jyapayne/langflow
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

add RAG policy to TaskExeRole

Browse source
This commit is contained in:
nsxshota 2023-11-24 19:14:37 +09:00
commit 7bf37cf447
1 changed files with 14 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

25
deploy/scripts/cdk/lib/construct/iam.ts
View file

@ -46,6 +46,17 @@ export class EcsIAM extends Construct {
'kendra:*' 'kendra:*'
], ],
}); });
// Create Rag Policy
const RagAccessPolicy = new iam.Policy(this, 'RAGFullAccess', {
statements: [KendraPolicyStatement,BedrockPolicyStatement],
})
// Secrets ManagerからDB認証情報を取ってくるためのPolicy
const SecretsManagerPolicy = new iam.Policy(this, 'SMGetPolicy', {
statements: [new iam.PolicyStatement({
actions: ['secretsmanager:GetSecretValue'],
resources: [props.rdsCluster.secret!.secretArn],
})],
})
// FrontEnd Task Role // FrontEnd Task Role
this.frontendTaskRole = new iam.Role(this, 'FrontendTaskRole', { this.frontendTaskRole = new iam.Role(this, 'FrontendTaskRole', {
@ -60,8 +71,7 @@ export class EcsIAM extends Construct {
// ECS Exec Policyの付与 // ECS Exec Policyの付与
this.backendTaskRole.addToPolicy(ECSExecPolicyStatement); this.backendTaskRole.addToPolicy(ECSExecPolicyStatement);
// KendraとBedrockのアクセス権付与 // KendraとBedrockのアクセス権付与
this.backendTaskRole.addToPolicy(KendraPolicyStatement); this.backendTaskRole.attachInlinePolicy(RagAccessPolicy);
this.backendTaskRole.addToPolicy(BedrockPolicyStatement);
// FrontEnd Task ExecutionRole // FrontEnd Task ExecutionRole
this.frontendTaskExecutionRole = new iam.Role(this, 'frontendTaskExecutionRole', { this.frontendTaskExecutionRole = new iam.Role(this, 'frontendTaskExecutionRole', {
@ -74,9 +84,6 @@ export class EcsIAM extends Construct {
], ],
}); });
// Secrets ManagerからDB認証情報を取ってくる
const secretsDB = props.rdsCluster.secret!;
// BackEnd Task ExecutionRole // BackEnd Task ExecutionRole
this.backendTaskExecutionRole = new iam.Role(this, 'backendTaskExecutionRole', { this.backendTaskExecutionRole = new iam.Role(this, 'backendTaskExecutionRole', {
assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'), assumedBy: new iam.ServicePrincipal('ecs-tasks.amazonaws.com'),
@ -88,11 +95,7 @@ export class EcsIAM extends Construct {
], ],
}); });
this.backendTaskExecutionRole.attachInlinePolicy(new iam.Policy(this, 'SMGetPolicy', { this.backendTaskExecutionRole.attachInlinePolicy(SecretsManagerPolicy);
statements: [new iam.PolicyStatement({ this.backendTaskExecutionRole.attachInlinePolicy(RagAccessPolicy);
actions: ['secretsmanager:GetSecretValue'],
resources: [secretsDB.secretArn],
})],
}));
} }
} }