bedrock-cft.yml

AWSTemplateFormatVersion: '2010-09-09'
Description: 'MemMachine - Simple EC2 Deployment with Docker Compose (AWS Bedrock)'

Parameters:
  StackName:
    Type: String
    Default: memmachine-bedrock-ec2-stack
    Description: Name for the CloudFormation stack
  
  InstanceType:
    Type: String
    Default: t3.xlarge
    AllowedValues: [t3.medium, t3.large, t3.xlarge, t3.2xlarge, m5.large, m5.xlarge, m5.2xlarge]
    Description: EC2 instance type
  
  KeyPairName:
    Type: AWS::EC2::KeyPair::KeyName
    Description: Name of an existing EC2 KeyPair to enable SSH access
  
  PostgresPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    Description: PostgreSQL database password
  
  Neo4jPassword:
    Type: String
    NoEcho: true
    MinLength: 8
    Description: Neo4j database password
  
  AwsAccessKeyId:
    Type: String
    NoEcho: true
    Description: AWS Access Key ID for Bedrock access
  
  AwsSecretAccessKey:
    Type: String
    NoEcho: true
    Description: AWS Secret Access Key for Bedrock access
  
  AwsRegion:
    Type: String
    Default: us-west-2
    AllowedValues: [us-east-1, us-west-2, eu-west-1, ap-southeast-1]
    Description: AWS Region for Bedrock services
  
  BedrockEmbeddingModel:
    Type: String
    Default: amazon.titan-embed-text-v2:0
    Description: Bedrock embedding model ID
  
  BedrockLanguageModel:
    Type: String
    Default: openai.gpt-oss-20b-1:0
    Description: Bedrock language model ID
  
  AllowedCIDR:
    Type: String
    Default: 0.0.0.0/0
    Description: CIDR block allowed to access the application (use 0.0.0.0/0 for public access)

Resources:
  # VPC
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsHostnames: true
      EnableDnsSupport: true
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-vpc'
  
  InternetGateway:
    Type: AWS::EC2::InternetGateway
    Properties:
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-igw'
  
  InternetGatewayAttachment:
    Type: AWS::EC2::VPCGatewayAttachment
    Properties:
      InternetGatewayId: !Ref InternetGateway
      VpcId: !Ref VPC
  
  # Public Subnet
  PublicSubnet:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [0, !GetAZs '']
      CidrBlock: 10.0.0.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-public-subnet'
  
  PublicSubnet2:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      AvailabilityZone: !Select [1, !GetAZs '']
      CidrBlock: 10.0.1.0/24
      MapPublicIpOnLaunch: true
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-public-subnet-2'
  
  # Route Table
  PublicRouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-public-routes'
  
  DefaultPublicRoute:
    Type: AWS::EC2::Route
    DependsOn: InternetGatewayAttachment
    Properties:
      RouteTableId: !Ref PublicRouteTable
      DestinationCidrBlock: 0.0.0.0/0
      GatewayId: !Ref InternetGateway
  
  PublicSubnetRouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet
  
  PublicSubnet2RouteTableAssociation:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      RouteTableId: !Ref PublicRouteTable
      SubnetId: !Ref PublicSubnet2
  
  # Security Group
  MemMachineSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: !Sub '${StackName}-sg'
      GroupDescription: Security group for MemMachine EC2 instance
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: !Ref AllowedCIDR
          Description: SSH access
        - IpProtocol: tcp
          FromPort: 8080
          ToPort: 8080
          CidrIp: 10.0.0.0/16
          Description: MemMachine API from VPC only
        - IpProtocol: tcp
          FromPort: 7474
          ToPort: 7474
          CidrIp: !Ref AllowedCIDR
          Description: Neo4j HTTP
        - IpProtocol: tcp
          FromPort: 7687
          ToPort: 7687
          CidrIp: !Ref AllowedCIDR
          Description: Neo4j Bolt
      SecurityGroupEgress:
        - IpProtocol: -1
          CidrIp: 0.0.0.0/0
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-sg'
  
  # IAM Role for EC2
  EC2Role:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub '${StackName}-ec2-role'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: ec2.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
      Policies:
        - PolicyName: CloudWatchLogs
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - logs:CreateLogGroup
                  - logs:CreateLogStream
                  - logs:PutLogEvents
                  - logs:DescribeLogStreams
                Resource: '*'
  
