AWS solutions low security documentation change
Summary
Updated parameters and documentation for deployment configuration. Changes include adding UseCaseUUID, clarifying existing API usage requirements, enabling feedback features, fixing Kendra documentation links, adding VPC AZs parameter, and adding Bedrock Inference Profile IAM policy configuration.
Security assessment
The addition of 'UseInferenceProfile' parameter explicitly ensures required IAM policies are configured for Bedrock cross-region inference, which directly relates to security best practices for access control. This addresses potential misconfiguration risks by enforcing proper permissions.
Diff
diff --git a/solutions/latest/generative-ai-application-builder-on-aws/deploying-the-text-use-case-stack-separately.md b/solutions/latest/generative-ai-application-builder-on-aws/deploying-the-text-use-case-stack-separately.md index 13713f731..a61714c36 100644 --- a//solutions/latest/generative-ai-application-builder-on-aws/deploying-the-text-use-case-stack-separately.md +++ b//solutions/latest/generative-ai-application-builder-on-aws/deploying-the-text-use-case-stack-separately.md @@ -7 +7 @@ -Follow the step-by-step instructions in this section to configure and deploy the solution into your account. +Follow the step-by-step instructions in this section to configure and deploy the solution into your account. @@ -13 +13 @@ Follow the step-by-step instructions in this section to configure and deploy th -**BedrockChat.template** | [  ](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?&templateURL=https://solutions-reference.s3.amazonaws.com/generative-ai-application-builder-on-aws/latest/BedrockChat.template&redirectId=ImplementationGuide) +**BedrockChat.template** | [  ](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://solutions-reference.s3.amazonaws.com/generative-ai-application-builder-on-aws/latest/BedrockChat.template&stackName=&redirectId=ImplementationGuide) @@ -15 +15 @@ Follow the step-by-step instructions in this section to configure and deploy th -**SageMakerChat.template** | [  ](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?&templateURL=https://solutions-reference.s3.amazonaws.com/generative-ai-application-builder-on-aws/latest/SageMakerChat.template&redirectId=ImplementationGuide) +**SageMakerChat.template** | [  ](https://console.aws.amazon.com/cloudformation/home?region=us-east-1#/stacks/quickcreate?templateURL=https://solutions-reference.s3.amazonaws.com/generative-ai-application-builder-on-aws/latest/SageMakerChat.template&stackName=&redirectId=ImplementationGuide) @@ -27 +27 @@ Note: This solution uses Amazon Kendra and Amazon Bedrock, which are not current -**UseCaseConfigRecordKey** | `<_Requires input_>` | Key corresponding of the record containing configurations required by the chat provider Lambda at runtime. The record in the table must have a **key** attribute matching this value, and a **config** attribute containing the desired configuration. This record will be populated by the deployment platform if in use. For standalone deployments of this use case, a manually created entry in the table defined in **UseCaseConfigTableName** is required. +**UseCaseUUID** | `<_Requires input_>` | 36 character long UUIDv4 to identify this deployed use case within an application. @@ -28,0 +29 @@ Note: This solution uses Amazon Kendra and Amazon Bedrock, which are not current +**UseCaseConfigRecordKey** | `<_Requires input_>` | Key corresponding of the record containing configurations required by the chat provider Lambda at runtime. The record in the table must have a **key** attribute matching this value, and a **config** attribute containing the desired configuration. This record will be populated by the deployment platform if in use. For standalone deployments of this use case, a manually created entry in the table defined in **UseCaseConfigTableName** is required. @@ -29,0 +31,3 @@ Note: This solution uses Amazon Kendra and Amazon Bedrock, which are not current +**ExistingRestApiId** | _(Optional input)_ | Existing API Gateway REST API ID to use. If not provided, a new API Gateway REST API will be created. Typically provided when deploying from the Deployment dashboard. Note: Using Existing APIs can help reduce resource duplication and simplify management of APIs when you need to deploy multiple standalone use cases. When supplying existing APIs for a standalone use case, you are responsible for ensuring that the API is configured with the required route(s) with expected models. A required pre-configured /details route (fetches use case details during chat) and optionally, a /feedback route (if **FeedbackEnabled** is set to `Yes` to enable collection of feedback for LLM chat responses) must be configured. Additionally, **ExistingApiRootResourceId** , **ExistingCognitoUserPoolId** and **ExistingCognitoGroupPolicyTableName** must also be provided. +**ExistingApiRootResourceId** | _(Optional input)_ | Existing API Gateway REST API Root Resource ID to use. REST API Root Resource ID can be obtained from the AWS console by selecting the root resource (/) in the "Resources" section of the API. The Resource ID will then be displayed in the Resource details panel. You can alternatively run a describe API call on your REST API to find the Root Resource ID. +**FeedbackEnabled** | `No` | If set to No, the deployed use case stack will not have access to the feedback feature. @@ -40,2 +44,2 @@ Note: This solution uses Amazon Kendra and Amazon Bedrock, which are not current -**NewKendraQueryCapacityUnits** | 0 | Additional query capacity units for the new Amazon Kendra index to be created for this use case. Only applies if **ExistingK endraIndexId** is not supplied, see [CapacityU](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html)https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html[nitsConfiguration]. Note: Only relevant if **RAGEnabled** is `true` and **KnowledgeBaseType** is `Kendra`. -**NewKendraStorageCapacityUnits** | `0` | Additional storage capacity units for the new Amazon Kendra index to be created for this use case. Only applies if **ExistingKendraIndexId** is not supplied, see [CapacityUnitsConfiguration](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html). Note: Only relevant if **RAGEnabled** is `true` and **KnowledgeBaseType** is `Kendra`. +**NewKendraQueryCapacityUnits** | 0 | Additional query capacity units for the new Amazon Kendra index to be created for this use case. Only applies if **ExistingKendraIndexId** is not supplied, see [CapacityUnitsConfiguration](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html). Note: Only relevant if **RAGEnabled** is `true` and **KnowledgeBaseType** is `Kendra`. +**NewKendraStorageCapacityUnits** | `0` | Additional storage capacity units for the new Amazon Kendra index to be created for this use case. Only applies if **ExistingKendraIndexId** is not supplied, see [CapacityUnitsConfiguration](https://docs.aws.amazon.com/kendra/latest/APIReference/API_CapacityUnitsConfiguration.html). Note: Only relevant if **RAGEnabled** is `true` and **KnowledgeBaseType** is `Kendra`. @@ -49,0 +54,2 @@ Note: This solution uses Amazon Kendra and Amazon Bedrock, which are not current +**VpcAzs** | _(Optional input)_ | Comma separated list of AZs in which subnets of the VPCs are created Note: Only relevant if **VpcEnabled** is `Yes` and **CreateNewVpc** is `No`. +**UseInferenceProfile** | `No` | If the model configured is Bedrock, you can indicate if you are using Bedrock Inference Profile. This will ensure that the required IAM policies will be configured during stack deployment. For more details, refer to the following <https://docs.aws.amazon.com/bedrock/latest/userguide/cross-region-inference.html>