModelInvocationLoggingBuilderResult;
+}
+/**
+ * Creates a builder that turns on Amazon Bedrock model invocation logging for
+ * the account in the stack's Region, delivering to a log group it creates.
+ *
+ * Account-wide per Region: build it once. A second one overwrites the first,
+ * and deleting either stack turns logging off.
+ *
+ * @example
+ * ```ts
+ * createModelInvocationLoggingBuilder()
+ *   .largeDataBucket(ref("audit", (r: BucketBuilderResult) => r.bucket));
+ * ```
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export declare function createModelInvocationLoggingBuilder(): IModelInvocationLoggingBuilder;
+export {};
+//# sourceMappingURL=model-invocation-logging-builder.d.ts.map

package/dist/commonjs/model-invocation-logging-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-builder.d.ts","sourceRoot":"","sources":["../../src/model-invocation-logging-builder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,KAAK,EAAqC,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,iBAAiB,EAAsB,MAAM,8BAA8B,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAIlF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,KAAK,iCAAiC,EAEvC,MAAM,sCAAsC,CAAC;AAE9C,wDAAwD;AACxD,MAAM,WAAW,gCAAgC;IAC/C,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,gFAAgF;AAChF,MAAM,WAAW,kCAAmC,SAAQ,gCAAgC;IAC1F,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,4CAA4C;QAC5C,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,gBAAgB,CAAC;KAC7D,CAAC;IAEF;;;;OAIG;IACH,eAAe,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAEtC,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC/D;AAED,qEAAqE;AACrE,MAAM,WAAW,mCAAmC;IAClD,sDAAsD;IACtD,QAAQ,EAAE,SAAS,CAAC;IACpB,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,4EAA4E;IAC5E,aAAa,EAAE,iBAAiB,CAAC;IACjC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,cAAc,CACzD,kCAAkC,EAClC,6BAA6B,CAC9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,QAAQ,CAAC,gCAAgC,CAKxF,CAAC;AAuCF,cAAM,6BAA8B,YAAW,SAAS,CAAC,mCAAmC,CAAC;IAC3F,KAAK,EAAE,OAAO,CAAC,kCAAkC,CAAC,CAAM;IAExD,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,mCAAmC;CAsFvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,IAAI,8BAA8B,CAIpF"}