  EC2InstanceProfile:
    Type: AWS::IAM::InstanceProfile
    Properties:
      Roles:
        - !Ref EC2Role
  
  # CloudWatch Log Group
  MemMachineLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub '/memmachine/${StackName}'
      RetentionInDays: 30


  MemMachineNLB:
    Type: AWS::ElasticLoadBalancingV2::LoadBalancer
    Properties:
      Name: !Sub '${StackName}-nlb'
      Type: network
      Scheme: internal
      Subnets:
        - !Ref PublicSubnet
        - !Ref PublicSubnet2

  MemMachineTargetGroup:
    Type: AWS::ElasticLoadBalancingV2::TargetGroup
    Properties:
      Name: !Sub '${StackName}-tg'
      Port: 8080
      Protocol: TCP
      TargetType: instance
      VpcId: !Ref VPC
      HealthCheckPort: '8080'
      HealthCheckProtocol: TCP
      Targets:
        - Id: !Ref MemMachineInstance
          Port: 8080

  MemMachineNLBListener:
    Type: AWS::ElasticLoadBalancingV2::Listener
    Properties:
      DefaultActions:
        - Type: forward
          TargetGroupArn: !Ref MemMachineTargetGroup
      LoadBalancerArn: !Ref MemMachineNLB
      Port: 8080
      Protocol: TCP

  MemMachineVpcLink:
    Type: AWS::ApiGatewayV2::VpcLink
    Properties:
      Name: !Sub '${StackName}-vpclink'
      SubnetIds:
        - !Ref PublicSubnet
        - !Ref PublicSubnet2

  MemMachineHttpApi:
    Type: AWS::ApiGatewayV2::Api
    Properties:
      Name: !Sub '${StackName}-http-api'
      ProtocolType: HTTP

  MemMachineIntegration:
    Type: AWS::ApiGatewayV2::Integration
    Properties:
      ApiId: !Ref MemMachineHttpApi
      IntegrationType: HTTP_PROXY
      IntegrationMethod: ANY
      ConnectionType: VPC_LINK
      ConnectionId: !Ref MemMachineVpcLink
      IntegrationUri: !Ref MemMachineNLBListener
      PayloadFormatVersion: '1.0'

  MemMachineRoute:
    Type: AWS::ApiGatewayV2::Route
    Properties:
      ApiId: !Ref MemMachineHttpApi
      RouteKey: 'ANY /{proxy+}'
      Target: !Sub 'integrations/${MemMachineIntegration}'

  MemMachineStage:
    Type: AWS::ApiGatewayV2::Stage
    Properties:
      ApiId: !Ref MemMachineHttpApi
      StageName: '$default'
      AutoDeploy: true

  MemMachineInstance:
    Type: AWS::EC2::Instance
    Properties:
      ImageId: !Sub '{{resolve:ssm:/aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2}}'
      InstanceType: !Ref InstanceType
      KeyName: !Ref KeyPairName
      SubnetId: !Ref PublicSubnet
      SecurityGroupIds:
        - !Ref MemMachineSecurityGroup
      IamInstanceProfile: !Ref EC2InstanceProfile
      UserData:
        Fn::Base64: !Sub |
          #!/bin/bash
          set -e
          
          # Update system
          yum update -y
          
          # Install CloudFormation helper scripts
          yum install -y aws-cfn-bootstrap
          
          # Install Docker
          yum install -y docker
          systemctl start docker
          systemctl enable docker
          usermod -a -G docker ec2-user
          
          # Install Docker Compose
          curl -L "https://github.com/docker/compose/releases/latest/download/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
          chmod +x /usr/local/bin/docker-compose
          ln -s /usr/local/bin/docker-compose /usr/bin/docker-compose
          
          # Install Git
          yum install -y git
          
          # Create application directory
          mkdir -p /opt/memmachine
          cd /opt/memmachine
          
          # Create docker-compose.yml
          cat > docker-compose.yml << 'COMPOSEEOF'
          services:
            postgres:
              image: pgvector/pgvector:pg16
              container_name: memmachine-postgres
              restart: unless-stopped
              ports:
                - "5432:5432"
              environment:
                POSTGRES_DB: memmachine
                POSTGRES_USER: memmachine
                POSTGRES_PASSWORD: POSTGRES_PASSWORD_PLACEHOLDER
                POSTGRES_INITDB_ARGS: "--encoding=UTF-8 --lc-collate=C --lc-ctype=C"
              volumes:
                - postgres_data:/var/lib/postgresql/data
              healthcheck:
                test: ["CMD-SHELL", "pg_isready -U memmachine -d memmachine"]
                interval: 10s
                timeout: 5s
                retries: 5
                start_period: 30s
              networks:
                - memmachine-network

