thinkwork-cli 0.13.2 → 1.0.0

package/dist/terraform/modules/app/hindsight-memory/main.tf

@@ -1,411 +0,0 @@
-################################################################################
-# Hindsight Memory (Optional Add-On) — App Module
-#
-# Optional ECS Fargate + ALB service for Hindsight long-term memory. Only
-# created when `enable_hindsight = true`. AgentCore managed memory is
-# always on (see ../agentcore-memory) — Hindsight runs alongside it as an
-# add-on, not as a replacement.
-#
-# Hindsight provides hindsight_retain/recall/reflect tools for cross-thread
-# organizational memory with entity-graph traversal and cross-encoder
-# reranking. It runs local embeddings + reranker and uses the shared Aurora
-# PostgreSQL instance with pgvector.
-################################################################################
-
-variable "stage" {
-  type = string
-}
-
-variable "vpc_id" {
-  type = string
-}
-
-variable "subnet_ids" {
-  type = list(string)
-}
-
-variable "db_security_group_id" {
-  type = string
-}
-
-variable "database_url" {
-  type      = string
-  sensitive = true
-}
-
-variable "database_name" {
-  description = <<-EOT
-    Dedicated Hindsight database name (THINK-220). Empty (default) keeps the
-    legacy layout: Hindsight lives in the `hindsight` schema of the primary
-    database named in database_url. Set (e.g. "thinkwork_hindsight") to point
-    the service at that database on the same cluster with schema `public` —
-    the vanilla upstream configuration, which its maintenance-loop discovery
-    queries require. The database must already exist (bootstrap SQL; Terraform
-    cannot CREATE DATABASE inside the cluster).
-  EOT
-  type        = string
-  default     = ""
-}
-
-locals {
-  # database_url with its path segment swapped for var.database_name.
-  # Matches "...host:port/<db>" with an optional "?query" tail.
-  hindsight_database_url = (
-    var.database_name == ""
-    ? var.database_url
-    : replace(var.database_url, "/(/[^/?]+)([?].*)?$/", "/${var.database_name}$2")
-  )
-}
-
-variable "image_tag" {
-  description = "Hindsight Docker image tag (ghcr.io/vectorize-io/hindsight:<tag>)"
-  type        = string
-  default     = "0.8.4"
-}
-
-variable "enable_auto_consolidation" {
-  description = "Run Hindsight's observation consolidation engine automatically after retain. Service-level default; per-bank config overrides apply on top."
-  type        = bool
-  default     = true
-}
-
-variable "consolidation_dedup_threshold" {
-  description = "Cosine-similarity threshold for near-duplicate observation reconciliation (0.0-1.0; 1.0 disables). Hindsight default is 0.97 — set explicitly so deploys don't drift with image defaults."
-  type        = string
-  default     = "0.97"
-}
-
-variable "retain_llm_model" {
-  description = "Bedrock model id for Hindsight's retain/extraction pass. Default = Haiku 4.5, validated on image 0.8.4 (THINK-201, 2026-07-06): 12.9% dangling-referent rate vs ~38% for gpt-oss-20b, best usefulness of any measured config, zero Anthropic tool-schema errors (the 0.5.0 incompatibility that caused the THINK-198 incident is fixed upstream). Evidence: docs/solutions/tooling-decisions/hindsight-084-upgrade-validation-2026-07-06.md. Requires image >= 0.8.x for anthropic.* models."
-  type        = string
-  default     = "us.anthropic.claude-haiku-4-5-20251001-v1:0"
-}
-
-variable "observations_mission" {
-  description = "Service-level default observations mission steering what consolidation synthesizes. Empty string omits the env var so the image default applies. Per-bank overrides apply on top."
-  type        = string
-  default     = "Synthesize durable, institutional facts about the business: customers, projects, decisions, processes, tools, relationships, and recurring patterns. Filter out ephemeral state, secrets, and personal small talk."