package/dist/commonjs/model-invocation-logging-builder.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MODEL_INVOCATION_LOGGING_DEFAULTS = void 0;
+exports.createModelInvocationLoggingBuilder = createModelInvocationLoggingBuilder;
+const aws_cdk_lib_1 = require("aws-cdk-lib");
+const aws_iam_1 = require("aws-cdk-lib/aws-iam");
+const custom_resources_1 = require("aws-cdk-lib/custom-resources");
+const core_1 = require("@composurecdk/core");
+const cloudformation_1 = require("@composurecdk/cloudformation");
+const cloudwatch_1 = require("@composurecdk/cloudwatch");
+const custom_resources_2 = require("@composurecdk/custom-resources");
+const iam_1 = require("@composurecdk/iam");
+const logs_1 = require("@composurecdk/logs");
+const model_invocation_logging_alarms_js_1 = require("./model-invocation-logging-alarms.js");
+/**
+ * Every modality is logged, so the record covers every invocation.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+exports.MODEL_INVOCATION_LOGGING_DEFAULTS = {
+    textDataDeliveryEnabled: true,
+    imageDataDeliveryEnabled: true,
+    embeddingDataDeliveryEnabled: true,
+    videoDataDeliveryEnabled: true,
+};
+/** The stream Bedrock writes to within the log group. */
+const LOG_STREAM = "aws/bedrock/modelinvocations";
+/** Bedrock, trusted only for this account and Region (confused-deputy guard). */
+function bedrockPrincipal(stack) {
+    return new aws_iam_1.ServicePrincipal("bedrock.amazonaws.com", {
+        conditions: {
+            StringEquals: { "aws:SourceAccount": stack.account },
+            ArnLike: {
+                "aws:SourceArn": stack.formatArn({
+                    service: "bedrock",
+                    resource: "*",
+                    arnFormat: aws_cdk_lib_1.ArnFormat.NO_RESOURCE_NAME,
+                }),
+            },
+        },
+    });
+}
+/** Lets Bedrock write large-data objects into `bucket`. */
+function grantLargeDataWrite(bucket, bedrock, keyPrefix, account) {
+    const prefix = keyPrefix ? `${keyPrefix}/` : "";
+    bucket.addToResourcePolicy(new aws_iam_1.PolicyStatement({
+        principals: [bedrock],
+        actions: ["s3:PutObject"],
+        resources: [bucket.arnForObjects(`${prefix}AWSLogs/${account}/BedrockModelInvocationLogs/*`)],
+    }));
+    bucket.encryptionKey?.grant(bedrock, "kms:GenerateDataKey");
+}
+class ModelInvocationLoggingBuilder {
+    props = {};
+    build(scope, id, context = {}) {
+        const { logGroup: logGroupConfig, largeDataBucket, largeDataKeyPrefix, recommendedAlarms, ...modalities } = this.props;
+        const stack = aws_cdk_lib_1.Stack.of(scope);
+        const bedrock = bedrockPrincipal(stack);
+        const logGroupBuilder = (0, logs_1.createLogGroupBuilder)();
+        const logGroup = (logGroupConfig?.configure?.(logGroupBuilder) ?? logGroupBuilder).build(scope, `${id}LogGroup`, context).logGroup;
+        const role = (0, iam_1.createRoleBuilder)()
+            .assumedBy(bedrock)
+            .addInlinePolicyStatements("ModelInvocationLogsWriter", [
+            new aws_iam_1.PolicyStatement({
+                actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+                resources: [
+                    stack.formatArn({
+                        service: "logs",
+                        resource: "log-group",
+                        resourceName: `${logGroup.logGroupName}:log-stream:${LOG_STREAM}`,
+                        arnFormat: aws_cdk_lib_1.ArnFormat.COLON_RESOURCE_NAME,
+                    }),
+                ],
+            }),
+        ])
+            .build(scope, `${id}Role`, context).role;
+        const bucket = largeDataBucket === undefined ? undefined : (0, core_1.resolve)(largeDataBucket, context);
+        if (bucket)
+            grantLargeDataWrite(bucket, bedrock, largeDataKeyPrefix, stack.account);
+        const loggingConfig = {
+            cloudWatchConfig: {
+                logGroupName: logGroup.logGroupName,
+                roleArn: role.roleArn,
+                ...(bucket && {
+                    largeDataDeliveryS3Config: {
+                        bucketName: bucket.bucketName,
+                        ...(largeDataKeyPrefix && { keyPrefix: largeDataKeyPrefix }),
+                    },
+                }),
+            },
+            ...exports.MODEL_INVOCATION_LOGGING_DEFAULTS,
+            ...modalities,
+        };
+        const configurationBuilder = (0, custom_resources_2.createAwsCustomResourceBuilder)()
+            .onUpdate({
+            service: "Bedrock",
+            action: "PutModelInvocationLoggingConfiguration",
+            parameters: { loggingConfig },
+            physicalResourceId: custom_resources_1.PhysicalResourceId.of("ModelInvocationLogging"),
+        })
+            .onDelete({ service: "Bedrock", action: "DeleteModelInvocationLoggingConfiguration" })
+            // The configuration is account-wide for the Region; it has no ARN.
+            .allow([
+            "bedrock:PutModelInvocationLoggingConfiguration",
+            "bedrock:DeleteModelInvocationLoggingConfiguration",
+        ], ["*"])
+            .allow(["iam:PassRole"], [role.roleArn])
+            .dependsOn(role);
+        if (bucket?.policy)
+            configurationBuilder.dependsOn(bucket.policy);
+        const { customResource: configuration } = configurationBuilder.build(scope, `${id}Configuration`, context);
+        const alarms = (0, cloudwatch_1.createAlarms)(scope, id, (0, model_invocation_logging_alarms_js_1.resolveModelInvocationLoggingAlarmDefinitions)(recommendedAlarms, bucket !== undefined));
+        return { logGroup, role, configuration, alarms };
+    }
+}
+/**
+ * Creates a builder that turns on Amazon Bedrock model invocation logging for
+ * the account in the stack's Region, delivering to a log group it creates.
+ *
+ * Account-wide per Region: build it once. A second one overwrites the first,
+ * and deleting either stack turns logging off.
+ *
+ * @example
+ * ```ts
+ * createModelInvocationLoggingBuilder()
+ *   .largeDataBucket(ref("audit", (r: BucketBuilderResult) => r.bucket));
+ * ```
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+function createModelInvocationLoggingBuilder() {
+    return (0, cloudformation_1.taggedBuilder)(ModelInvocationLoggingBuilder);
+}
+//# sourceMappingURL=model-invocation-logging-builder.js.map

