@composurecdk/bedrock 0.10.1 → 0.10.3

package/dist/esm/model-invocation-logging-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-builder.d.ts","sourceRoot":"","sources":["../../src/model-invocation-logging-builder.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,KAAK,KAAK,EAAqC,MAAM,qBAAqB,CAAC;AACpF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,KAAK,iBAAiB,EAAsB,MAAM,8BAA8B,CAAC;AAC1F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,KAAK,SAAS,EAAW,KAAK,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAE,KAAK,cAAc,EAAiB,MAAM,8BAA8B,CAAC;AAIlF,OAAO,EAAyB,KAAK,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAClF,OAAO,EACL,KAAK,iCAAiC,EAEvC,MAAM,sCAAsC,CAAC;AAE9C,wDAAwD;AACxD,MAAM,WAAW,gCAAgC;IAC/C,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,wBAAwB,CAAC,EAAE,OAAO,CAAC;IACnC,4BAA4B,CAAC,EAAE,OAAO,CAAC;IACvC,wBAAwB,CAAC,EAAE,OAAO,CAAC;CACpC;AAED,gFAAgF;AAChF,MAAM,WAAW,kCAAmC,SAAQ,gCAAgC;IAC1F,8EAA8E;IAC9E,QAAQ,CAAC,EAAE;QACT,4CAA4C;QAC5C,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,gBAAgB,CAAC;KAC7D,CAAC;IAEF;;;;OAIG;IACH,eAAe,CAAC,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAEtC,iDAAiD;IACjD,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAE5B;;;OAGG;IACH,iBAAiB,CAAC,EAAE,iCAAiC,GAAG,KAAK,CAAC;CAC/D;AAED,qEAAqE;AACrE,MAAM,WAAW,mCAAmC;IAClD,sDAAsD;IACtD,QAAQ,EAAE,SAAS,CAAC;IACpB,6DAA6D;IAC7D,IAAI,EAAE,KAAK,CAAC;IACZ,4EAA4E;IAC5E,aAAa,EAAE,iBAAiB,CAAC;IACjC,yDAAyD;IACzD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;CAC/B;AAED;;;;GAIG;AACH,MAAM,MAAM,8BAA8B,GAAG,cAAc,CACzD,kCAAkC,EAClC,6BAA6B,CAC9B,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iCAAiC,EAAE,QAAQ,CAAC,gCAAgC,CAKxF,CAAC;AAuCF,cAAM,6BAA8B,YAAW,SAAS,CAAC,mCAAmC,CAAC;IAC3F,KAAK,EAAE,OAAO,CAAC,kCAAkC,CAAC,CAAM;IAExD,KAAK,CACH,KAAK,EAAE,UAAU,EACjB,EAAE,EAAE,MAAM,EACV,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM,GACnC,mCAAmC;CAsFvC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mCAAmC,IAAI,8BAA8B,CAIpF"}

package/dist/esm/model-invocation-logging-builder.js

@@ -0,0 +1,131 @@
+import { ArnFormat, Stack } from "aws-cdk-lib";
+import { PolicyStatement, ServicePrincipal } from "aws-cdk-lib/aws-iam";
+import { PhysicalResourceId } from "aws-cdk-lib/custom-resources";
+import { resolve } from "@composurecdk/core";
+import { taggedBuilder } from "@composurecdk/cloudformation";
+import { createAlarms } from "@composurecdk/cloudwatch";
+import { createAwsCustomResourceBuilder } from "@composurecdk/custom-resources";
+import { createRoleBuilder } from "@composurecdk/iam";
+import { createLogGroupBuilder } from "@composurecdk/logs";
+import { resolveModelInvocationLoggingAlarmDefinitions, } from "./model-invocation-logging-alarms.js";
+/**
+ * Every modality is logged, so the record covers every invocation.