-}
-
-data "aws_region" "current" {}
-
-################################################################################
-# ECS Cluster
-################################################################################
-
-resource "aws_ecs_cluster" "main" {
-  name = "thinkwork-${var.stage}-cluster"
-
-  setting {
-    name  = "containerInsights"
-    value = "enabled"
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-cluster" }
-}
-
-################################################################################
-# IAM
-################################################################################
-
-resource "aws_iam_role" "ecs_execution" {
-  name = "thinkwork-${var.stage}-hindsight-execution"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy_attachment" "ecs_execution" {
-  role       = aws_iam_role.ecs_execution.name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
-}
-
-resource "aws_iam_role" "ecs_task" {
-  name = "thinkwork-${var.stage}-hindsight-task"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Action    = "sts:AssumeRole"
-      Effect    = "Allow"
-      Principal = { Service = "ecs-tasks.amazonaws.com" }
-    }]
-  })
-}
-
-resource "aws_iam_role_policy" "bedrock_access" {
-  name = "bedrock-access"
-  role = aws_iam_role.ecs_task.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [{
-      Effect   = "Allow"
-      Action   = ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"]
-      Resource = "*"
-    }]
-  })
-}
-
-################################################################################
-# Security Groups
-################################################################################
-
-resource "aws_security_group" "hindsight" {
-  name_prefix = "thinkwork-${var.stage}-hindsight-"
-  description = "Hindsight ECS task"
-  vpc_id      = var.vpc_id
-
-  ingress {
-    description     = "ALB to Hindsight API"
-    from_port       = 8888
-    to_port         = 8888
-    protocol        = "tcp"
-    security_groups = [aws_security_group.alb.id]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group" "alb" {
-  name_prefix = "thinkwork-${var.stage}-hindsight-alb-"
-  description = "Hindsight ALB"
-  vpc_id      = var.vpc_id
-
-  ingress {
-    from_port   = 80
-    to_port     = 80
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  egress {
-    from_port   = 0
-    to_port     = 0
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-alb-sg" }
-  lifecycle { create_before_destroy = true }
-}
-
-resource "aws_security_group_rule" "aurora_from_hindsight" {
-  type                     = "ingress"
-  from_port                = 5432
-  to_port                  = 5432
-  protocol                 = "tcp"
-  source_security_group_id = aws_security_group.hindsight.id
-  security_group_id        = var.db_security_group_id
-}
-
-################################################################################
-# ALB
-################################################################################
-
-resource "aws_lb" "hindsight" {
-  name               = "tw-${var.stage}-hindsight"
-  internal           = false
-  load_balancer_type = "application"
-  security_groups    = [aws_security_group.alb.id]
-  subnets            = var.subnet_ids
-
-  # Synchronous retain runs LLM extraction + auto-consolidation and routinely
-  # exceeds the 60s ALB default, which returned 504s to the retain Lambda
-  # while Hindsight was still working (every dead-lettered retain attempt on
-  # dev showed ~60.1-60.5s backend latency). Must stay above the retain
-  # Lambda's HINDSIGHT_TIMEOUT_MS so the client, not the ALB, owns timeouts.
-  idle_timeout = 300
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-alb" }
-}
-
-resource "aws_lb_target_group" "hindsight" {
-  name        = "tw-${var.stage}-hindsight"
-  port        = 8888
-  protocol    = "HTTP"
-  vpc_id      = var.vpc_id
-  target_type = "ip"
-
-  health_check {
-    path                = "/health"
-    port                = "8888"
-    protocol            = "HTTP"
-    healthy_threshold   = 2
-    unhealthy_threshold = 3
-    timeout             = 10
-    interval            = 30
-    matcher             = "200-399"
-  }
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-tg" }
-}
-
-resource "aws_lb_listener" "hindsight" {
-  load_balancer_arn = aws_lb.hindsight.arn
-  port              = 80
-  protocol          = "HTTP"
-
-  default_action {
-    type             = "forward"
-    target_group_arn = aws_lb_target_group.hindsight.arn
-  }
-}
-
-################################################################################
-# CloudWatch Logs
-################################################################################
-
-resource "aws_cloudwatch_log_group" "hindsight" {
-  name              = "/thinkwork/${var.stage}/hindsight"
-  retention_in_days = 14
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight-logs" }
-}
-
-################################################################################
-# ECS Task Definition
-################################################################################
-
-resource "aws_ecs_task_definition" "hindsight" {
-  family                   = "thinkwork-${var.stage}-hindsight"
-  requires_compatibilities = ["FARGATE"]
-  network_mode             = "awsvpc"
-  cpu                      = 2048
-  memory                   = 4096
-  execution_role_arn       = aws_iam_role.ecs_execution.arn
-  task_role_arn            = aws_iam_role.ecs_task.arn
-
-  lifecycle {
-    precondition {
-      # A dedicated Hindsight database that is actually the primary database
-      # would put Hindsight's `public` schema on top of the thinkwork tables.
-      condition     = var.database_name == "" || !endswith(split("?", var.database_url)[0], "/${var.database_name}")
-      error_message = "database_name must be distinct from the primary database in database_url (THINK-220)."
