cfn-workshop-setup.yaml

AWSTemplateFormatVersion: '2010-09-09'
Description: >
  Agentic Process Transformation Workshop — provisions S3 bucket, DynamoDB tables,
  SageMaker execution role with least-privilege permissions, and uploads sample data.

Parameters:
  S3BucketName:
    Type: String
    Default: ''
    Description: >
      (Optional) Custom S3 bucket name. Leave blank to auto-generate a unique name
      using your account ID and region.

Conditions:
  UseAutoGeneratedBucketName: !Equals [!Ref S3BucketName, '']

Resources:

  # ── S3 Bucket for claim documents ──────────────────────────────────────────
  WorkshopS3Bucket:
    Type: AWS::S3::Bucket
    DeletionPolicy: Delete
    Properties:
      BucketName: !If
        - UseAutoGeneratedBucketName
        - !Sub 'agentic-workshop-${AWS::AccountId}-${AWS::Region}'
        - !Ref S3BucketName
      PublicAccessBlockConfiguration:
        BlockPublicAcls: true
        BlockPublicPolicy: true
        IgnorePublicAcls: true
        RestrictPublicBuckets: true
      BucketEncryption:
        ServerSideEncryptionConfiguration:
          - ServerSideEncryptionByDefault:
              SSEAlgorithm: AES256
      Tags:
        - Key: Project
          Value: agentic-process-transformation

  WorkshopS3BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref WorkshopS3Bucket
      PolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Sid: DenyNonSSLRequests
            Effect: Deny
            Principal: '*'
            Action: 's3:*'
            Resource:
              - !GetAtt WorkshopS3Bucket.Arn
              - !Sub '${WorkshopS3Bucket.Arn}/*'
            Condition:
              Bool:
                aws:SecureTransport: 'false'

  # ── DynamoDB Tables ────────────────────────────────────────────────────────
  ClaimsMetadataTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Delete
    Properties:
      TableName: claims-metadata
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: claim_id
          AttributeType: S
      KeySchema:
        - AttributeName: claim_id
          KeyType: HASH
      SSESpecification:
        SSEEnabled: true
      Tags:
        - Key: Project
          Value: agentic-process-transformation

  DemoClaimsMetadataTable:
    Type: AWS::DynamoDB::Table
    DeletionPolicy: Delete
    Properties:
      TableName: demo-claims-metadata
      BillingMode: PAY_PER_REQUEST
      AttributeDefinitions:
        - AttributeName: claim_id
          AttributeType: S
      KeySchema:
        - AttributeName: claim_id
          KeyType: HASH
      SSESpecification:
        SSEEnabled: true
      Tags:
        - Key: Project
          Value: agentic-process-transformation

  # ── IAM Role for Step Functions (HITL) ─────────────────────────────────────
  StepFunctionsHITLRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: claims-hitl-sfn-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: claims-hitl-dynamodb-access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:PutItem
                  - dynamodb:UpdateItem
                  - dynamodb:GetItem
                Resource:
                  - !GetAtt ClaimsMetadataTable.Arn
                  - !GetAtt DemoClaimsMetadataTable.Arn
      Tags:
        - Key: Project
          Value: agentic-process-transformation

  DemoStepFunctionsHITLRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: demo-claims-hitl-sfn-role
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: states.amazonaws.com
            Action: sts:AssumeRole
      Policies:
        - PolicyName: demo-hitl-dynamodb
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:PutItem
                  - dynamodb:UpdateItem
                  - dynamodb:GetItem
                Resource:
                  - !GetAtt DemoClaimsMetadataTable.Arn
      Tags:
        - Key: Project
          Value: agentic-process-transformation

  # ── SageMaker Execution Role ───────────────────────────────────────────────
  SageMakerExecutionRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub 'agentic-workshop-sagemaker-role-${AWS::Region}'
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: sagemaker.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/AmazonSageMakerFullAccess
      Policies:
        # ── Bedrock: model inference ──
        - PolicyName: bedrock-inference
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - bedrock:InvokeModel
                  - bedrock:InvokeModelWithResponseStream
                Resource:
                  - !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/amazon.nova-2-lite-v1:0'
                  - !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/amazon.nova-2-multimodal-embeddings-v1:0'
                  - !Sub 'arn:aws:bedrock:${AWS::Region}::foundation-model/anthropic.claude-sonnet-4-6'
                  - !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/us.amazon.nova-2-lite-v1:0'
                  - !Sub 'arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/us.anthropic.claude-sonnet-4-6'
                  - 'arn:aws:bedrock:*::foundation-model/amazon.nova-2-lite-v1:0'
                  - 'arn:aws:bedrock:*::foundation-model/amazon.nova-2-multimodal-embeddings-v1:0'
                  - 'arn:aws:bedrock:*::foundation-model/anthropic.claude-sonnet-4-6'