+ *
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export const MODEL_INVOCATION_LOGGING_DEFAULTS = {
+    textDataDeliveryEnabled: true,
+    imageDataDeliveryEnabled: true,
+    embeddingDataDeliveryEnabled: true,
+    videoDataDeliveryEnabled: true,
+};
+/** The stream Bedrock writes to within the log group. */
+const LOG_STREAM = "aws/bedrock/modelinvocations";
+/** Bedrock, trusted only for this account and Region (confused-deputy guard). */
+function bedrockPrincipal(stack) {
+    return new ServicePrincipal("bedrock.amazonaws.com", {
+        conditions: {
+            StringEquals: { "aws:SourceAccount": stack.account },
+            ArnLike: {
+                "aws:SourceArn": stack.formatArn({
+                    service: "bedrock",
+                    resource: "*",
+                    arnFormat: ArnFormat.NO_RESOURCE_NAME,
+                }),
+            },
+        },
+    });
+}
+/** Lets Bedrock write large-data objects into `bucket`. */
+function grantLargeDataWrite(bucket, bedrock, keyPrefix, account) {
+    const prefix = keyPrefix ? `${keyPrefix}/` : "";
+    bucket.addToResourcePolicy(new PolicyStatement({
+        principals: [bedrock],
+        actions: ["s3:PutObject"],
+        resources: [bucket.arnForObjects(`${prefix}AWSLogs/${account}/BedrockModelInvocationLogs/*`)],
+    }));
+    bucket.encryptionKey?.grant(bedrock, "kms:GenerateDataKey");
+}
+class ModelInvocationLoggingBuilder {
+    props = {};
+    build(scope, id, context = {}) {
+        const { logGroup: logGroupConfig, largeDataBucket, largeDataKeyPrefix, recommendedAlarms, ...modalities } = this.props;
+        const stack = Stack.of(scope);
+        const bedrock = bedrockPrincipal(stack);
+        const logGroupBuilder = createLogGroupBuilder();
+        const logGroup = (logGroupConfig?.configure?.(logGroupBuilder) ?? logGroupBuilder).build(scope, `${id}LogGroup`, context).logGroup;
+        const role = createRoleBuilder()
+            .assumedBy(bedrock)
+            .addInlinePolicyStatements("ModelInvocationLogsWriter", [
+            new PolicyStatement({
+                actions: ["logs:CreateLogStream", "logs:PutLogEvents"],
+                resources: [
+                    stack.formatArn({
+                        service: "logs",
+                        resource: "log-group",
+                        resourceName: `${logGroup.logGroupName}:log-stream:${LOG_STREAM}`,
+                        arnFormat: ArnFormat.COLON_RESOURCE_NAME,
+                    }),
+                ],
+            }),
+        ])
+            .build(scope, `${id}Role`, context).role;
+        const bucket = largeDataBucket === undefined ? undefined : resolve(largeDataBucket, context);
+        if (bucket)
+            grantLargeDataWrite(bucket, bedrock, largeDataKeyPrefix, stack.account);
+        const loggingConfig = {
+            cloudWatchConfig: {
+                logGroupName: logGroup.logGroupName,
+                roleArn: role.roleArn,
+                ...(bucket && {
+                    largeDataDeliveryS3Config: {
+                        bucketName: bucket.bucketName,
+                        ...(largeDataKeyPrefix && { keyPrefix: largeDataKeyPrefix }),
+                    },
+                }),
+            },
+            ...MODEL_INVOCATION_LOGGING_DEFAULTS,
+            ...modalities,
+        };
+        const configurationBuilder = createAwsCustomResourceBuilder()
+            .onUpdate({
+            service: "Bedrock",
+            action: "PutModelInvocationLoggingConfiguration",
+            parameters: { loggingConfig },
+            physicalResourceId: PhysicalResourceId.of("ModelInvocationLogging"),
+        })
+            .onDelete({ service: "Bedrock", action: "DeleteModelInvocationLoggingConfiguration" })
+            // The configuration is account-wide for the Region; it has no ARN.
+            .allow([
+            "bedrock:PutModelInvocationLoggingConfiguration",
+            "bedrock:DeleteModelInvocationLoggingConfiguration",
+        ], ["*"])
+            .allow(["iam:PassRole"], [role.roleArn])
+            .dependsOn(role);
+        if (bucket?.policy)
+            configurationBuilder.dependsOn(bucket.policy);
+        const { customResource: configuration } = configurationBuilder.build(scope, `${id}Configuration`, context);
+        const alarms = createAlarms(scope, id, resolveModelInvocationLoggingAlarmDefinitions(recommendedAlarms, bucket !== undefined));
+        return { logGroup, role, configuration, alarms };
+    }
+}
+/**
+ * Creates a builder that turns on Amazon Bedrock model invocation logging for
+ * the account in the stack's Region, delivering to a log group it creates.