-    }
-  }
-
-  runtime_platform {
-    operating_system_family = "LINUX"
-    cpu_architecture        = "ARM64"
-  }
-
-  container_definitions = jsonencode([{
-    name      = "hindsight"
-    image     = "ghcr.io/vectorize-io/hindsight:${var.image_tag}"
-    essential = true
-
-    portMappings = [{
-      containerPort = 8888
-      protocol      = "tcp"
-    }]
-
-    environment = concat([
-      { name = "HINDSIGHT_API_DATABASE_URL", value = local.hindsight_database_url },
-      # `public` on a dedicated database is upstream's vanilla layout — the
-      # maintenance-loop discovery queries only work there (THINK-220).
-      { name = "HINDSIGHT_API_DATABASE_SCHEMA", value = var.database_name == "" ? "hindsight" : "public" },
-      { name = "HINDSIGHT_API_VECTOR_EXTENSION", value = "pgvector" },
-      { name = "HINDSIGHT_API_TEXT_SEARCH_EXTENSION", value = "native" },
-      { name = "HINDSIGHT_API_RUN_MIGRATIONS_ON_STARTUP", value = "true" },
-      { name = "HINDSIGHT_API_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_LLM_MODEL", value = "openai.gpt-oss-20b-1:0" },
-      { name = "AWS_REGION_NAME", value = data.aws_region.current.name },
-      { name = "AWS_DEFAULT_REGION", value = data.aws_region.current.name },
-      { name = "HINDSIGHT_API_RETAIN_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_RETAIN_LLM_MODEL", value = var.retain_llm_model },
-      { name = "HINDSIGHT_API_REFLECT_LLM_PROVIDER", value = "bedrock" },
-      { name = "HINDSIGHT_API_REFLECT_LLM_MODEL", value = "openai.gpt-oss-120b-1:0" },
-      { name = "HINDSIGHT_API_EMBEDDINGS_PROVIDER", value = "local" },
-      { name = "HINDSIGHT_API_EMBEDDINGS_LOCAL_MODEL", value = "BAAI/bge-small-en-v1.5" },
-      { name = "HINDSIGHT_API_RERANKER_PROVIDER", value = "local" },
-      { name = "HINDSIGHT_API_RERANKER_MAX_CANDIDATES", value = "20" },
-      { name = "HINDSIGHT_API_RERANKER_LOCAL_BUCKET_BATCHING", value = "true" },
-      { name = "HINDSIGHT_API_RERANKER_LOCAL_MAX_CONCURRENT", value = "1" },
-      { name = "HINDSIGHT_API_RECALL_BUDGET_FUNCTION", value = "adaptive" },
-      { name = "HINDSIGHT_API_RECALL_BUDGET_MIN", value = "5" },
-      { name = "HINDSIGHT_API_RECALL_BUDGET_MAX", value = "300" },
-      { name = "HINDSIGHT_API_ENABLE_AUTO_CONSOLIDATION", value = tostring(var.enable_auto_consolidation) },
-      { name = "HINDSIGHT_API_CONSOLIDATION_DEDUP_THRESHOLD", value = var.consolidation_dedup_threshold },
-      ],
-      var.observations_mission != "" ? [
-        { name = "HINDSIGHT_API_OBSERVATIONS_MISSION", value = var.observations_mission },
-      ] : [],
-    )
-
-    logConfiguration = {
-      logDriver = "awslogs"
-      options = {
-        "awslogs-group"         = aws_cloudwatch_log_group.hindsight.name
-        "awslogs-region"        = data.aws_region.current.name
-        "awslogs-stream-prefix" = "hindsight"
-      }
-    }
-
-    healthCheck = {
-      command     = ["CMD-SHELL", "curl -f http://localhost:8888/health || exit 1"]
-      interval    = 30
-      timeout     = 10
-      retries     = 3
-      startPeriod = 300
-    }
-  }])
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight" }
-}
-
-################################################################################
-# ECS Service
-################################################################################
-
-resource "aws_ecs_service" "hindsight" {
-  name            = "thinkwork-${var.stage}-hindsight"
-  cluster         = aws_ecs_cluster.main.id
-  task_definition = aws_ecs_task_definition.hindsight.arn
-  desired_count   = 1
-  launch_type     = "FARGATE"
-
-  network_configuration {
-    subnets          = var.subnet_ids
-    security_groups  = [aws_security_group.hindsight.id]
-    assign_public_ip = true
-  }
-
-  load_balancer {
-    target_group_arn = aws_lb_target_group.hindsight.arn
-    container_name   = "hindsight"
-    container_port   = 8888
-  }
-
-  depends_on = [aws_lb_listener.hindsight]
-
-  tags = { Name = "thinkwork-${var.stage}-hindsight" }
-}
-
-################################################################################
-# Outputs
-################################################################################
-
-output "hindsight_endpoint" {
-  description = "Hindsight API endpoint (ALB URL)"
-  value       = "http://${aws_lb.hindsight.dns_name}"
-}
-
-output "ecs_cluster_arn" {
-  description = "ECS cluster ARN"
-  value       = aws_ecs_cluster.main.arn
-}

package/dist/terraform/modules/app/lambda-api/agentcore-harness-alarms.tf

@@ -1,88 +0,0 @@
-################################################################################
-# AgentCore Harness retirement-soak operational gates.
