Skip to content

Commit 75c45b9

Browse files
committed
update readme
1 parent 4210e63 commit 75c45b9

File tree

1 file changed

+234
-9
lines changed
  • aws_sra_examples/solutions/genai/bedrock_org

1 file changed

+234
-9
lines changed

aws_sra_examples/solutions/genai/bedrock_org/README.md

Lines changed: 234 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
- [Deployed Resource Details](#deployed-resource-details)
66
- [Implementation Instructions](#implementation-instructions)
77
- [References](#references)
8+
- [JSON Parameters Explanation](#json-parameters-explanation)
89

910
---
1011

@@ -23,15 +24,15 @@ The architecture follows best practices for security and scalability and is desi
2324
This section provides a detailed explanation of the resources shown in the updated architecture diagram:
2425

2526
### Organization Management Account
26-
1. **AWS CloudFormation (1.1)**: Used to define and deploy resources in the solution.
27-
2. **CloudWatch Lambda Role (1.2)**: Role for enabling CloudWatch access by the Lambda function in the global region.
28-
3. **SNS Topic (1.3)**: SNS publish to Lambda. Handles fanout configuration of the solution.
29-
4. **Bedrock Lambda Function (1.4)**: Core function responsible for deploying resources and managing configurations across accounts and regions.
30-
5. **CloudWatch Log Group (1.5)**: Logs for monitoring the execution of the Lambda function.
31-
6. **Dead-Letter Queue (DLQ) (1.6)**: Handles failed Lambda invocations.
32-
7. **CloudWatch Filters (1.7)**: Filters specific log events to track relevant activities.
33-
8. **CloudWatch Alarms (1.8)**: Triggers notifications based on preconfigured thresholds.
34-
9. **SNS Topic (1.9)**: Publishes notifications for alarms and events.
27+
- **(1.1) AWS CloudFormation**: Used to define and deploy resources in the solution.
28+
- **CloudWatch Lambda Role (1.2)**: Role for enabling CloudWatch access by the Lambda function in the global region.
29+
- **SNS Topic (1.3)**: SNS publish to Lambda. Handles fanout configuration of the solution.
30+
- **Bedrock Lambda Function (1.4)**: Core function responsible for deploying resources and managing configurations across accounts and regions.
31+
- **CloudWatch Log Group (1.5)**: Logs for monitoring the execution of the Lambda function.
32+
- **Dead-Letter Queue (DLQ) (1.6)**: Handles failed Lambda invocations.
33+
- **CloudWatch Filters (1.7)**: Filters specific log events to track relevant activities.
34+
- **CloudWatch Alarms (1.8)**: Triggers notifications based on preconfigured thresholds.
35+
- **SNS Topic (1.9)**: Publishes notifications for alarms and events.
3536
10. **CloudWatch Link (1.10)**: Links CloudWatch metrics across accounts and regions for centralized observability.
3637
11. **KMS Key (1.11)**: Encrypts SNS topic.
3738

