Skip to content

Commit 4d88731

Browse files
committed
Use secrets manager for api key
1 parent 48bf360 commit 4d88731

File tree

4 files changed

+70
-390
lines changed

4 files changed

+70
-390
lines changed

README.md

Lines changed: 17 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,7 @@ OpenAI-compatible RESTful APIs for Amazon Bedrock
66

77
## Breaking Changes
88

9-
This solution can now **automatically detect** new models supported in Amazon Bedrock.
10-
So whenever new models are added to Amazon Bedrock, you can immediately try them without the need to wait for code changes to this repo.
11-
12-
This is to use the `ListFoundationModels` api and the `ListInferenceProfiles` api by Amazon Bedrock, due to this change, additional IAM permissions are required to your Lambda/Fargate role.
13-
14-
If you are facing error: 'Unsupported model xxx, please use models API to get a list of supported models' even the model ID is correct,
15-
please either update your existing stack (**Recommended**) with the new template in the deployment folder or manually add below permissions to the related Lambda/Fargate role.
16-
17-
```json
18-
{
19-
"Action": [
20-
"bedrock:ListFoundationModels",
21-
"bedrock:ListInferenceProfiles"
22-
],
23-
"Resource": "*",
24-
"Effect": "Allow"
25-
}
26-
```
9+
This solution now uses Secrets Manager to maintain API Key for security best practice. You **MUST** create the API Key first in Secrets Manager and rotate it frequently.
2710

2811
Please raise an GitHub issue if you still have problems.
2912

@@ -74,42 +57,38 @@ Alternatively, you can use Lambda Function URL to replace ALB, see [example](htt
7457

7558
Please follow the steps below to deploy the Bedrock Proxy APIs into your AWS account. Only supports regions where Amazon Bedrock is available (such as `us-west-2`). The deployment will take approximately **3-5 minutes** 🕒.
7659

77-
**Step 1: Create your own custom API key (Optional)**
78-
79-
#### Store API Key in ParameterStore
60+
**Step 1: Create your own API key in Secrets Manager (MUST)**
8061

81-
> **Note:** This step is to use any string (without spaces) you like to create a custom API Key (credential) that will be used to access the proxy API later. This key does not have to match your actual OpenAI key, and you don't need to have an OpenAI API key. It is recommended that you take this step and ensure that you keep the key safe and private.
8262

83-
1. Open the AWS Management Console and navigate to the Systems Manager service.
84-
2. In the left-hand navigation pane, click on "Parameter Store".
85-
3. Click on the "Create parameter" button.
86-
4. In the "Create parameter" window, select the following options:
87-
- Name: Enter a descriptive name for your parameter (e.g., "BedrockProxyAPIKey").
88-
- Description: Optionally, provide a description for the parameter.
89-
- Tier: Select **Standard**.
90-
- Type: Select **SecureString**.
91-
- Value: Any string (without spaces).
92-
5. Click "Create parameter".
93-
6. Make a note of the parameter name you used (e.g., "BedrockProxyAPIKey"). You'll need this in the next step.
63+
> **Note:** This step is to use any string (without spaces) you like to create a custom API Key (credential) that will be used to access the proxy API later. This key does not have to match your actual OpenAI key, and you don't need to have an OpenAI API key. please keep the key safe and private.
9464
95-
#### Store API Key in ENV variable
65+
1. Open the AWS Management Console and navigate to the AWS Secrets Manager service.
66+
2. Click on "Store a new secret" button.
67+
3. In the "Choose secret type" page, select:
9668

97-
1. Provide an ENV variable to the container named: `API_KEY` with the API key value.
69+
Secret type: Other type of secret
70+
Key/value pairs:
71+
- Key: api_key
72+
- Value: Enter your API key value
73+
74+
Click "Next"
75+
4. In the "Configure secret" page:
76+
Secret name: Enter a name (e.g., "BedrockProxyAPIKey")
77+
Description: (Optional) Add a description of your secret
78+
5. Click "Next" and review all your settings and click "Store"
9879

9980
**Step 2: Deploy the CloudFormation stack**
10081

10182
1. Sign in to AWS Management Console, switch to the region to deploy the CloudFormation Stack to.
10283
2. Click the following button to launch the CloudFormation Stack in that region. Choose one of the following:
103-
- **ALB + Lambda**
10484

105-
[![Launch Stack](assets/launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/create/template?stackName=BedrockProxyAPI&templateURL=https://aws-gcr-solutions.s3.amazonaws.com/bedrock-access-gateway/latest/BedrockProxy.template)
10685
- **ALB + Fargate**
10786

10887
[![Launch Stack](assets/launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/create/template?stackName=BedrockProxyAPI&templateURL=https://aws-gcr-solutions.s3.amazonaws.com/bedrock-access-gateway/latest/BedrockProxyFargate.template)
10988
3. Click "Next".
11089
4. On the "Specify stack details" page, provide the following information:
11190
- Stack name: Change the stack name if needed.
112-
- ApiKeyParam (if you set up an API key in Step 1): Enter the parameter name you used for storing the API key (e.g., `BedrockProxyAPIKey`). If you did not set up an API key, leave this field blank. Click "Next".
91+
- ApiKeySecretName: Enter the secret name you used for storing the API key (e.g., `BedrockProxyAPIKey`). Click "Next".
11392
5. On the "Configure stack options" page, you can leave the default settings or customize them according to your needs.
11493
6. Click "Next".
11594
7. On the "Review" page, review the details of the stack you're about to create. Check the "I acknowledge that AWS CloudFormation might create IAM resources" checkbox at the bottom.

