New pattern - aurora-serverless-v2-lambda-bedrock-cdk#3094
Conversation
…v2 RAG with Bedrock Deploy Aurora Serverless v2 PostgreSQL (platform version 4, 30% perf boost) with Lambda functions that query stored knowledge via Data API and use Amazon Bedrock for AI-powered answers. Scales to zero.
|
Hi @biswanathmukherjee 👋 This shows Aurora Serverless v2 with RDS Data API + Bedrock — a unique integration demonstrating RAG with Aurora pgvector, zero VPC needed. First pattern combining Aurora Data API with Bedrock embeddings. Deployed and tested. |
marcojahn
left a comment
marcojahn
left a comment
There was a problem hiding this comment.
Hey @NithinChandranR-AWS, thank you for you PR. I've made some suggestions for changes, please review.
| serverlessV2MaxCapacity: 4, | ||
| writer: rds.ClusterInstance.serverlessV2("writer"), | ||
| vpc, | ||
| vpcSubnets: { subnetType: ec2.SubnetType.PUBLIC }, |
There was a problem hiding this comment.
The Aurora Serverless v2 cluster is placed in SubnetType.PUBLIC. AWS best practice is to host database clusters in private/isolated subnets so they are not reachable from the internet.
There was a problem hiding this comment.
I agree, moved the cluster into a dedicated VPC with PRIVATE_ISOLATED subnets. Since we use the RDS Data API, I think its okay if Lambda doesn't need to be in the VPC?
| queryFn.addToRolePolicy( | ||
| new iam.PolicyStatement({ | ||
| actions: ["bedrock:InvokeModel"], | ||
| resources: ["*"], |
There was a problem hiding this comment.
The query function's IAM policy allows bedrock:InvokeModel on resources: ["*"], permitting invocation of every foundation model and inference profile in the account. Least privilege recommends scoping to the specific model/inference profile in use.
There was a problem hiding this comment.
Scoped to the specific inference-profile and foundation-model ARNs for the model in use.
There was a problem hiding this comment.
A cached cdk.context.json is committed containing a real AWS account ID (742460038667), a VPC ID, and six subnet IDs.
There was a problem hiding this comment.
Deleted it and added cdk.context.json to .gitignore. Since the stack now creates its own VPC (no fromLookup), context is only needed for AZ resolution at deploy time.
|
|
||
| ## How it works | ||
|
|
||
|  |
There was a problem hiding this comment.
The README embeds architecture.png, but no such file exists in the pattern directory. The image will render as a broken link on serverlessland.com and GitHub.
There was a problem hiding this comment.
Replaced the broken image reference with a text architecture description.
- Move Aurora cluster to private/isolated subnets (not public) - Scope bedrock:InvokeModel to specific model ARN - Add storageEncrypted: true to cluster - Delete cdk.context.json with real account ID, add to .gitignore - Replace broken architecture.png reference with text description - Add full service name prefixes (Amazon Aurora, AWS Lambda, Amazon Bedrock) - Fix service names in example-pattern.json
|
All 7 comments addressed and pushed. Moved the cluster to isolated subnets, added encryption, scoped IAM, and cleaned up the committed context file. Thanks for the detailed review, @marcojahn. |
|
Hi @marcojahn — Request review , when convenient. Thank you for your time and help. |
marcojahn
left a comment
marcojahn
left a comment
There was a problem hiding this comment.
Deployed and tested in a Samples account (eu-central-1). Architecture is solid and the RAG path works, but the pattern only runs end-to-end in US regions, and the first command in the README fails on a fresh deploy. Two blockers:
1. Bedrock model ID is US-only. Query Lambda hard-codes us.anthropic.claude-sonnet-4-20250514-v1:0 (a US cross-region inference profile), and the IAM policy only grants the us. ARNs (lib/aurora-serverless-v2-lambda-bedrock-stack.ts:73,82-84). In eu-central-1 this fails with ValidationException: The provided model identifier is invalid — the Aurora retrieval works, only Bedrock breaks. Please make the model/region portable (derive the us./eu./apac. prefix from the deploy region, or use a global.* profile) and match the IAM ARNs, or document that the pattern is US-only.
2. Aurora scale-to-zero resume isn't handled. With serverlessV2MinCapacity: 0, the first Data API call after idle throws DatabaseResumingException. That's the README's first post-deploy step (setup invoke) — it fails on a fresh deploy and succeeds on retry, so it looks broken when it isn't. Please add a short retry in the Lambda and/or a README note that the first call may need re-running while Aurora resumes.
Minor: README setup invoke is missing --cli-binary-format raw-in-base64-out that the query example has — make them consistent.
Nice: isolated subnets, encryption at rest, Secrets Manager, idempotent seed logic. Scale-to-zero is a great fit — just make the resume behavior expected.
| * [AWS CDK](https://docs.aws.amazon.com/cdk/latest/guide/cli.html) installed | ||
| * [Amazon Bedrock model access](https://docs.aws.amazon.com/bedrock/latest/userguide/model-access.html) enabled for Anthropic Claude Sonnet in your target region | ||
|
|
||
| ## Architecture |
There was a problem hiding this comment.
Can you please an architecture diagram?
There was a problem hiding this comment.
Added a diagram. Also fixed the region portability and added retry for scale-to-zero resume.
…Aurora resume retry, architecture diagram - MODEL_ID auto-derives region prefix (us/eu/apac) from deploy region - IAM policy uses wildcard for cross-region inference profile routing - Updated model from legacy sonnet-4-20250514 to current sonnet-4-6 - Added retry logic for DatabaseResumingException (scale-to-zero) - Added try/except error handling to query Lambda - Added --cli-binary-format to setup invoke in README - Added text architecture diagram per reviewer request - Fixed bare service names, <code> tags, description length
|
Really appreciate the detailed testing. All three issues addressed: model is now region-portable (us/eu/apac prefix derived from deploy region), Aurora resume retries added, and --cli-binary-format made consistent. Fresh deploy and end-to-end test passed. |
|
Hi @marcojahn — same here, happy to address anything further. Please let me know. Thank you for your time and help. |
added aurora-serverless-v2-lambda-bedrock-cdk.json
|
Hello @NithinChandranR-AWS, thank you for your contribution. Your PR will be merged soon |
3 participants
Description
Deploy Aurora Serverless v2 PostgreSQL (platform version 4 with 30% better performance) with Lambda functions that query stored knowledge via RDS Data API and use Amazon Bedrock for AI-powered answers.
Features
Checklist