-#
-# These use native AWS/Lambda metrics so they work on a fresh stage without
-# pre-creating or importing implicit log groups. alarm_actions remain empty,
-# consistent with the other non-cost operational alarms in this module.
-################################################################################
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_errors" {
-  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-errors"
-  alarm_description   = "The AgentCore Harness runner crashed. The turn fails closed and must be reconciled before the retirement soak can pass."
-  namespace           = "AWS/Lambda"
-  metric_name         = "Errors"
-  statistic           = "Sum"
-  period              = 60
-  evaluation_periods  = 1
-  threshold           = 1
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
-  }
-}
-resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_throttles" {
-  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-throttles"
-  alarm_description   = "AgentCore Harness turns are being throttled before execution; capacity admission or account concurrency is insufficient."
-  namespace           = "AWS/Lambda"
-  metric_name         = "Throttles"
-  statistic           = "Sum"
-  period              = 60
-  evaluation_periods  = 1
-  threshold           = 1
-  comparison_operator = "GreaterThanOrEqualToThreshold"
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_p95" {
-  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-p95"
-  alarm_description   = "AgentCore Harness runner p95 exceeded the 120-second retirement-certification threshold."
-  namespace           = "AWS/Lambda"
-  metric_name         = "Duration"
-  extended_statistic  = "p95"
-  period              = 300
-  evaluation_periods  = 5
-  datapoints_to_alarm = 3
-  threshold           = 120000
-  comparison_operator = "GreaterThanThreshold"
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_harness_runner_async_age" {
-  count = local.deploy_lambda_handlers && var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-harness-runner-async-age"
-  alarm_description   = "AgentCore Harness Event invocations waited more than 60 seconds before execution; the runtime path is backlogged."
-  namespace           = "AWS/Lambda"
-  metric_name         = "AsyncEventAge"
-  extended_statistic  = "p95"
-  period              = 60
-  evaluation_periods  = 3
-  datapoints_to_alarm = 2
-  threshold           = 60000
-  comparison_operator = "GreaterThanThreshold"
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    FunctionName = aws_lambda_function.handler["harness-runner"].function_name
-  }
-}

package/dist/terraform/modules/app/lambda-api/agentcore-identity-alarms.tf

@@ -1,91 +0,0 @@
-################################################################################
-# THINK-316 U9 — assertion mint operational gates
-#
-# The mint emits redacted EMF metrics around only the KMS Sign call. These
-# alarms encode the frozen U9 latency and failure thresholds; no assertion,
-# subject, tenant, key id, or other caller material is emitted as a dimension.
-################################################################################
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_kms_p95" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-kms-p95"
-  alarm_description   = "AgentCore turn assertion KMS signing p95 exceeded the frozen 100 ms U9 gate."
-  namespace           = "ThinkWork/AgentCore"
-  metric_name         = "TurnAssertionKmsSignLatency"
-  extended_statistic  = "p95"
-  comparison_operator = "GreaterThanThreshold"
-  threshold           = 100
-  period              = 60
-  evaluation_periods  = 5
-  datapoints_to_alarm = 3
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    Stage = var.stage
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_kms_p99" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-kms-p99"
-  alarm_description   = "AgentCore turn assertion KMS signing p99 exceeded the frozen 250 ms U9 gate."
