Skip to content

Commit d314f4b

Browse files
quixoticmonkquixoticmonk
authored
v0.1.0
* Various fix to ensure reliability when deploying to non us-east-1 regions * bump AWS providers version * update Guardrails (will re-create the Lambda function as well) --------- Co-authored-by: wellsiau-aws and quixoticmonk
1 parent d1cb9e7 commit d314f4b

File tree

9 files changed

+87
-93
lines changed

9 files changed

+87
-93
lines changed

‎README.md‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ Enhance your Terraform workflows with AI-powered insights while maintaining secu
9999
|------|---------|
100100
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.5.0 |
101101
| <a name="requirement_archive"></a> [archive](#requirement\_archive) | ~>2.2.0 |
102-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.47.0 |
102+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.72.0 |
103103
| <a name="requirement_awscc"></a> [awscc](#requirement\_awscc) | >= 1.11.0 |
104104
| <a name="requirement_random"></a> [random](#requirement\_random) | >=3.4.0 |
105105

@@ -108,9 +108,8 @@ Enhance your Terraform workflows with AI-powered insights while maintaining secu
108108
| Name | Version |
109109
|------|---------|
110110
| <a name="provider_archive"></a> [archive](#provider\_archive) | ~>2.2.0 |
111-
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.47.0 |
112-
| <a name="provider_aws.cloudfront_waf"></a> [aws.cloudfront\_waf](#provider\_aws.cloudfront\_waf) | >= 5.47.0 |
113-
| <a name="provider_awscc"></a> [awscc](#provider\_awscc) | >= 1.11.0 |
111+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.72.0 |
112+
| <a name="provider_aws.cloudfront_waf"></a> [aws.cloudfront\_waf](#provider\_aws.cloudfront\_waf) | >= 5.72.0 |
114113
| <a name="provider_random"></a> [random](#provider\_random) | >=3.4.0 |
115114
| <a name="provider_terraform"></a> [terraform](#provider\_terraform) | n/a |
116115
| <a name="provider_time"></a> [time](#provider\_time) | n/a |
@@ -125,6 +124,8 @@ Enhance your Terraform workflows with AI-powered insights while maintaining secu
125124

126125
| Name | Type |
127126
|------|------|
127+
| [aws_bedrock_guardrail.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/bedrock_guardrail) | resource |
128+
| [aws_bedrock_guardrail_version.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/bedrock_guardrail_version) | resource |
128129
| [aws_cloudfront_origin_request_policy.runtask_cloudfront](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_request_policy) | resource |
129130
| [aws_cloudwatch_event_rule.runtask_rule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
130131
| [aws_cloudwatch_event_target.runtask_target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
@@ -172,8 +173,6 @@ Enhance your Terraform workflows with AI-powered insights while maintaining secu
172173
| [aws_sfn_state_machine.runtask_states](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sfn_state_machine) | resource |
173174
| [aws_wafv2_web_acl.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl) | resource |
174175
| [aws_wafv2_web_acl_logging_configuration.runtask_waf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_logging_configuration) | resource |
175-
| [awscc_bedrock_guardrail.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/bedrock_guardrail) | resource |
176-
| [awscc_bedrock_guardrail_version.runtask_fulfillment](https://registry.terraform.io/providers/hashicorp/awscc/latest/docs/resources/bedrock_guardrail_version) | resource |
177176
| [random_string.solution_prefix](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/string) | resource |
178177
| [random_uuid.runtask_cloudfront](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |
179178
| [random_uuid.runtask_hmac](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/uuid) | resource |

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
v0.0.4
1+
v0.1.0

‎bedrock.tf‎

Lines changed: 65 additions & 75 deletions
Original file line numberDiff line numberDiff line change
@@ -1,92 +1,82 @@
1-
resource "awscc_bedrock_guardrail" "runtask_fulfillment" {
2-
name = "${local.solution_prefix}-guardrail"
1+
resource "aws_bedrock_guardrail" "runtask_fulfillment" {
2+
name = "${local.solution_prefix}-guardrails"
33
blocked_input_messaging = "Unfortunately we are unable to provide response for this input"
44
blocked_outputs_messaging = "Unfortunately we are unable to provide response for this input"
55
description = "Basic Bedrock Guardrail for sensitive info exfiltration"
66