package/dist/commonjs/model-invocation-logging-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-builder.js","sourceRoot":"","sources":["../../src/model-invocation-logging-builder.ts"],"names":[],"mappings":";;;AAyOA,kFAIC;AA7OD,6CAA+C;AAE/C,iDAAoF;AAGpF,mEAA0F;AAE1F,6CAA8E;AAC9E,iEAAkF;AAClF,yDAAwD;AACxD,qEAAgF;AAChF,2CAAsD;AACtD,6CAAkF;AAClF,6FAG8C;AAyD9C;;;;GAIG;AACU,QAAA,iCAAiC,GAA+C;IAC3F,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,IAAI;IAC9B,4BAA4B,EAAE,IAAI;IAClC,wBAAwB,EAAE,IAAI;CAC/B,CAAC;AAEF,yDAAyD;AACzD,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,KAAY;IACpC,OAAO,IAAI,0BAAgB,CAAC,uBAAuB,EAAE;QACnD,UAAU,EAAE;YACV,YAAY,EAAE,EAAE,mBAAmB,EAAE,KAAK,CAAC,OAAO,EAAE;YACpD,OAAO,EAAE;gBACP,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC;oBAC/B,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,GAAG;oBACb,SAAS,EAAE,uBAAS,CAAC,gBAAgB;iBACtC,CAAC;aACH;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,SAAS,mBAAmB,CAC1B,MAAe,EACf,OAAyB,EACzB,SAA6B,EAC7B,OAAe;IAEf,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,CAAC,mBAAmB,CACxB,IAAI,yBAAe,CAAC;QAClB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,SAAS,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,WAAW,OAAO,+BAA+B,CAAC,CAAC;KAC9F,CAAC,CACH,CAAC;IACF,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,6BAA6B;IACjC,KAAK,GAAgD,EAAE,CAAC;IAExD,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,UAAkC,EAAE;QAEpC,MAAM,EACJ,QAAQ,EAAE,cAAc,EACxB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,UAAU,EACd,GAAG,IAAI,CAAC,KAAK,CAAC;QACf,MAAM,KAAK,GAAG,mBAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,eAAe,GAAG,IAAA,4BAAqB,GAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,CACtF,KAAK,EACL,GAAG,EAAE,UAAU,EACf,OAAO,CACR,CAAC,QAAQ,CAAC;QAEX,MAAM,IAAI,GAAG,IAAA,uBAAiB,GAAE;aAC7B,SAAS,CAAC,OAAO,CAAC;aAClB,yBAAyB,CAAC,2BAA2B,EAAE;YACtD,IAAI,yBAAe,CAAC;gBAClB,OAAO,EAAE,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;gBACtD,SAAS,EAAE;oBACT,KAAK,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,MAAM;wBACf,QAAQ,EAAE,WAAW;wBACrB,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,eAAe,UAAU,EAAE;wBACjE,SAAS,EAAE,uBAAS,CAAC,mBAAmB;qBACzC,CAAC;iBACH;aACF,CAAC;SACH,CAAC;aACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAE3C,MAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,cAAO,EAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7F,IAAI,MAAM;YAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpF,MAAM,aAAa,GAAG;YACpB,gBAAgB,EAAE;gBAChB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,MAAM,IAAI;oBACZ,yBAAyB,EAAE;wBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,GAAG,CAAC,kBAAkB,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;qBAC7D;iBACF,CAAC;aACH;YACD,GAAG,yCAAiC;YACpC,GAAG,UAAU;SACd,CAAC;QAEF,MAAM,oBAAoB,GAAG,IAAA,iDAA8B,GAAE;aAC1D,QAAQ,CAAC;YACR,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,wCAAwC;YAChD,UAAU,EAAE,EAAE,aAAa,EAAE;YAC7B,kBAAkB,EAAE,qCAAkB,CAAC,EAAE,CAAC,wBAAwB,CAAC;SACpE,CAAC;aACD,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;YACtF,mEAAmE;aAClE,KAAK,CACJ;YACE,gDAAgD;YAChD,mDAAmD;SACpD,EACD,CAAC,GAAG,CAAC,CACN;aACA,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aACvC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,MAAM,EAAE,MAAM;YAAE,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAClE,KAAK,EACL,GAAG,EAAE,eAAe,EACpB,OAAO,CACR,CAAC;QAEF,MAAM,MAAM,GAAG,IAAA,yBAAY,EACzB,KAAK,EACL,EAAE,EACF,IAAA,kFAA6C,EAAC,iBAAiB,EAAE,MAAM,KAAK,SAAS,CAAC,CACvF,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAgB,mCAAmC;IACjD,OAAO,IAAA,8BAAa,EAClB,6BAA6B,CAC9B,CAAC;AACJ,CAAC"}