            neo4j:
              image: neo4j:5.23-community
              container_name: memmachine-neo4j
              restart: unless-stopped
              ports:
                - "7474:7474"
                - "7473:7473"
                - "7687:7687"
              environment:
                NEO4J_EDITION: community
                NEO4J_AUTH: neo4j/NEO4J_PASSWORD_PLACEHOLDER
                NEO4J_server_bolt_thread__pool__max__size: 2000
                NEO4J_server_memory_heap_initial__size: 512m
                NEO4J_server_memory_heap_max__size: 1G
                NEO4J_server_default__listen__address: 0.0.0.0
                NEO4J_server_bolt_listen__address: 0.0.0.0:7687
                NEO4J_server_http_listen__address: 0.0.0.0:7474
                NEO4J_server_https_listen__address: 0.0.0.0:7473
                NEO4J_PLUGINS: '["apoc", "graph-data-science"]'
              volumes:
                - neo4j_data:/data
                - neo4j_logs:/logs
                - neo4j_import:/var/lib/neo4j/import
                - neo4j_plugins:/plugins
              healthcheck:
                test: ["CMD", "cypher-shell", "-u", "neo4j", "-p", "NEO4J_PASSWORD_PLACEHOLDER", "RETURN 1"]
                interval: 30s
                timeout: 10s
                retries: 5
                start_period: 30s
              networks:
                - memmachine-network

            memmachine:
              image: public.ecr.aws/z0l5i7c8/memmachine-v2:latest-cpu
              container_name: memmachine-app
              restart: unless-stopped
              ports:
                - "8080:8080"
              environment:
                POSTGRES_HOST: postgres
                POSTGRES_PORT: 5432
                POSTGRES_USER: memmachine
                POSTGRES_PASSWORD: POSTGRES_PASSWORD_PLACEHOLDER
                POSTGRES_DB: memmachine
                NEO4J_HOST: neo4j
                NEO4J_PORT: 7687
                NEO4J_USER: neo4j
                NEO4J_PASSWORD: NEO4J_PASSWORD_PLACEHOLDER
                MEMORY_CONFIG: /app/configuration.yml
                MCP_BASE_URL: http://localhost:8080
                GATEWAY_URL: http://localhost:8080
                FAST_MCP_LOG_LEVEL: INFO
                LOG_LEVEL: INFO
              volumes:
                - memmachine_logs:/tmp/memory_logs
              depends_on:
                postgres:
                  condition: service_healthy
                neo4j:
                  condition: service_healthy
              healthcheck:
                test: ["CMD", "curl", "--fail", "--silent", "http://localhost:8080/api/v2/health"]
                interval: 30s
                timeout: 10s
                retries: 3
                start_period: 60s
              networks:
                - memmachine-network

          volumes:
            postgres_data:
            neo4j_data:
            neo4j_logs:
            neo4j_import:
            neo4j_plugins:
            memmachine_logs:

          networks:
            memmachine-network:
              driver: bridge
          COMPOSEEOF
          
          # Replace password placeholders in docker-compose.yml (using proper escaping for sed)
          sed -i "s|POSTGRES_PASSWORD_PLACEHOLDER|$(echo '${PostgresPassword}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" docker-compose.yml
          sed -i "s|NEO4J_PASSWORD_PLACEHOLDER|$(echo '${Neo4jPassword}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" docker-compose.yml
          
          # Create configuration.yml file with actual values (using proper YAML escaping)
          cat > configuration.yml << 'CONFIGEOF'
          logging:
            path: mem-machine.log
            level: info #| debug | error

          episode_store:
            database: profile_storage

          episodic_memory:
            long_term_memory:
              embedder: aws_embedder_id
              reranker: my_reranker_id
              vector_graph_store: my_storage_id
            short_term_memory:
              llm_model: aws_model
              message_capacity: 500

          semantic_memory:
            llm_model: aws_model
            embedding_model: aws_embedder_id
            database: profile_storage

