template.yaml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >
  Demo GenAI app

  SAM Template for sample genai App using Prompt management and prompt flow

Globals:
  Function:
    Timeout: 200

    Tracing: Active
    LoggingConfig:
      LogFormat: JSON
  Api:
    TracingEnabled: true

Parameters:
  modelId:
    Type: String
    Default: "anthropic.claude-3-haiku-20240307-v1:0"
  pythonruntime:
    Type: String
    Default: "python3.12"
  startPrompt:
    Type: String
    Default: "You are a helpful assistant. Answer the following questions based on the provided input: <description>{{description}}</description>"
    

Resources:
  # The API Gateway that will receive 
  genaiappAPI:
    Type: AWS::Serverless::Api
    Properties:
      StageName: Prod
      MethodSettings:
      - HttpMethod: "*"
        ResourcePath: "/*"

  genaiappFunction:
    Type: AWS::Serverless::Function # More info about Function Resource: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#awsserverlessfunction
    Properties:
    # Links to the Prompt Flow and Alias
      Environment:
        Variables:
          FLOW_ID: !GetAtt PromptgenaiappFlow.Id
          FLOW_ALIAS_ID: !GetAtt PromptgenaiappFlowAlias.Id
      CodeUri: lambdabedrock/
      Handler: app.lambda_handler
      Runtime: !Ref pythonruntime
      Architectures:
      - x86_64
      MemorySize: 128
      Policies:
      - Statement:
        - Sid: CallBedrockFlow
          Effect: Allow
          Action:
          - bedrock:InvokeFlow
          - bedrock:GetFlowAlias
          Resource: !GetAtt PromptgenaiappFlowAlias.Arn

      Events:
        genaiappAPI:
          Type: Api # More info about API Event Source: https://github.com/awslabs/serverless-application-model/blob/master/versions/2016-10-31.md#api
          Properties:
            RestApiId: !Ref genaiappAPI
            Path: /api
            Method: post
  ApplicationResourceGroup:
    Type: AWS::ResourceGroups::Group
    Properties:
      Name:
        Fn::Sub: ApplicationInsights-SAM-${AWS::StackName}
      ResourceQuery:
        Type: CLOUDFORMATION_STACK_1_0
  ApplicationInsightsMonitoring:
    Type: AWS::ApplicationInsights::Application
    Properties:
      ResourceGroupName:
        Ref: ApplicationResourceGroup
      AutoConfigurationEnabled: 'true'
# an S3 bucket to store the static objects
  genaiappStorageBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Join ["-", ["genaiapp-storage", !Select [2, !Split ["/", !Ref "AWS::StackId"]]]]


# a cloudfront AOI to access my bucket
  OriginAccessIdentity:
    Type: AWS::CloudFront::CloudFrontOriginAccessIdentity
    Properties:
      CloudFrontOriginAccessIdentityConfig:
        Comment: !Ref AWS::StackName

  genaiappStorageBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref genaiappStorageBucket
      PolicyDocument:
        Statement:
          - Effect: Allow
            Action:
              - s3:GetObject
            Principal:
              CanonicalUser: !GetAtt OriginAccessIdentity.S3CanonicalUserId
            Resource: !Sub 'arn:aws:s3:::${genaiappStorageBucket}/*'
          - Effect: Deny
            Action: "*"
            Condition:
              Bool:
                'aws:SecureTransport': false
            Principal: "*"
            Resource: !Sub 'arn:aws:s3:::${genaiappStorageBucket}/*'
            Sid: DenyUnencryptedConnections

  CloudFrontDistribution:
    Type: AWS::CloudFront::Distribution
    Properties:
      DistributionConfig:
        DefaultCacheBehavior:
          Compress: true
          ForwardedValues:
            QueryString: false
          TargetOriginId: the-s3-bucket
          ViewerProtocolPolicy: redirect-to-https
        #Cache behavior for the api gateway onn api/
        CacheBehaviors:
          - AllowedMethods:
              - GET
              - HEAD
              - POST
              - OPTIONS
              - PUT
              - DELETE
              - PATCH
            Compress: true
            DefaultTTL: 0
            ForwardedValues:
              QueryString: false
            MaxTTL: 300
            MinTTL: 0
            PathPattern: "/api*"
            TargetOriginId: the-api-gateway
            ViewerProtocolPolicy: redirect-to-https
        DefaultRootObject: index.html
        Enabled: true
        HttpVersion: http2
        Origins:
          - DomainName: !Sub "${genaiappStorageBucket}.s3.amazonaws.com"
            Id: the-s3-bucket
            S3OriginConfig:
              OriginAccessIdentity:
                !Sub "origin-access-identity/cloudfront/${OriginAccessIdentity}"
          # the api gateway origin
          - DomainName: !Sub "${genaiappAPI}.execute-api.${AWS::Region}.amazonaws.com"
            OriginPath: /Prod
            CustomOriginConfig:
              HTTPSPort: 443
              OriginProtocolPolicy: https-only
              OriginSSLProtocols:
                - TLSv1.2
            Id: the-api-gateway

