serverless-bedrock-agentcore-plugin 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "serverless-bedrock-agentcore-plugin",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Serverless Framework plugin for AWS Bedrock AgentCore - deploy Runtime, Memory, and Gateway resources",
   "main": "src/index.js",
   "engines": {

package/src/compilers/runtime.js

@@ -187,15 +187,15 @@ function buildRequestHeaderConfiguration(requestHeaders) {
  * Allows cross-account or cross-principal access to invoke the agent
  *
  * @param {Object} resourcePolicy - The resource policy configuration from serverless.yml
- * @returns {Object|null} CloudFormation ResourcePolicy or null
+ * @returns {Object|null} IAM policy document or null
  */
 function buildResourcePolicy(resourcePolicy) {
   if (!resourcePolicy || !resourcePolicy.Statement || resourcePolicy.Statement.length === 0) {
     return null;
   }
 
-  // CloudFormation expects the policy as a JSON object
-  // The policy should be in standard IAM policy document format
+  // Return standard IAM policy document format
+  // Applied via bedrock-agentcore-control put-resource-policy API after deploy
   return {
     Version: resourcePolicy.Version || '2012-10-17',
     Statement: resourcePolicy.Statement,
@@ -223,7 +223,10 @@ function compileRuntime(name, config, context, tags) {
   const protocolConfig = buildProtocolConfiguration(config.protocol);
   const envVars = buildEnvironmentVariables(config.environment);
   const requestHeaderConfig = buildRequestHeaderConfiguration(config.requestHeaders);
-  const resourcePolicy = buildResourcePolicy(config.resourcePolicy);
+
+  // Note: resourcePolicy is NOT included in CFN properties.
+  // CloudFormation doesn't support ResourcePolicy on AWS::BedrockAgentCore::Runtime.
+  // It is applied via the bedrock-agentcore-control put-resource-policy API after deploy.
 
   return {
     Type: 'AWS::BedrockAgentCore::Runtime',
@@ -238,7 +241,6 @@ function compileRuntime(name, config, context, tags) {
       ...(protocolConfig && { ProtocolConfiguration: protocolConfig }),
       ...(envVars && { EnvironmentVariables: envVars }),
       ...(requestHeaderConfig && { RequestHeaderConfiguration: requestHeaderConfig }),
-      ...(resourcePolicy && { ResourcePolicy: resourcePolicy }),
       ...(Object.keys(tags).length > 0 && { Tags: tags }),
     },
   };

package/src/index.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { compileRuntime } = require('./compilers/runtime');
+const { compileRuntime, buildResourcePolicy } = require('./compilers/runtime');
 const { compileRuntimeEndpoint } = require('./compilers/runtimeEndpoint');
 const { compileMemory } = require('./compilers/memory');
 const { compileGateway } = require('./compilers/gateway');
@@ -137,8 +137,11 @@ class ServerlessBedrockAgentCore {
       'after:package:compileFunctions': () => this.compileAgentCoreResources(),
       'before:package:finalize': () => this.compileAgentCoreResources(),
 
-      // Post-deploy info
-      'after:deploy:deploy': () => this.displayDeploymentInfo(),
+      // Post-deploy: apply resource policies, then display info
+      'after:deploy:deploy': async () => {
+        await this.applyResourcePolicies();
+        await this.displayDeploymentInfo();
+      },
 
       // Custom commands
       'agentcore:info:info': () => this.showInfo(),
@@ -972,6 +975,54 @@ class ServerlessBedrockAgentCore {
     }
   }
 
+  /**
+   * Apply resource policies to runtimes after deployment.
+   * CloudFormation doesn't support ResourcePolicy on AWS::BedrockAgentCore::Runtime,
+   * so we apply it via the bedrock-agentcore-control put-resource-policy API after deploy.
+   */
+  async applyResourcePolicies() {
+    const agents = this.getAgentsConfig();
+
+    if (!agents || Object.keys(agents).length === 0) {
+      return;
+    }
+
+    const agentsWithPolicies = Object.entries(agents).filter(
+      ([, config]) => config.type === 'runtime' && config.resourcePolicy
+    );
+
+    if (agentsWithPolicies.length === 0) {
+      return;
+    }
+
+    this.log.info(`Applying resource policies for ${agentsWithPolicies.length} runtime(s)...`);
+
+    for (const [name, config] of agentsWithPolicies) {
+      try {
+        this.log.info(`  Applying resource policy for '${name}'...`);
+
+        const runtimeArn = await this.getRuntimeArn(name);
+        const policyDocument = buildResourcePolicy(config.resourcePolicy);
+
+        if (!policyDocument) {
+          this.log.warning(`  Skipping '${name}': resource policy has no statements`);
+          continue;
+        }
+
+        await this.provider.request('BedrockAgentCoreControl', 'putResourcePolicy', {
+          resourceArn: runtimeArn,
+          policy: JSON.stringify(policyDocument),
+        });
+
+        this.log.info(`  Resource policy applied successfully for '${name}'`);
+      } catch (error) {
+        throw new this.serverless.classes.Error(
+          `Failed to apply resource policy for '${name}': ${error.message}`
+        );
+      }
+    }
+  }
+
   /**
    * Show information about AgentCore resources
    */