package/dist/esm/alarm-definition.d.ts

@@ -0,0 +1,29 @@
+import { type Metric, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import type { AlarmConfig, AlarmConfigDefaults, AlarmDefinition, ResolvedAlarmConfig } from "@composurecdk/cloudwatch";
+/**
+ * 3 breaching minutes out of 5: SDK retries absorb isolated throttles and
+ * transient errors, so a single datapoint is noise. No traffic emits no data.
+ * @internal
+ */
+export declare const SUSTAINED: {
+    evaluationPeriods: number;
+    datapointsToAlarm: number;
+    treatMissingData: TreatMissingData;
+};
+/** A greater-than alarm definition from a resolved config. @internal */
+export declare function toDefinition(key: string, metric: Metric, cfg: ResolvedAlarmConfig, description: string): AlarmDefinition;
+/** A recommended alarm on one metric. @internal */
+export interface ThresholdAlarmSpec {
+    metricName: string;
+    statistic: string;
+    /** Absent for opt-in alarms, whose threshold the caller must supply. */
+    defaults?: AlarmConfigDefaults;
+    describe: (threshold: number) => string;
+}
+/**
+ * Resolves each spec against the caller's config: on-by-default alarms merge
+ * over their defaults, opt-in alarms are created only when configured, with
+ * a threshold. @internal
+ */
+export declare function resolveThresholdAlarms<K extends string>(specs: Record<K, ThresholdAlarmSpec>, config: Partial<Record<K, AlarmConfig | false>> | undefined, metric: (metricName: string, statistic: string) => Metric): AlarmDefinition[];
+//# sourceMappingURL=alarm-definition.d.ts.map

package/dist/esm/alarm-definition.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-definition.d.ts","sourceRoot":"","sources":["../../src/alarm-definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,MAAM,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EACV,WAAW,EACX,mBAAmB,EACnB,eAAe,EACf,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAGlC;;;;GAIG;AACH,eAAO,MAAM,SAAS;;;;CAIrB,CAAC;AAEF,wEAAwE;AACxE,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,mBAAmB,EACxB,WAAW,EAAE,MAAM,GAClB,eAAe,CAYjB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,mBAAmB,CAAC;IAC/B,QAAQ,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,MAAM,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,MAAM,EACrD,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,kBAAkB,CAAC,EACpC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,CAAC,GAAG,SAAS,EAC3D,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GACxD,eAAe,EAAE,CAgBnB"}