  Promptgenaiapp:
    Type: AWS::Bedrock::Prompt
    Properties:
      Name:
        Fn::Join:
            - "-"
            - - "Promptgenaiapp"
              - !Select 
                - 2
                - !Split 
                  - "/"
                  - !Ref AWS::StackId
      DefaultVariant: DefaultVariant
      Variants:
        - Name: DefaultVariant
          InferenceConfiguration:
            Text:
              MaxTokens: 1024
              StopSequences: []
              Temperature: 0.1
              TopP: 1
              TopK: 250
          ModelId: !Ref modelId 
          TemplateType: TEXT
          TemplateConfiguration:
            Text:
              Text: !Ref startPrompt
              InputVariables:
                - Name: description

  PromptgenaiappVersion:
    Type: AWS::Bedrock::PromptVersion
    Properties:
      PromptArn: !Ref Promptgenaiapp


  PromptExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: BedrockPromptExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: 
                  - "bedrock:InvokeModel"
                Resource: !Join
                    - ''
                    - -  "arn:aws:bedrock:*::foundation-model/"
                      -  !Ref modelId
              - Effect: Allow
                Action: 
                  - "bedrock:GetPrompt"
                Resource: !GetAtt Promptgenaiapp.Arn

  PromptgenaiappFlow:
    Type: AWS::Bedrock::Flow
    Properties:
      Name:
        Fn::Join:
            - "-"
            - - "PromptgenaiappFlow"
              - !Select 
                - 2
                - !Split 
                  - "/"
                  - !Ref AWS::StackId
      ExecutionRoleArn: !GetAtt PromptExecutionRole.Arn
      Definition:
        Nodes:
          - Type: Input
            Name: FlowInputNode
            Outputs:
              - Name: document
                Type: String
          - Type: Output
            Name: FlowOutputNode
            Inputs:
              - Name: document
                Type: String
                Expression: $.data
          - Type: Prompt
            Name: Promptgenaiapp
            Configuration:
              Prompt: 
                SourceConfiguration:
                  Resource:
                    PromptArn: !GetAtt Promptgenaiapp.Arn
            Inputs:
              - Name: description
                Type: String
                Expression: $.data

            Outputs:
              - Name: modelCompletion
                Type: String 
        Connections:
          - Configuration:
              Data:
                SourceOutput: document
                TargetInput: description
            Name: InputToPtompt
            Source: FlowInputNode
            Target: Promptgenaiapp
            Type: Data
          - Configuration:
              Data:
                SourceOutput: modelCompletion
                TargetInput: document
            Name: OutputToFlow
            Source: Promptgenaiapp
            Target: FlowOutputNode
            Type: Data

    DependsOn:
      - PromptgenaiappVersion

  PromptgenaiappFlowVersion:
    Type: AWS::Bedrock::FlowVersion
    Properties:
      FlowArn: !GetAtt PromptgenaiappFlow.Arn

  PromptgenaiappFlowAlias:
    Type: AWS::Bedrock::FlowAlias
    Properties:
      Name: PromptgenaiappFlowAlias
      FlowArn: !GetAtt PromptgenaiappFlow.Arn
      Description: "Prompt genaiapp Flow Alias"
      RoutingConfiguration:
        - FlowVersion: !GetAtt PromptgenaiappFlowVersion.Version



  BedrockPromptExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: BedrockPromptExecutionPolicy
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action: "bedrock:*"
                Resource: "*"

Outputs:
  CloudfrontURL:
    Description: "the cloudfront url"
    Value: !Sub "https://${CloudFrontDistribution.DomainName}"
  S3BucketName:
    Description: "the s3 bucket name"
    Value: !Ref genaiappStorageBucket
  PromptFlow:
    Description: "the prompt flow arn"
    Value: !Ref PromptgenaiappFlow