Skip to content

Commit ba09cd6

Browse files
xschildwxschildw
committed
Merge branch 'master' into m-plfm-8102-use-cdk-bootstrap-role
2 parents f16de2c + 5a718b8 commit ba09cd6

File tree

14 files changed

+302
-47
lines changed

14 files changed

+302
-47
lines changed

‎org-formation/300-account-defaults/_tasks.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,3 +55,13 @@ ItKmsKey:
5555
IncludeMasterAccount: true
5656
Account: '*'
5757
Region: !Ref primaryRegion
58+
59+
BedrockAgentRole:
60+
Type: update-stacks
61+
Template: ./bedrock-agent-role.yaml
62+
StackName: bedrock-agent-role
63+
DefaultOrganizationBindingRegion: !Ref primaryRegion
64+
DefaultOrganizationBinding:
65+
IncludeMasterAccount: false
66+
Account: '*'
67+
Region: !Ref primaryRegion

‎org-formation/300-account-defaults/bedrock-agent-role.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
AWSTemplateFormatVersion: '2010-09-09'
2+
Description: Enables executing a Bedrock model
3+
4+
Resources:
5+
# https://docs.aws.amazon.com/bedrock/latest/userguide/agents-permissions.html
6+
bedrockAgentRole:
7+
Type: AWS::IAM::Role
8+
Properties:
9+
AssumeRolePolicyDocument:
10+
Version: 2012-10-17
11+
Statement:
12+
- Effect: Allow
13+
Principal:
14+
Service: bedrock.amazonaws.com
15+
Action: sts:AssumeRole
16+
Condition:
17+
StringEquals:
18+
aws:SourceAccount: !Ref AWS::AccountId
19+
ArnLike:
20+
aws:SourceArn: !Sub "arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:agent/*"
21+
Policies:
22+
- PolicyName: bedrockAgentPolicy
23+
PolicyDocument:
24+
Version: "2012-10-17"
25+
Statement:
26+
- Effect: Allow
27+
Action: "bedrock:InvokeModel"
28+
Resource:
29+
- !Sub "arn:aws:bedrock:${AWS::Region}::foundation-model/*"
30+
31+
Outputs:
32+
BedrockAgentRoleArn:
33+
Description: The ARN of the Bedrock Agent Role
34+
Value: !GetAtt bedrockAgentRole.Arn
35+
Export:
36+
Name: !Sub '${AWS::StackName}-BedrockAgentRoleArn'

‎org-formation/600-access/_tasks.yaml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -388,3 +388,32 @@ SynapseAthenaUserAccessPolicy:
388388
]
389389
}
390390
PolicyName: SynapseAthenaUserAccessPolicy
391+
392+
# https://stackoverflow.com/questions/58125181/cloud-formation-cant-upload-template-file
393+
SynapseLlmDeveloperPolicy:
394+
Type: update-stacks
395+
Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.5.1/templates/IAM/managed-policy.yaml
396+
StackName: synapsellm-developer-policy
397+
DefaultOrganizationBinding:
398+
IncludeMasterAccount: true
399+
Account:
400+
- !Ref SynapseLlmProdAccount
401+
Region: !Ref primaryRegion
402+
Parameters:
403+
PolicyDocument: >-
404+
{
405+
"Version": "2012-10-17",
406+
"Statement": [
407+
{
408+
"Effect": "Allow",
409+
"Action": "s3:*",
410+
"Resource": "arn:aws:s3:::cf-template*"
411+
},
412+
{
413+
"Effect": "Allow",
414+
"Action": "iam:PassRole",
415+
"Resource": "*"
416+
}
417+
]
418+
}
419+
PolicyName: SynapseLlmDeveloperPolicy

‎org-formation/650-identity-providers/_tasks.yaml‎

Lines changed: 47 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,28 @@ GithubOidcSageBionetworksSchematicInfra:
122122
- !Ref DCAProdAccount
123123
Region: us-east-1
124124

