Add InvokeDataAutomationAsync permission and profile resource access

Author: laurencegoolsby

infra/app-flask/service/document_data_extraction.tf

@@ -71,9 +71,3 @@ module "dde" {
 
   name = "${local.prefix}${local.document_data_extraction_config.name}"
 }
-
-resource "aws_iam_role_policy_attachment" "app_bedrock_access" {
-  count      = local.document_data_extraction_config != null ? 1 : 0
-  role       = module.service.app_role_name
-  policy_arn = module.dde[0].access_policy_arn
-}

infra/modules/document-data-extraction/resources/access_control.tf

@@ -8,6 +8,7 @@ data "aws_iam_policy_document" "bedrock_access" {
     actions = [
       "bedrock:InvokeModel",
       "bedrock:InvokeModelWithResponseStream",
+      "bedrock:InvokeDataAutomationAsync",
       "bedrock:GetDataAutomationProject",
       "bedrock:GetBlueprint",
       "bedrock:StartDataAutomationJob",
@@ -18,7 +19,8 @@ data "aws_iam_policy_document" "bedrock_access" {
     resources = [
       awscc_bedrock_data_automation_project.bda_project.project_arn,
       "${awscc_bedrock_data_automation_project.bda_project.project_arn}/*",
-      "arn:aws:bedrock:*:*:blueprint/*"
+      "arn:aws:bedrock:*:*:blueprint/*",
+      "arn:aws:bedrock:*:*:data-automation-profile/*"
     ]
   }
 }