README_CN.md

Lines changed: 17 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -6,24 +6,7 @@
66

77
## 重大变更
88

9-
这个方案现在可以**自动检测** Amazon Bedrock 中支持的新模型。
10-
因此,当 Amazon Bedrock 添加新模型时,您可以立即尝试使用它们,无需等待此代码库的更新。
11-
12-
这是通过使用Amazon Bedrock 的 `ListFoundationModels API``ListInferenceProfiles` API 实现的。由于这一变更,您需要为 Lambda/Fargate 角色添加额外的 IAM 权限。
13-
14-
如果您遇到错误:"Unsupported model xxx, please use models API to get a list of supported models"(即使Model ID 是正确的),
15-
请使用Deployment 文件夹中的新模板更新您现有的堆栈(**推荐**),或手动为相关的 Lambda/Fargate 角色添加以下权限。
16-
17-
```json
18-
{
19-
"Action": [
20-
"bedrock:ListFoundationModels",
21-
"bedrock:ListInferenceProfiles"
22-
],
23-
"Resource": "*",
24-
"Effect": "Allow"
25-
}
26-
```
9+
为了遵循安全最佳实践,本解决方案现使用 Secrets Manager 来管理 API 密钥。您必须先在 Secrets Manager 中创建 API 密钥,并定期轮换该密钥。
2710

2811
如果依然有问题,请提个GitHub issue。
2912

@@ -76,37 +59,36 @@ OpenAI 的 API 或 SDK 无缝集成并试用 Amazon Bedrock 的模型,而无需
7659

7760
请按以下步骤将Bedrock代理API部署到您的AWS账户中。仅支持Amazon Bedrock可用的区域(如us-west-2)。 部署预计用时**3-5分钟** 🕒。
7861

79-
**第一步: 自定义您的API Key (可选)**
62+
**第一步: 在 Secrets Manager 中创建您的 API 密钥(必须)**
8063

8164
> 注意:这一步是使用任意字符串(不带空格)创建一个自定义的API Key(凭证),将用于后续访问代理API。此API Key不必与您实际的OpenAI
82-
> Key一致,您甚至无需拥有OpenAI API Key。建议您执行此步操作并且请确保保管好此API Key。
83-
84-
1. 打开AWS管理控制台,导航到Systems Manager服务。
85-
2. 在左侧导航窗格中,单击"参数存储"。
86-
3. 单击"创建参数"按钮。
87-
4. 在"创建参数"窗口中,选择以下选项:
88-
- 名称:输入参数的描述性名称(例如"BedrockProxyAPIKey")。
89-
- 描述:可选,为参数提供描述。
90-
- 层级:选择**标准**
91-
- 类型:选择**SecureString**
92-
- 值: 随意字符串(不带空格)。
93-
5. 单击"创建参数"。
94-
6. 记录您使用的参数名称(例如"BedrockProxyAPIKey")。您将在下一步中需要它。
65+
> Key一致,您甚至无需拥有OpenAI API Key。请确保保管好此API Key。
66+
67+
1. 打开 AWS 管理控制台并导航至 AWS Secrets Manager 服务。
68+
2. 点击 "存储新密钥" 按钮。
69+
3. 在 "选择密钥类型" 页面,选择:
70+
71+
密钥类型:其他类型的密钥 键/值对:
72+
73+
- 键:api_key
74+
- 值:输入您的 API 密钥值
75+
点击 "下一步"
76+
4. 在 "配置密钥" 页面: 密钥名称:输入一个名称(例如:"BedrockProxyAPIKey") 描述:(可选)添加密钥的描述
77+
5. 点击 "下一步",检查所有设置后点击 "存储"
78+
9579

9680
**第二步: 部署CloudFormation堆栈**
9781

9882
1. 登录AWS管理控制台,切换到要部署CloudFormation堆栈的区域。
9983
2. 单击以下按钮在该区域启动CloudFormation堆栈,选择一种方式部署。
100-
- **ALB + Lambda**
10184

102-
[![Launch Stack](assets/launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/create/template?stackName=BedrockProxyAPI&templateURL=https://aws-gcr-solutions.s3.amazonaws.com/bedrock-access-gateway/latest/BedrockProxy.template)
10385
- **ALB + Fargate**
10486

10587
[![Launch Stack](assets/launch-stack.png)](https://console.aws.amazon.com/cloudformation/home#/stacks/create/template?stackName=BedrockProxyAPI&templateURL=https://aws-gcr-solutions.s3.amazonaws.com/bedrock-access-gateway/latest/BedrockProxyFargate.template)
10688
3. 单击"下一步"。
10789
4. 在"指定堆栈详细信息"页面,提供以下信息:
10890
- 堆栈名称: 可以根据需要更改名称。
109-
- ApiKeyParam(如果在步骤1中设置了API Key):输入您用于存储API密钥的参数名称(例如"BedrockProxyAPIKey"),否则,请将此字段留空。
91+
- ApiKeySecretName:输入您用于存储API 密钥的名称(例如"BedrockProxyAPIKey"),否则,请将此字段留空。
11092
单击"下一步"。
11193
5. 在"配置堆栈选项"页面,您可以保留默认设置或根据需要进行自定义。
11294
6. 单击"下一步"。

0 commit comments

Comments
 (0)