125+
GithubOidcSageBionetworksItSchematicInfraV2:
126+
Type: update-stacks
127+
DependsOn: GithubOidcSageBionetworks
128+
Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
129+
StackName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-it-schematic-infra-v2
130+
Parameters:
131+
ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
132+
ProviderRoleName: !Sub ${resourcePrefix}-${appName}-sage-bionetworks-it-schematic-infra-v2
133+
ManagedPolicyArns:
134+
- "arn:aws:iam::aws:policy/AdministratorAccess"
135+
- "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
136+
TemplatingContext:
137+
GitHubOrg: "Sage-Bionetworks-IT"
138+
Repositories:
139+
- name: "schematic-infra-v2"
140+
branches: ["dev", "stage", "prod"]
141+
DefaultOrganizationBinding:
142+
Account:
143+
- !Ref DnTDevAccount
144+
- !Ref DCAProdAccount
145+
Region: us-east-1
146+
125147
GithubOidcSageBionetworksSynapseDockerRegistry:
126148
Type: update-stacks
127149
DependsOn: GithubOidcSageBionetworks
@@ -782,6 +804,29 @@ GithubOidcAgoraInfraDeploy:
782804
- !Ref AgoraProdAccount
783805
Region: us-east-1
784806

807+
GithubOidcAgoraInfraV3:
808+
Type: update-stacks
809+
DependsOn: GithubOidcSageBionetworks
810+
Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.6/templates/IAM/github-oidc-provider.j2
811+
StackName: !Sub ${resourcePrefix}-${appName}-agora-infra-v3
812+
Parameters:
813+
ProviderArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-ProviderArn' ]
814+
ProviderRoleName: !Sub ${resourcePrefix}-${appName}-agora-infra-v3
815+
MaxSessionDuration: 7200
816+
ManagedPolicyArns:
817+
- "arn:aws:iam::aws:policy/AdministratorAccess"
818+
- "arn:aws:iam::aws:policy/AWSKeyManagementServicePowerUser"
819+
TemplatingContext:
820+
GitHubOrg: "Sage-Bionetworks-IT"
821+
Repositories:
822+
- name: "agora-infra-v3"
823+
branches: ["dev","stage","prod"]
824+
DefaultOrganizationBinding:
825+
Account:
826+
- !Ref AgoraDevAccount
827+
- !Ref AgoraProdAccount
828+
Region: us-east-1
829+
785830
GithubOidcAgoraEBDeploy:
786831
Type: update-stacks
787832
DependsOn: GithubOidcSageBionetworks
@@ -882,9 +927,7 @@ SynapseMonorepoBucketAccessPolicy:
882927
"Effect": "Allow",
883928
"Action": [ "s3:GetBucketLocation", "s3:ListBucket", "s3:ListBucketMultipartUploads" ],
884929
"Resource": [
885-
"arn:aws:s3:::prod.accounts.sagebionetworks.org",
886-
"arn:aws:s3:::staging.accounts.sagebionetworks.org",
887-
"arn:aws:s3:::dev.accounts.sagebionetworks.org",
930+
"arn:aws:s3:::dev.accounts.synapse.org",
888931
"arn:aws:s3:::prod.accounts.synapse.org",
889932
"arn:aws:s3:::staging.accounts.synapse.org",
890933
"arn:aws:s3:::prod-adknowledgeportalsynapse-org-websitebucket-1wcys549ufmd",
@@ -935,9 +978,7 @@ SynapseMonorepoFileAccessPolicy:
935978
"Effect": "Allow",
936979
"Action": [ "s3:PutObject", "s3:GetObject", "s3:DeleteObject", "s3:*Multipart*" ],
937980
"Resource": [
938-
"arn:aws:s3:::prod.accounts.sagebionetworks.org/*",
939-
"arn:aws:s3:::staging.accounts.sagebionetworks.org/*",
940-
"arn:aws:s3:::dev.accounts.sagebionetworks.org/*",
981+
"arn:aws:s3:::dev.accounts.synapse.org/*",
941982
"arn:aws:s3:::prod.accounts.synapse.org/*",
942983
"arn:aws:s3:::staging.accounts.synapse.org/*",
943984
"arn:aws:s3:::prod-adknowledgeportalsynapse-org-websitebucket-1wcys549ufmd/*",
@@ -1005,8 +1046,6 @@ SynapseMonorepoCloudfrontAccessPolicy:
10051046
"arn:aws:cloudfront::797640923903:distribution/E10U4765KQQW5P",
10061047
"arn:aws:cloudfront::797640923903:distribution/E1FILQHG8BTWIL",
10071048
"arn:aws:cloudfront::797640923903:distribution/E14P60CJ0I6G7Y",
1008-
"arn:aws:cloudfront::797640923903:distribution/E2656IE63W1MXI",
1009-
"arn:aws:cloudfront::797640923903:distribution/EY52HOUGKDP1F",
10101049
"arn:aws:cloudfront::797640923903:distribution/E14F656YEGR4P3",
10111050
"arn:aws:cloudfront::797640923903:distribution/E1CB47ERU70VWV",
10121051
"arn:aws:cloudfront::797640923903:distribution/E2K9BYXQN2MM76",