        # ── Bedrock AgentCore: memory management ──
        - PolicyName: bedrock-agentcore-memory
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - bedrock-agentcore:*
                Resource: '*'

        # ── S3: read/write claim documents ──
        - PolicyName: s3-claim-documents
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:ListAllMyBuckets
                Resource: '*'
              - Effect: Allow
                Action:
                  - s3:GetObject
                  - s3:PutObject
                Resource:
                  - !Sub '${WorkshopS3Bucket.Arn}/*'

        # ── DynamoDB: claim metadata tables ──
        - PolicyName: dynamodb-claims-tables
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - dynamodb:CreateTable
                  - dynamodb:DescribeTable
                  - dynamodb:DeleteTable
                  - dynamodb:PutItem
                  - dynamodb:GetItem
                  - dynamodb:UpdateItem
                  - dynamodb:Scan
                Resource:
                  - !GetAtt ClaimsMetadataTable.Arn
                  - !GetAtt DemoClaimsMetadataTable.Arn

        # ── Step Functions: HITL orchestration ──
        - PolicyName: step-functions-hitl
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - states:CreateStateMachine
                  - states:DescribeStateMachine
                  - states:DeleteStateMachine
                  - states:StartExecution
                  - states:StopExecution
                  - states:SendTaskSuccess
                  - states:CreateActivity
                  - states:GetActivityTask
                  - states:ListExecutions
                  - states:DescribeExecution
                  - states:DeleteActivity
                Resource:
                  - !Sub 'arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:claims-hitl-*'
                  - !Sub 'arn:aws:states:${AWS::Region}:${AWS::AccountId}:stateMachine:demo-claims-hitl-*'
                  - !Sub 'arn:aws:states:${AWS::Region}:${AWS::AccountId}:activity:demo-claims-*'
                  - !Sub 'arn:aws:states:${AWS::Region}:${AWS::AccountId}:activity:claims-*'
                  - !Sub 'arn:aws:states:${AWS::Region}:${AWS::AccountId}:execution:*:*'

        # ── IAM: manage Step Functions execution roles ──
        - PolicyName: iam-sfn-role-management
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - iam:CreateRole
                  - iam:GetRole
                  - iam:PutRolePolicy
                  - iam:DeleteRolePolicy
                  - iam:DeleteRole
                Resource:
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/claims-hitl-sfn-role'
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/demo-claims-hitl-sfn-role'
              - Effect: Allow
                Action:
                  - iam:PassRole
                Resource:
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/claims-hitl-sfn-role'
                  - !Sub 'arn:aws:iam::${AWS::AccountId}:role/demo-claims-hitl-sfn-role'
                Condition:
                  StringEquals:
                    iam:PassedToService: states.amazonaws.com

        # ── STS: get caller identity ──
        - PolicyName: sts-get-caller-identity
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sts:GetCallerIdentity
                Resource: '*'

        # ── CloudFormation: read stack outputs ──
        - PolicyName: cloudformation-read
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - cloudformation:DescribeStacks
                  - cloudformation:ListStacks
                Resource: '*'

        # ── Marketplace: model subscriptions ──
        - PolicyName: marketplace-model-access
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - aws-marketplace:ViewSubscriptions
                  - aws-marketplace:Subscribe
                  - aws-marketplace:Unsubscribe
                Resource: '*'
      Tags:
        - Key: Project
          Value: agentic-process-transformation

# ── Outputs ──────────────────────────────────────────────────────────────────
Outputs:
  S3BucketName:
    Description: S3 bucket for workshop claim documents
    Value: !Ref WorkshopS3Bucket
    Export:
      Name: !Sub '${AWS::StackName}-S3Bucket'

  SageMakerRoleArn:
    Description: SageMaker execution role ARN — use this when creating your notebook instance or Studio domain
    Value: !GetAtt SageMakerExecutionRole.Arn
    Export:
      Name: !Sub '${AWS::StackName}-SageMakerRoleArn'

  ClaimsMetadataTableName:
    Description: DynamoDB table for claim metadata
    Value: !Ref ClaimsMetadataTable

  DemoClaimsMetadataTableName:
    Description: DynamoDB table for demo claim metadata
    Value: !Ref DemoClaimsMetadataTable

  StepFunctionsRoleArn:
    Description: IAM role ARN for Step Functions HITL state machines
    Value: !GetAtt StepFunctionsHITLRole.Arn

  UploadCommand:
    Description: Run this command to upload sample claim documents to S3
    Value: !Sub 'aws s3 cp 01-insurance-claims-processing/sample_data/ s3://${WorkshopS3Bucket}/claims-processing/claimant-data/ --recursive'