-  namespace           = "ThinkWork/AgentCore"
-  metric_name         = "TurnAssertionKmsSignLatency"
-  extended_statistic  = "p99"
-  comparison_operator = "GreaterThanThreshold"
-  threshold           = 250
-  period              = 60
-  evaluation_periods  = 5
-  datapoints_to_alarm = 3
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    Stage = var.stage
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_kms_failures" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-kms-failures"
-  alarm_description   = "AgentCore turn assertion KMS signing failed; new Harness/Gateway assertions fail closed."
-  namespace           = "ThinkWork/AgentCore"
-  metric_name         = "TurnAssertionKmsSignFailures"
-  statistic           = "Sum"
-  comparison_operator = "GreaterThanThreshold"
-  threshold           = 0
-  period              = 60
-  evaluation_periods  = 1
-  datapoints_to_alarm = 1
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    Stage = var.stage
-  }
-}
-
-resource "aws_cloudwatch_metric_alarm" "agentcore_turn_assertion_lambda_errors" {
-  count = var.enable_agentcore_multiplayer_proof ? 1 : 0
-
-  alarm_name          = "thinkwork-${var.stage}-agentcore-turn-assertion-errors"
-  alarm_description   = "The internal AgentCore assertion mint Lambda failed. No fallback assertion is issued."
-  namespace           = "AWS/Lambda"
-  metric_name         = "Errors"
-  statistic           = "Sum"
-  comparison_operator = "GreaterThanThreshold"
-  threshold           = 0
-  period              = 60
-  evaluation_periods  = 1
-  datapoints_to_alarm = 1
-  treat_missing_data  = "notBreaching"
-  alarm_actions       = []
-
-  dimensions = {
-    FunctionName = aws_lambda_function.handler["turn-assertion-mint"].function_name
-  }
-}

package/dist/terraform/modules/data/bedrock-knowledge-base/main.tf

@@ -1,102 +0,0 @@
-################################################################################
-# Bedrock Knowledge Base — Data Module
-#
-# Creates the IAM service role that Bedrock Knowledge Bases need to access
-# S3 documents, invoke Titan embeddings, use RDS Data API, and read secrets.
-################################################################################
-
-variable "stage" {
-  description = "Deployment stage"
-  type        = string
-}
-
-variable "account_id" {
-  description = "AWS account ID"
-  type        = string
-}
-
-variable "region" {
-  description = "AWS region"
-  type        = string
-}
-
-variable "bucket_name" {
-  description = "S3 bucket name for knowledge base documents"
-  type        = string
-}
-
-data "aws_iam_policy_document" "kb_assume" {
-  statement {
-    effect  = "Allow"
-    actions = ["sts:AssumeRole"]
-    principals {
-      type        = "Service"
-      identifiers = ["bedrock.amazonaws.com"]
-    }
-    condition {
-      test     = "StringEquals"
-      variable = "aws:SourceAccount"
-      values   = [var.account_id]
-    }
-  }
-}
-
-resource "aws_iam_role" "kb_service" {
-  name               = "thinkwork-${var.stage}-kb-service-role"
-  assume_role_policy = data.aws_iam_policy_document.kb_assume.json
-}
-
-resource "aws_iam_role_policy" "kb_permissions" {
-  name = "knowledge-base-permissions"
-  role = aws_iam_role.kb_service.id
-
-  policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "S3ReadDocs"
-        Effect = "Allow"
-        Action = [
-          "s3:GetObject",
-          "s3:ListBucket",
-        ]
-        Resource = [
-          "arn:aws:s3:::${var.bucket_name}",
-          "arn:aws:s3:::${var.bucket_name}/*",
-        ]
-      },
-      {
-        Sid    = "BedrockEmbedding"
-        Effect = "Allow"
-        Action = ["bedrock:InvokeModel"]
-        Resource = "arn:aws:bedrock:${var.region}::foundation-model/amazon.titan-embed-text-v2:0"
-      },
-      {
-        Sid    = "RDSDataAPI"
-        Effect = "Allow"
-        Action = [
-          "rds-data:ExecuteStatement",
-          "rds-data:BatchExecuteStatement",
-        ]
-        Resource = "*"
-      },
-      {
-        Sid    = "RDSDescribe"
-        Effect = "Allow"
-        Action = ["rds:DescribeDBClusters"]
-        Resource = "*"
-      },
-      {
-        Sid    = "SecretsManager"
-        Effect = "Allow"
-        Action = ["secretsmanager:GetSecretValue"]
-        Resource = "*"
-      },
-    ]
-  })
-}
-
-output "kb_service_role_arn" {
-  description = "IAM role ARN for Bedrock Knowledge Base service"
-  value       = aws_iam_role.kb_service.arn
-}