|
| 1 | +import * as cdk from "aws-cdk-lib"; |
| 2 | +import * as lambda from "aws-cdk-lib/aws-lambda"; |
| 3 | +import * as iam from "aws-cdk-lib/aws-iam"; |
| 4 | +import { Construct } from "constructs"; |
| 5 | + |
| 6 | +export class LambdaDurableBedrockStack extends cdk.Stack { |
| 7 | + constructor(scope: Construct, id: string, props?: cdk.StackProps) { |
| 8 | + super(scope, id, props); |
| 9 | + |
| 10 | + const modelId = new cdk.CfnParameter(this, "BedrockModelId", { |
| 11 | + type: "String", |
| 12 | + default: "us.anthropic.claude-sonnet-4-20250514-v1:0", |
| 13 | + description: "Bedrock model ID (inference profile) to use", |
| 14 | + }); |
| 15 | + |
| 16 | + // Lambda function with durable execution enabled |
| 17 | + const fn = new lambda.Function(this, "DurableBedrockFn", { |
| 18 | + runtime: lambda.Runtime.NODEJS_20_X, |
| 19 | + handler: "index.handler", |
| 20 | + code: lambda.Code.fromAsset("src"), |
| 21 | + timeout: cdk.Duration.minutes(15), |
| 22 | + memorySize: 256, |
| 23 | + environment: { |
| 24 | + MODEL_ID: modelId.valueAsString, |
| 25 | + }, |
| 26 | + }); |
| 27 | + |
| 28 | + // Enable durable execution via CfnFunction escape hatch |
| 29 | + const cfnFn = fn.node.defaultChild as lambda.CfnFunction; |
| 30 | + cfnFn.addOverride("Properties.Runtime", "nodejs24.x"); |
| 31 | + cfnFn.addOverride("Properties.DurableConfig", { |
| 32 | + ExecutionTimeout: 900, // 15 minutes max durable execution |
| 33 | + RetentionPeriodInDays: 14, |
| 34 | + }); |
| 35 | + |
| 36 | + // Bedrock InvokeModel — scoped to the specific inference profile and its |
| 37 | + // underlying foundation model rather than a wildcard resource. |
| 38 | + fn.addToRolePolicy( |
| 39 | + new iam.PolicyStatement({ |
| 40 | + actions: ["bedrock:InvokeModel"], |
| 41 | + resources: [ |
| 42 | + `arn:aws:bedrock:${this.region}:${this.account}:inference-profile/${modelId.valueAsString}`, |
| 43 | + "arn:aws:bedrock:*::foundation-model/*", |
| 44 | + ], |
| 45 | + }) |
| 46 | + ); |
| 47 | + |
| 48 | + // Durable execution + CloudWatch Logs permissions via AWS managed policy |
| 49 | + // https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambdaBasicDurableExecutionRolePolicy.html |
| 50 | + fn.role!.addManagedPolicy( |
| 51 | + iam.ManagedPolicy.fromAwsManagedPolicyName( |
| 52 | + "service-role/AWSLambdaBasicDurableExecutionRolePolicy" |
| 53 | + ) |
| 54 | + ); |
| 55 | + |
| 56 | + // Publish a version via L1 — fn.currentVersion doesn't recognise the |
| 57 | + // DurableConfig escape-hatch property on CDK 2.180. |
| 58 | + const cfnVersion = new lambda.CfnVersion(this, "DurableBedrockFnVersion", { |
| 59 | + functionName: fn.functionName, |
| 60 | + description: "Durable execution version", |
| 61 | + }); |
| 62 | + |
| 63 | + new cdk.CfnOutput(this, "FunctionName", { value: fn.functionName }); |
| 64 | + new cdk.CfnOutput(this, "FunctionArn", { value: fn.functionArn }); |
| 65 | + new cdk.CfnOutput(this, "FunctionVersion", { |
| 66 | + value: cfnVersion.attrVersion, |
| 67 | + description: "Published version number — use as --qualifier value", |
| 68 | + }); |
| 69 | + } |
| 70 | +} |
0 commit comments