@@ -124,3 +125,227 @@ Once the stack is deployed, the Bedrock Lambda function (`sra-bedrock-org`) will
124125
- [CloudWatch Metrics and Alarms](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html)
125126
- [AWS Lambda](https://docs.aws.amazon.com/lambda/latest/dg/welcome.html)
126127
- [AWS KMS](https://docs.aws.amazon.com/kms/latest/developerguide/overview.html)
128+
129+
130+
## JSON Parameters Explanation
131+
132+
This section explains the parameters in the CloudFormation template that require JSON string values. Each parameter's structure and purpose are described in detail to assist in their configuration.
133+
134+
### `pBedrockModelEvalBucketRuleParams`
135+
- **Purpose**: Configures a rule to validate a Bedrock Model Evaluation bucket.
136+
- **Structure**:
137+
{
138+
"deploy": "true|false",
139+
"accounts": ["account_id1", "account_id2"],
140+
"regions": ["region1", "region2"],
141+
"input_params": {
142+
"BucketName": "bucket-name"
143+
}
144+
}
145+
- **Fields**:
146+
- `deploy`: Whether the rule should be deployed (`true` or `false`).
147+
- `accounts`: List of account IDs to apply the rule.
148+
- `regions`: List of regions to apply the rule.
149+
- `input_params.BucketName`: Name of the evaluation bucket.
150+
151+
---
152+
153+
### `pBedrockGuardrailsRuleParams`
154+
- **Purpose**: Enforces governance guardrails for Bedrock resources.
155+
- **Structure**:
156+
{
157+
"deploy": "true|false",
158+
"accounts": ["account_id1", "account_id2"],
159+
"regions": ["region1", "region2"],
160+
"input_params": {
161+
"content_filters": "true|false",
162+
"denied_topics": "true|false",
163+
"word_filters": "true|false",
164+
"sensitive_info_filters": "true|false",
165+
"contextual_grounding": "true|false"
166+
}
167+
}
168+
- **Fields**:
169+
- `deploy`: Whether the rule should be deployed.
170+
- `accounts`: List of account IDs.
171+
- `regions`: List of regions.
172+
- `input_params`: Specifies guardrail options (`true` or `false` for each filter).
173+
174+
---
175+
176+
### `pBedrockInvocationLogCWRuleParams`
177+
- **Purpose**: Validates CloudWatch logging for model invocations.
178+
- **Structure**:
179+
{
180+
"deploy": "true|false",
181+
"accounts": ["account_id1", "account_id2"],
182+
"regions": ["region1", "region2"],
183+
"input_params": {
184+
"check_retention": "true|false",
185+
"check_encryption": "true|false"
186+
}
187+
}
188+
- **Fields**:
189+
- `deploy`: Whether the rule should be deployed.
190+
- `accounts`: List of account IDs.
191+
- `regions`: List of regions.
192+
- `input_params.check_retention`: Ensures log retention is configured.
193+
- `input_params.check_encryption`: Ensures logs are encrypted.
194+
195+
---
196+
197+
### `pBedrockInvocationLogS3RuleParams`
198+
- **Purpose**: Validates S3 logging for model invocations.
199+
- **Structure**:
200+
{
201+
"deploy": "true|false",
202+
"accounts": ["account_id1", "account_id2"],
203+
"regions": ["region1", "region2"],
204+
"input_params": {
205+
"check_retention": "true|false",
206+
"check_encryption": "true|false",
207+
"check_access_logging": "true|false",
208+
"check_object_locking": "true|false",
209+
"check_versioning": "true|false"
210+
}
211+
}
212+
- **Fields**:
213+
- `deploy`: Whether the rule should be deployed.
214+
- `accounts`: List of account IDs.
215+
- `regions`: List of regions.
216+
- `input_params.check_retention`: Ensures bucket retention policies are configured.
217+
- `input_params.check_encryption`: Ensures bucket encryption is enabled.
218+
- `input_params.check_access_logging`: Ensures bucket access logging is enabled.
219+
- `input_params.check_object_locking`: Ensures bucket object locking is enabled.
220+
- `input_params.check_versioning`: Ensures bucket versioning is enabled.
221+
222+
---
223+
224+
### `pBedrockCWEndpointsRuleParams`
225+
- **Purpose**: Validates CloudWatch VPC endpoints.
226+
- **Structure**:
227+
{
228+
"deploy": "true|false",
229+
"accounts": ["account_id1", "account_id2"],
