Add comprehensive Bedrock Prompt Management permissions

Author: kris-szlapa

packages/cdk/nagSuppressions.ts

@@ -145,11 +145,12 @@ export const nagSuppressions = (stack: Stack) => {
     [
       {
         id: "AwsSolutions-IAM5",
-        reason: "SlackBot Lambda needs wildcard access for Lambda functions (self-invocation), KMS operations, and Bedrock prompts.",
+        reason: "SlackBot Lambda requires wildcard access for Lambda, KMS, and Bedrock resources.",
         appliesTo: [
           `Resource::arn:aws:lambda:eu-west-2:${account}:function:*`,
           `Resource::arn:aws:bedrock:eu-west-2:${account}:prompt/*`,
-          `Resource::arn:aws:bedrock:eu-west-2:${account}:prompt/${stackName}-queryReformulation:*`,
+          `Resource::arn:aws:bedrock:eu-west-2::foundation-model/*`,
+          `Resource::arn:aws:bedrock:eu-west-2:${account}:inference-profile/*`,
           "Action::kms:GenerateDataKey*",
           "Action::kms:ReEncrypt*"
         ]

packages/cdk/resources/RuntimePolicies.ts

@@ -63,10 +63,27 @@ export class RuntimePolicies extends Construct {
     })
 
     const slackBotPromptPolicy = new PolicyStatement({
-      actions: ["bedrock:GetPrompt"],
+      actions: [
+        "bedrock:CreatePrompt",
+        "bedrock:UpdatePrompt", 
+        "bedrock:GetPrompt",
+        "bedrock:ListPrompts",
+        "bedrock:DeletePrompt",
+        "bedrock:CreatePromptVersion",
+        "bedrock:OptimizePrompt",
+        "bedrock:GetFoundationModel",
+        "bedrock:ListFoundationModels",
+        "bedrock:GetInferenceProfile",
+        "bedrock:ListInferenceProfiles",
+        "bedrock:RenderPrompt",
+        "bedrock:TagResource",
+        "bedrock:UntagResource",
+        "bedrock:ListTagsForResource"
+      ],
       resources: [
-        `arn:aws:bedrock:${props.region}:${props.account}:prompt/${props.promptName}`,
-        `arn:aws:bedrock:${props.region}:${props.account}:prompt/${props.promptName}:*`
+        `arn:aws:bedrock:${props.region}:${props.account}:prompt/*`,
+        `arn:aws:bedrock:${props.region}::foundation-model/*`,
+        `arn:aws:bedrock:${props.region}:${props.account}:inference-profile/*`
       ]
     })