77
# detect and filter harmful user inputs and FM-generated outputs
8-
content_policy_config = {
9-
filters_config = [
10-
{
11-
input_strength = "HIGH"
12-
output_strength = "HIGH"
13-
type = "SEXUAL"
14-
},
15-
{
16-
input_strength = "HIGH"
17-
output_strength = "HIGH"
18-
type = "VIOLENCE"
19-
},
20-
{
21-
input_strength = "HIGH"
22-
output_strength = "HIGH"
23-
type = "HATE"
24-
},
25-
{
26-
input_strength = "HIGH"
27-
output_strength = "HIGH"
28-
type = "INSULTS"
29-
},
30-
{
31-
input_strength = "HIGH"
32-
output_strength = "HIGH"
33-
type = "MISCONDUCT"
34-
},
35-
{
36-
input_strength = "NONE"
37-
output_strength = "NONE"
38-
type = "PROMPT_ATTACK"
39-
}
40-
]
8+
content_policy_config {
9+
filters_config {
10+
input_strength = "HIGH"
11+
output_strength = "HIGH"
12+
type = "HATE"
13+
}
14+
filters_config {
15+
input_strength = "HIGH"
16+
output_strength = "HIGH"
17+
type = "INSULTS"
18+
}
19+
filters_config {
20+
input_strength = "HIGH"
21+
output_strength = "HIGH"
22+
type = "MISCONDUCT"
23+
}
24+
filters_config {
25+
input_strength = "NONE"
26+
output_strength = "NONE"
27+
type = "PROMPT_ATTACK"
28+
}
29+
filters_config {
30+
input_strength = "HIGH"
31+
output_strength = "HIGH"
32+
type = "SEXUAL"
33+
}
34+
filters_config {
35+
input_strength = "HIGH"
36+
output_strength = "HIGH"
37+
type = "VIOLENCE"
38+
}
4139
}
4240

4341
# block / mask potential PII information
44-
sensitive_information_policy_config = {
45-
pii_entities_config = [
46-
{
47-
action = "BLOCK"
48-
type = "DRIVER_ID"
49-
},
50-
{
51-
action = "BLOCK"
52-
type = "PASSWORD"
53-
},
54-
{
55-
action = "ANONYMIZE"
56-
type = "EMAIL"
57-
},
58-
{
59-
action = "ANONYMIZE"
60-
type = "USERNAME"
61-
},
62-
{
63-
action = "BLOCK"
64-
type = "AWS_ACCESS_KEY"
65-
},
66-
{
67-
action = "BLOCK"
68-
type = "AWS_SECRET_KEY"
69-
},
70-
]
42+
sensitive_information_policy_config {
43+
pii_entities_config {
44+
action = "BLOCK"
45+
type = "DRIVER_ID"
46+
}
47+
pii_entities_config {
48+
action = "BLOCK"
49+
type = "PASSWORD"
50+
}
51+
pii_entities_config {
52+
action = "ANONYMIZE"
53+
type = "EMAIL"
54+
}
55+
pii_entities_config {
56+
action = "ANONYMIZE"
57+
type = "USERNAME"
58+
}
59+
pii_entities_config {
60+
action = "BLOCK"
61+
type = "AWS_ACCESS_KEY"
62+
}
63+
pii_entities_config {
64+
action = "BLOCK"
65+
type = "AWS_SECRET_KEY"
66+
}
7167
}
7268

7369
# block select word / profanity
74-
word_policy_config = {
75-
managed_word_lists_config = [{
70+
word_policy_config {
71+
managed_word_lists_config {
7672
type = "PROFANITY"
77-
}]
78-
}
79-
80-
tags = [for k, v in local.combined_tags :
81-
{
82-
key : k,
83-
value : v
8473
}
85-
]
74+
}
8675

76+
tags = local.combined_tags
8777
}
8878

89-
resource "awscc_bedrock_guardrail_version" "runtask_fulfillment" {
90-
guardrail_identifier = awscc_bedrock_guardrail.runtask_fulfillment.guardrail_id
91-
description = "Initial version"
79+
resource "aws_bedrock_guardrail_version" "runtask_fulfillment" {
80+
guardrail_arn = aws_bedrock_guardrail.runtask_fulfillment.guardrail_arn
81+
description = "Initial version"
9282
}

‎cloudfront.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -190,6 +190,7 @@ resource "aws_cloudwatch_log_group" "runtask_waf" {
190190