‎org-formation/700-aws-sso/_tasks.yaml‎

Lines changed: 26 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -343,6 +343,10 @@ Parameters:
343343
Type: String
344344
Default: '143894c8-1031-70c4-b98a-9d2a9aec59bd'
345345

346+
MkPreYnAdminGroup: #JC aws-MkPreYn-admins
347+
Type: String
348+
Default: 'd4284428-6061-70b8-191c-37e390b2a596'
349+
346350
#----------------------------------------------------------------------------------------------
347351

348352
SsoAdministrator:
@@ -624,7 +628,7 @@ SsoLlmDeveloper:
624628
Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.7.7/templates/SSO/aws-sso.njk
625629
TemplatingContext:
626630
customerManagedPolicies:
627-
- Name: !Ref CostExplorerPolicyName
631+
- Name: SynapseLlmDeveloperPolicy
628632
StackName: !Sub '${resourcePrefix}-${appName}-llmdeveloper'
629633
StackDescription: 'Permission set used by an Large Language Model developer'
630634
TerminationProtection: false
@@ -639,17 +643,15 @@ SsoLlmDeveloper:
639643
principalId: !Ref llmDeveloperGroup
640644
permissionSetName: 'LlmDeveloper'
641645
managedPolicies:
642-
- 'arn:aws:iam::aws:policy/AmazonBedrockFullAccess'
643-
- 'arn:aws:iam::aws:policy/AWSCloudFormationFullAccess'
644-
# https://stackoverflow.com/questions/58125181/cloud-formation-cant-upload-template-file
646+
- 'arn:aws:iam::aws:policy/PowerUserAccess'
645647
inlinePolicy: >-
646648
{
647649
"Version": "2012-10-17",
648650
"Statement": [
649651
{
650-
"Effect": "Allow",
651-
"Action": "s3:*",
652-
"Resource": "arn:aws:s3:::cf-template*"
652+
"Effect": "Deny",
653+
"Action": "sts:AssumeRole",
654+
"Resource": "*"
653655
}
654656
]
655657
}
@@ -1716,6 +1718,23 @@ SsoBWmErzkAdmin:
17161718
principalId: !Ref BWmErzkAdminGroup
17171719
permissionSetArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-admin-permission-set-arn' ]
17181720

1721+
SsoMkPreYnAdmin:
1722+
Type: update-stacks
1723+
DependsOn: SsoAdministrator
1724+
Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.2.11/templates/SSO/aws-sso.yaml
1725+
StackName: !Sub '${resourcePrefix}-${appName}-MkPreYn-admin'
1726+
StackDescription: 'SSO: admin role used by MkPreYn admin group'
1727+
DefaultOrganizationBindingRegion: !Ref primaryRegion
1728+
DefaultOrganizationBinding:
1729+
IncludeMasterAccount: true
1730+
OrganizationBindings:
1731+
TargetBinding:
1732+
Account: !Ref MkPreYnAccount
1733+
Parameters:
1734+
instanceArn: !Ref instanceArn
1735+
principalId: !Ref MkPreYnAdminGroup
1736+
permissionSetArn: !CopyValue [ !Sub '${resourcePrefix}-${appName}-admin-permission-set-arn' ]
1737+
17191738
SsoRecoverDevAdmin:
17201739
Type: update-stacks
17211740
DependsOn: SsoAdministrator

0 commit comments

Comments
 (0)