          session_manager:
            database: profile_storage

          prompt:
            session:
            - profile_prompt


          resources:
            databases:
              profile_storage:
                provider: postgres
                config:
                  host: postgres
                  port: 5432
                  user: memmachine
                  password: POSTGRES_PASSWORD_PLACEHOLDER
                  db_name: memmachine
              my_storage_id:
                provider: neo4j
                config:
                  uri: 'bolt://neo4j:7687'
                  username: neo4j
                  password: NEO4J_PASSWORD_PLACEHOLDER
              sqlite_test:
                provider: sqlite
                config:
                  path: sqlite_test.db
            embedders:
              aws_embedder_id:
                provider: 'amazon-bedrock'
                config:
                  region: AWS_REGION_PLACEHOLDER
                  aws_access_key_id: AWS_ACCESS_KEY_ID_PLACEHOLDER
                  aws_secret_access_key: AWS_SECRET_ACCESS_KEY_PLACEHOLDER
                  model_id: BEDROCK_EMBEDDING_MODEL_PLACEHOLDER
                  similarity_metric: "cosine"
            language_models:
              aws_model:
                provider: "amazon-bedrock"
                config:
                  region: AWS_REGION_PLACEHOLDER
                  aws_access_key_id: AWS_ACCESS_KEY_ID_PLACEHOLDER
                  aws_secret_access_key: AWS_SECRET_ACCESS_KEY_PLACEHOLDER
                  model_id: BEDROCK_LANGUAGE_MODEL_PLACEHOLDER
            rerankers:
              my_reranker_id:
                provider: "rrf-hybrid"
                config:
                  reranker_ids:
                    - id_ranker_id
                    - bm_ranker_id
              id_ranker_id:
                provider: "identity"
              bm_ranker_id:
                provider: "bm25"

          CONFIGEOF
          
          # Replace placeholders in configuration.yml (using proper escaping for sed)
          sed -i "s|AWS_REGION_PLACEHOLDER|$(echo '${AwsRegion}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          sed -i "s|AWS_ACCESS_KEY_ID_PLACEHOLDER|$(echo '${AwsAccessKeyId}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          sed -i "s|AWS_SECRET_ACCESS_KEY_PLACEHOLDER|$(echo '${AwsSecretAccessKey}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          sed -i "s|BEDROCK_EMBEDDING_MODEL_PLACEHOLDER|$(echo '${BedrockEmbeddingModel}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          sed -i "s|BEDROCK_LANGUAGE_MODEL_PLACEHOLDER|$(echo '${BedrockLanguageModel}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          sed -i "s|NEO4J_PASSWORD_PLACEHOLDER|$(echo '${Neo4jPassword}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          sed -i "s|POSTGRES_PASSWORD_PLACEHOLDER|$(echo '${PostgresPassword}' | sed 's/[[\.*^$()+?{|]/\\&/g')|g" configuration.yml
          
          # Update docker-compose.yml to mount configuration.yml
          sed -i '/memmachine_logs:\/tmp\/memory_logs/a\      - .\/configuration.yml:\/app\/configuration.yml:ro' docker-compose.yml
          
          # Start services
          docker-compose up -d
          
          # Wait for services to be healthy
          echo "Waiting for services to start..."
          sleep 30
          
          # Log status
          docker-compose ps >> /var/log/memmachine-startup.log 2>&1
          
          # Send completion signal to CloudFormation
          /opt/aws/bin/cfn-signal -e $? --stack ${AWS::StackName} --resource MemMachineInstance --region ${AWS::Region} || true
      Tags:
        - Key: Name
          Value: !Sub '${StackName}-instance'

Outputs:
    InstanceId:
        Description: EC2 Instance ID
        Value: !Ref MemMachineInstance

    PublicIP:
        Description: Public IP address
        Value: !GetAtt MemMachineInstance.PublicIp

    PublicDNS:
        Description: Public DNS name
        Value: !GetAtt MemMachineInstance.PublicDnsName

    ApplicationURL:
        Description: MemMachine Application URL (via API Gateway)
        Value: !Sub 'https://${MemMachineHttpApi}.execute-api.${AWS::Region}.amazonaws.com/docs'

    HealthCheckURL:
        Description: Health Check Endpoint
        Value: !Sub 'http://${MemMachineInstance.PublicIp}:8080/api/v2/health'

    Neo4jBrowserURL:
        Description: Neo4j Browser URL
        Value: !Sub 'http://${MemMachineInstance.PublicIp}:7474'

    SSHAccess:
        Description: SSH command to access the instance
        Value: !Sub 'ssh -i <your-key.pem> ec2-user@${MemMachineInstance.PublicIp}'