230+
"regions": ["region1", "region2"],
231+
"input_params": {}
232+
}
233+
- **Fields**:
234+
- `deploy`: Whether the rule should be deployed.
235+
- `accounts`: List of account IDs.
236+
- `regions`: List of regions.
237+
- `input_params`: This field is currently empty.
238+
239+
---
240+
241+
### `pBedrockS3EndpointsRuleParams`
242+
- **Purpose**: Validates S3 VPC endpoints.
243+
- **Structure**:
244+
{
245+
"deploy": "true|false",
246+
"accounts": ["account_id1", "account_id2"],
247+
"regions": ["region1", "region2"],
248+
"input_params": {}
249+
}
250+
- **Fields**:
251+
- `deploy`: Whether the rule should be deployed.
252+
- `accounts`: List of account IDs.
253+
- `regions`: List of regions.
254+
- `input_params`: This field is currently empty.
255+
256+
---
257+
258+
### `pBedrockServiceChangesFilterParams`
259+
- **Purpose**: Tracks changes to services in CloudTrail logs.
260+
- **Structure**:
261+
{
262+
"deploy": "true|false",
263+
"accounts": ["account_id1", "account_id2"],
264+
"regions": ["region1", "region2"],
265+
"filter_params": {
266+
"log_group_name": "log-group-name"
267+
}
268+
}
269+
- **Fields**:
270+
- `deploy`: Whether the filter should be deployed.
271+
- `accounts`: List of account IDs.
272+
- `regions`: List of regions.
273+
- `filter_params.log_group_name`: Name of the log group to monitor for changes.
274+
275+
---
276+
277+
### `pBedrockBucketChangesFilterParams`
278+
- **Purpose**: Monitors S3 bucket changes in CloudTrail logs.
279+
- **Structure**:
280+
{
281+
"deploy": "true|false",
282+
"accounts": ["account_id1", "account_id2"],
283+
"regions": ["region1", "region2"],
284+
"filter_params": {
285+
"log_group_name": "log-group-name",
286+
"bucket_names": ["bucket1", "bucket2"]
287+
}
288+
}
289+
- **Fields**:
290+
- `deploy`: Whether the filter should be deployed.
291+
- `accounts`: List of account IDs.
292+
- `regions`: List of regions.
293+
- `filter_params.log_group_name`: Name of the log group to monitor.
294+
- `filter_params.bucket_names`: List of bucket names to track.
295+
296+
---
297+
298+
### `pBedrockPromptInjectionFilterParams`
299+
- **Purpose**: Filters prompt injection attempts in logs.
300+
- **Structure**:
301+
{
302+
"deploy": "true|false",
303+
"accounts": ["account_id1", "account_id2"],
304+
"regions": ["region1", "region2"],
305+
"filter_params": {
306+
"log_group_name": "log-group-name",
307+
"input_path": "path.to.input"
308+
}
309+
}
310+
- **Fields**:
311+
- `deploy`: Whether the filter should be deployed.
312+
- `accounts`: List of account IDs.
313+
- `regions`: List of regions.
314+
- `filter_params.log_group_name`: Name of the log group to monitor.
315+
- `filter_params.input_path`: Path to the input field to check.
316+
317+
---
318+
319+
### `pBedrockSensitiveInfoFilterParams`
320+
- **Purpose**: Filters sensitive information from logs.
321+
- **Structure**:
322+
{
323+
"deploy": "true|false",
324+
"accounts": ["account_id1", "account_id2"],
325+
"regions": ["region1", "region2"],
326+
"filter_params": {
327+
"log_group_name": "log-group-name",
328+
"input_path": "path.to.sensitive.data"
329+
}
330+
}
331+
- **Fields**:
332+
- `deploy`: Whether the filter should be deployed.
333+
- `accounts`: List of account IDs.
334+
- `regions`: List of regions.
335+
- `filter_params.log_group_name`: The name of the log group to filter.
336+
- `filter_params.input_path`: Path to the data field containing sensitive information.
337+
338+
---
339+
340+
### `pBedrockCentralObservabilityParams`
341+
- **Purpose**: Configures central observability for Bedrock accounts.
342+
- **Structure**:
343+
{
344+
"deploy": "true|false",
345+
"bedrock_accounts": ["account_id1", "account_id2"],
346+
"regions": ["region1", "region2"]
347+
}
348+
- **Fields**:
349+
- `deploy`: Whether central observability should be deployed.
350+
- `bedrock_accounts`: List of Bedrock account IDs.
351+
- `regions`: List of regions.

0 commit comments

Comments
 (0)