191191
resource "aws_cloudwatch_log_resource_policy" "runtask_waf" {
192192
count = local.waf_deployment
193+
provider = aws.cloudfront_waf
193194
policy_document = data.aws_iam_policy_document.runtask_waf_log[count.index].json
194195
policy_name = "aws-waf-logs-${local.solution_prefix}-runtask_waf_acl"
195196
}

‎data.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,7 @@ data "aws_iam_policy_document" "runtask_waf_log" {
249249
resources = ["${aws_cloudwatch_log_group.runtask_waf[count.index].arn}:*"]
250250
condition {
251251
test = "ArnLike"
252-
values = ["arn:aws:logs:${data.aws_region.current_region.name}:${data.aws_caller_identity.current_account.account_id}:*"]
252+
values = ["arn:aws:logs:${data.aws_region.cloudfront_region.name}:${data.aws_caller_identity.current_account.account_id}:*"]
253253
variable = "aws:SourceArn"
254254
}
255255
condition {

‎examples/basic/README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,15 +38,15 @@ Follow the steps below to deploy the module and attach it to your HCP Terraform
3838
| Name | Version |
3939
|------|---------|
4040
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0.7 |
41-
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | 5.56.1 |
42-
| <a name="requirement_tfe"></a> [tfe](#requirement\_tfe) | ~>0.38.0 |
41+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.72.1 |
42+
| <a name="requirement_tfe"></a> [tfe](#requirement\_tfe) | ~> 0.38.0 |
4343

4444
## Providers
4545

4646
| Name | Version |
4747
|------|---------|
48-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.56.1 |
49-
| <a name="provider_tfe"></a> [tfe](#provider\_tfe) | ~>0.38.0 |
48+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.72.1 |
49+
| <a name="provider_tfe"></a> [tfe](#provider\_tfe) | ~> 0.38.0 |
5050

5151
## Modules
5252

@@ -59,7 +59,7 @@ Follow the steps below to deploy the module and attach it to your HCP Terraform
5959
| Name | Type |
6060
|------|------|
6161
| [tfe_organization_run_task.bedrock_plan_analyzer](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/resources/organization_run_task) | resource |
62-
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/5.56.1/docs/data-sources/region) | data source |
62+
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |
6363
| [tfe_organization.hcp_tf_org](https://registry.terraform.io/providers/hashicorp/tfe/latest/docs/data-sources/organization) | data source |
6464

6565
## Inputs

‎examples/basic/providers.tf‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,12 @@ terraform {
33
required_providers {
44
aws = {
55
source = "hashicorp/aws"
6-
version = "5.56.1"
6+
version = ">= 5.72.1"
77
}
88

99
tfe = {
1010
source = "hashicorp/tfe"
11-
version = "~>0.38.0"
11+
version = "~> 0.38.0"
1212
}
1313
}
1414
}
@@ -22,6 +22,10 @@ provider "aws" {
2222
region = "us-east-1" # for Cloudfront WAF only, must be in us-east-1
2323
}
2424

25+
provider "awscc" {
26+
region = var.region
27+
}
28+
2529
provider "tfe" {
2630
token = var.hcp_tf_token
2731
}

‎lambda.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -166,8 +166,8 @@ resource "aws_lambda_function" "runtask_fulfillment" {
166166
variables = {
167167
CW_LOG_GROUP_NAME = local.cloudwatch_log_group_name
168168
BEDROCK_LLM_MODEL = var.bedrock_llm_model
169-
BEDROCK_GUARDRAIL_ID = awscc_bedrock_guardrail.runtask_fulfillment.guardrail_id
170-
BEDROCK_GUARDRAIL_VERSION = awscc_bedrock_guardrail_version.runtask_fulfillment.version
169+
BEDROCK_GUARDRAIL_ID = aws_bedrock_guardrail.runtask_fulfillment.guardrail_id
170+
BEDROCK_GUARDRAIL_VERSION = aws_bedrock_guardrail_version.runtask_fulfillment.version
171171
}
172172
}
173173
tags = local.combined_tags

‎providers.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ terraform {
44
required_providers {
55
aws = {
66
source = "hashicorp/aws"
7-
version = ">= 5.47.0"
7+
version = ">= 5.72.0"
88
}
99
awscc = {
1010
source = "hashicorp/awscc"

0 commit comments

Comments
 (0)