+ *
+ * Account-wide per Region: build it once. A second one overwrites the first,
+ * and deleting either stack turns logging off.
+ *
+ * @example
+ * ```ts
+ * createModelInvocationLoggingBuilder()
+ *   .largeDataBucket(ref("audit", (r: BucketBuilderResult) => r.bucket));
+ * ```
+ *
+ * @see https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html
+ * @see https://docs.aws.amazon.com/wellarchitected/latest/generative-ai-lens/gensec01-bp04.html
+ */
+export function createModelInvocationLoggingBuilder() {
+    return taggedBuilder(ModelInvocationLoggingBuilder);
+}
+//# sourceMappingURL=model-invocation-logging-builder.js.map

package/dist/esm/model-invocation-logging-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model-invocation-logging-builder.js","sourceRoot":"","sources":["../../src/model-invocation-logging-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,EAAc,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGpF,OAAO,EAA0B,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAE1F,OAAO,EAAkB,OAAO,EAAmB,MAAM,oBAAoB,CAAC;AAC9E,OAAO,EAAuB,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,qBAAqB,EAAyB,MAAM,oBAAoB,CAAC;AAClF,OAAO,EAEL,6CAA6C,GAC9C,MAAM,sCAAsC,CAAC;AAyD9C;;;;GAIG;AACH,MAAM,CAAC,MAAM,iCAAiC,GAA+C;IAC3F,uBAAuB,EAAE,IAAI;IAC7B,wBAAwB,EAAE,IAAI;IAC9B,4BAA4B,EAAE,IAAI;IAClC,wBAAwB,EAAE,IAAI;CAC/B,CAAC;AAEF,yDAAyD;AACzD,MAAM,UAAU,GAAG,8BAA8B,CAAC;AAElD,iFAAiF;AACjF,SAAS,gBAAgB,CAAC,KAAY;IACpC,OAAO,IAAI,gBAAgB,CAAC,uBAAuB,EAAE;QACnD,UAAU,EAAE;YACV,YAAY,EAAE,EAAE,mBAAmB,EAAE,KAAK,CAAC,OAAO,EAAE;YACpD,OAAO,EAAE;gBACP,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC;oBAC/B,OAAO,EAAE,SAAS;oBAClB,QAAQ,EAAE,GAAG;oBACb,SAAS,EAAE,SAAS,CAAC,gBAAgB;iBACtC,CAAC;aACH;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,SAAS,mBAAmB,CAC1B,MAAe,EACf,OAAyB,EACzB,SAA6B,EAC7B,OAAe;IAEf,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAChD,MAAM,CAAC,mBAAmB,CACxB,IAAI,eAAe,CAAC;QAClB,UAAU,EAAE,CAAC,OAAO,CAAC;QACrB,OAAO,EAAE,CAAC,cAAc,CAAC;QACzB,SAAS,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,WAAW,OAAO,+BAA+B,CAAC,CAAC;KAC9F,CAAC,CACH,CAAC;IACF,MAAM,CAAC,aAAa,EAAE,KAAK,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,6BAA6B;IACjC,KAAK,GAAgD,EAAE,CAAC;IAExD,KAAK,CACH,KAAiB,EACjB,EAAU,EACV,UAAkC,EAAE;QAEpC,MAAM,EACJ,QAAQ,EAAE,cAAc,EACxB,eAAe,EACf,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,UAAU,EACd,GAAG,IAAI,CAAC,KAAK,CAAC;QACf,MAAM,KAAK,GAAG,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QAExC,MAAM,eAAe,GAAG,qBAAqB,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,cAAc,EAAE,SAAS,EAAE,CAAC,eAAe,CAAC,IAAI,eAAe,CAAC,CAAC,KAAK,CACtF,KAAK,EACL,GAAG,EAAE,UAAU,EACf,OAAO,CACR,CAAC,QAAQ,CAAC;QAEX,MAAM,IAAI,GAAG,iBAAiB,EAAE;aAC7B,SAAS,CAAC,OAAO,CAAC;aAClB,yBAAyB,CAAC,2BAA2B,EAAE;YACtD,IAAI,eAAe,CAAC;gBAClB,OAAO,EAAE,CAAC,sBAAsB,EAAE,mBAAmB,CAAC;gBACtD,SAAS,EAAE;oBACT,KAAK,CAAC,SAAS,CAAC;wBACd,OAAO,EAAE,MAAM;wBACf,QAAQ,EAAE,WAAW;wBACrB,YAAY,EAAE,GAAG,QAAQ,CAAC,YAAY,eAAe,UAAU,EAAE;wBACjE,SAAS,EAAE,SAAS,CAAC,mBAAmB;qBACzC,CAAC;iBACH;aACF,CAAC;SACH,CAAC;aACD,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC;QAE3C,MAAM,MAAM,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QAC7F,IAAI,MAAM;YAAE,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAEpF,MAAM,aAAa,GAAG;YACpB,gBAAgB,EAAE;gBAChB,YAAY,EAAE,QAAQ,CAAC,YAAY;gBACnC,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,GAAG,CAAC,MAAM,IAAI;oBACZ,yBAAyB,EAAE;wBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;wBAC7B,GAAG,CAAC,kBAAkB,IAAI,EAAE,SAAS,EAAE,kBAAkB,EAAE,CAAC;qBAC7D;iBACF,CAAC;aACH;YACD,GAAG,iCAAiC;YACpC,GAAG,UAAU;SACd,CAAC;QAEF,MAAM,oBAAoB,GAAG,8BAA8B,EAAE;aAC1D,QAAQ,CAAC;YACR,OAAO,EAAE,SAAS;YAClB,MAAM,EAAE,wCAAwC;YAChD,UAAU,EAAE,EAAE,aAAa,EAAE;YAC7B,kBAAkB,EAAE,kBAAkB,CAAC,EAAE,CAAC,wBAAwB,CAAC;SACpE,CAAC;aACD,QAAQ,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,2CAA2C,EAAE,CAAC;YACtF,mEAAmE;aAClE,KAAK,CACJ;YACE,gDAAgD;YAChD,mDAAmD;SACpD,EACD,CAAC,GAAG,CAAC,CACN;aACA,KAAK,CAAC,CAAC,cAAc,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;aACvC,SAAS,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,MAAM,EAAE,MAAM;YAAE,oBAAoB,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClE,MAAM,EAAE,cAAc,EAAE,aAAa,EAAE,GAAG,oBAAoB,CAAC,KAAK,CAClE,KAAK,EACL,GAAG,EAAE,eAAe,EACpB,OAAO,CACR,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CACzB,KAAK,EACL,EAAE,EACF,6CAA6C,CAAC,iBAAiB,EAAE,MAAM,KAAK,SAAS,CAAC,CACvF,CAAC;QAEF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;IACnD,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,mCAAmC;IACjD,OAAO,aAAa,CAClB,6BAA6B,CAC9B,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@composurecdk/bedrock",
-  "version": "0.10.1",
+  "version": "0.10.3",
   "description": "Composable Amazon Bedrock model access: cross-Region inference profiles, invocation grants and alarms",
   "repository": {
     "type": "git",
@@ -12,15 +12,6 @@
     "README.md",
     "LICENSE"
   ],
-  "scripts": {
-    "lint": "eslint .",
-    "clean": "rm -rf dist .tshy .tshy-build",
-    "build": "tshy",
-    "typecheck": "tsc --noEmit",
-    "check:exports": "attw --pack . --profile node16 && publint",
-    "test": "vitest run",
-    "test:watch": "vitest"
-  },
   "keywords": [
     "aws",
     "cdk",
@@ -52,7 +43,10 @@
     "@composurecdk/cloudformation": "^0.10.0",
     "@composurecdk/cloudwatch": "^0.10.0",
     "@composurecdk/core": "^0.10.0",
-    "aws-cdk-lib": "^2.138.0",
+    "@composurecdk/custom-resources": "^0.10.0",
+    "@composurecdk/iam": "^0.10.0",
+    "@composurecdk/logs": "^0.10.0",
+    "aws-cdk-lib": "^2.166.0",
     "constructs": "^10.0.0"
   },
   "devDependencies": {