package/dist/esm/alarm-definition.js

@@ -0,0 +1,48 @@
+import { ComparisonOperator, TreatMissingData } from "aws-cdk-lib/aws-cloudwatch";
+import { resolveAlarmConfig } from "@composurecdk/cloudwatch";
+/**
+ * 3 breaching minutes out of 5: SDK retries absorb isolated throttles and
+ * transient errors, so a single datapoint is noise. No traffic emits no data.
+ * @internal
+ */
+export const SUSTAINED = {
+    evaluationPeriods: 5,
+    datapointsToAlarm: 3,
+    treatMissingData: TreatMissingData.NOT_BREACHING,
+};
+/** A greater-than alarm definition from a resolved config. @internal */
+export function toDefinition(key, metric, cfg, description) {
+    return {
+        key,
+        alarmName: cfg.alarmName,
+        metric,
+        threshold: cfg.threshold,
+        comparisonOperator: ComparisonOperator.GREATER_THAN_THRESHOLD,
+        evaluationPeriods: cfg.evaluationPeriods,
+        datapointsToAlarm: cfg.datapointsToAlarm,
+        treatMissingData: cfg.treatMissingData,
+        description,
+    };
+}
+/**
+ * Resolves each spec against the caller's config: on-by-default alarms merge
+ * over their defaults, opt-in alarms are created only when configured, with
+ * a threshold. @internal
+ */
+export function resolveThresholdAlarms(specs, config, metric) {
+    return Object.keys(specs).flatMap((key) => {
+        const spec = specs[key];
+        const userConfig = config?.[key];
+        if (userConfig === false || (userConfig === undefined && !spec.defaults))
+            return [];
+        if (!spec.defaults && userConfig?.threshold === undefined) {
+            throw new Error(`The "${key}" alarm has no default threshold. Supply one, e.g. ` +
+                `recommendedAlarms({ ${key}: { threshold: … } }).`);
+        }
+        const cfg = resolveAlarmConfig(userConfig, spec.defaults ?? { ...SUSTAINED, threshold: 0 });
+        return [
+            toDefinition(key, metric(spec.metricName, spec.statistic), cfg, spec.describe(cfg.threshold)),
+        ];
+    });
+}
+//# sourceMappingURL=alarm-definition.js.map

package/dist/esm/alarm-definition.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"alarm-definition.js","sourceRoot":"","sources":["../../src/alarm-definition.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAe,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAO/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG;IACvB,iBAAiB,EAAE,CAAC;IACpB,iBAAiB,EAAE,CAAC;IACpB,gBAAgB,EAAE,gBAAgB,CAAC,aAAa;CACjD,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,MAAc,EACd,GAAwB,EACxB,WAAmB;IAEnB,OAAO;QACL,GAAG;QACH,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,kBAAkB,EAAE,kBAAkB,CAAC,sBAAsB;QAC7D,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;QACxC,gBAAgB,EAAE,GAAG,CAAC,gBAAgB;QACtC,WAAW;KACZ,CAAC;AACJ,CAAC;AAWD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAoC,EACpC,MAA2D,EAC3D,MAAyD;IAEzD,OAAQ,MAAM,CAAC,IAAI,CAAC,KAAK,CAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,UAAU,KAAK,KAAK,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC;YAAE,OAAO,EAAE,CAAC;QACpF,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,UAAU,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YAC1D,MAAM,IAAI,KAAK,CACb,QAAQ,GAAG,qDAAqD;gBAC9D,uBAAuB,GAAG,wBAAwB,CACrD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,IAAI,EAAE,GAAG,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5F,OAAO;YACL,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;SAC9F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}