-
Notifications
You must be signed in to change notification settings - Fork 87
Expand file tree
/
Copy pathtemplate.yaml
More file actions
9966 lines (9460 loc) · 370 KB
/
template.yaml
File metadata and controls
9966 lines (9460 loc) · 370 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
# SPDX-License-Identifier: MIT-0
AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: AWS GenAI IDP Accelerator (uksb-r8evguc4p9) (SO9027) (v<VERSION>)
Mappings:
AppSyncLogLevelMap:
DEBUG:
FieldLogLevel: ALL
INFO:
FieldLogLevel: ALL
WARN:
FieldLogLevel: ERROR
ERROR:
FieldLogLevel: ERROR
CRITICAL:
FieldLogLevel: ERROR
CrawlerScheduleMap:
Manual:
ScheduleExpression: ""
Every15m:
ScheduleExpression: "cron(0/15 * * * ? *)"
EveryHour:
ScheduleExpression: "cron(0 * * * ? *)"
EveryDay:
ScheduleExpression: "cron(0 0 * * ? *)"
ConfigurationMap:
lending-package-sample:
ConfigPath: "lending-package-sample"
rvl-cdip:
ConfigPath: "rvl-cdip"
rvl-cdip-with-few-shot-examples:
ConfigPath: "rvl-cdip-with-few-shot-examples"
bank-statement-sample:
ConfigPath: "bank-statement-sample"
docsplit:
ConfigPath: "docsplit"
realkie-fcc-verified:
ConfigPath: "realkie-fcc-verified"
ocr-benchmark:
ConfigPath: "ocr-benchmark"
rule-validation:
ConfigPath: "rule-validation"
lending-package-sample-govcloud:
ConfigPath: "lending-package-sample-govcloud"
Parameters:
# Authorization params
AdminEmail:
Type: String
Description: >-
Email address of the admin user (e.g. jdoe+admin@example.com).
An initial temporary password is automatically sent to this user via email.
AllowedPattern: '^[\w.+-]+@([\w-]+\.)+[\w-]{2,6}$'
AllowedSignUpEmailDomain:
Type: String
Default: ""
Description: >-
Email address domain (example.com) or comma separated list of email domains (example1.com,
example2.com) allowed to signup using the web UI.
If left empty, signup via the web UI is disabled and users will have to be created
using Cognito.
AllowedPattern: '^(|([\w-]+\.)+[\w-]{2,6}(, *([\w-]+\.)+[\w-]{2,6})*)$'
ConstraintDescription: >-
Must be empty or a list of comma separated email domains (example1.com, example2.com)
# External Identity Provider (Federation)
ExternalIdPType:
Type: String
Default: ""
AllowedValues:
- ""
- "SAML"
- "OIDC"
Description: >-
(Optional) Type of external identity provider to federate with Cognito.
Choose SAML for providers like PingOne, Okta SAML, or ADFS.
Choose OIDC for providers like Okta OIDC, Auth0, or Azure AD.
Leave empty to use Cognito-native authentication only.
ExternalIdPName:
Type: String
Default: ""
Description: >-
(Required when ExternalIdPType is set) Display name for the external identity provider (e.g. PingOne, Okta, AzureAD).
Must be alphanumeric with hyphens only. This name is used in the Cognito hosted UI sign-in button.
AllowedPattern: '^(|[a-zA-Z][a-zA-Z0-9-]{0,31})$'
ConstraintDescription: >-
Must be empty or start with a letter, contain only alphanumeric characters and hyphens, max 32 characters
ExternalIdPMetadataURL:
Type: String
Default: ""
Description: >-
(Required for SAML) The SAML metadata document URL from your identity provider.
For example: https://idp.example.com/saml/metadata
AllowedPattern: '^(|https://.+)$'
ConstraintDescription: Must be empty or a valid HTTPS URL
ExternalIdPOIDCIssuer:
Type: String
Default: ""
Description: >-
(Required for OIDC) The issuer URL from your OIDC identity provider.
For example: https://login.example.com or https://example.okta.com/oauth2/default
AllowedPattern: '^(|https://.+)$'
ConstraintDescription: Must be empty or a valid HTTPS URL
ExternalIdPOIDCClientId:
Type: String
Default: ""
Description: >-
(Required for OIDC) The client ID registered with your OIDC identity provider.
ExternalIdPOIDCClientSecretArn:
Type: String
Default: ""
Description: >-
(Required for OIDC) The ARN of an AWS Secrets Manager secret containing the OIDC client secret.
Create the secret before deploying: aws secretsmanager create-secret --name my-idp-oidc-secret --secret-string "YOUR_CLIENT_SECRET"
ExternalIdPGroupAttributeName:
Type: String
Default: ""
Description: >-
(Optional) The SAML attribute or OIDC claim name that carries group membership from the external IdP.
For SAML, this is typically http://schemas.xmlsoap.org/claims/Group or memberOf.
For OIDC, this is typically groups. Leave empty to skip automatic group mapping.
ExternalIdPAdminGroupName:
Type: String
Default: ""
Description: >-
(Optional) The group name in your external IdP that should map to the Cognito Admin role.
For example: IDP-Admins or cn=Admins,ou=Groups,dc=example,dc=com
ExternalIdPAuthorGroupName:
Type: String
Default: ""
Description: >-
(Optional) The group name in your external IdP that should map to the Cognito Author role.
For example: IDP-Authors
ExternalIdPReviewerGroupName:
Type: String
Default: ""
Description: >-
(Optional) The group name in your external IdP that should map to the Cognito Reviewer role.
For example: IDP-Reviewers
ExternalIdPViewerGroupName:
Type: String
Default: ""
Description: >-
(Optional) The group name in your external IdP that should map to the Cognito Viewer role.
For example: IDP-Viewers
ExternalIdPAutoLogin:
Type: String
Default: "false"
AllowedValues:
- "true"
- "false"
Description: >-
(Optional) When enabled and an external IdP is configured, users are automatically redirected
to the external IdP for authentication instead of seeing the Cognito login page first.
Native Cognito username/password login is still available by navigating directly to the Cognito hosted UI.
# Custom Configuration Path
CustomConfigPath:
Type: String
Default: ""
Description: >-
S3 URI pointing to your custom configuration YAML file. When provided, this configuration overrides the selected pattern preset and applies to all processing patterns.
Leave blank to use the selected pattern configuration preset. For example s3://my-bucket/custom-config/config.yaml
AllowedPattern: '^(|s3://.*)$'
ConstraintDescription: Must be empty or a valid S3 URI (e.g., s3://my-bucket/custom-config/config.yaml)
ConfigurationPreset:
Type: String
Default: "lending-package-sample"
AllowedValues:
- "lending-package-sample"
- "lending-package-sample-govcloud"
- "rvl-cdip"
- "rvl-cdip-with-few-shot-examples"
- "bank-statement-sample"
- "docsplit"
- "realkie-fcc-verified"
- "ocr-benchmark"
- "rule-validation"
Description: >-
Select the configuration preset. Each configuration contains pre-tuned settings for specific document processing scenarios - see https://github.com/aws-samples/sample-genai-idp/blob/main/config_library/README.md. Note: Custom Configuration Path overrides this when provided.
Pattern2CustomClassificationModelARN:
Type: String
Default: ""
Description: Specify Custom Fine Tuned Classification Model ARN. Leave blank to use pretrained model specified in the selected configuration.
Pattern2CustomExtractionModelARN:
Type: String
Default: ""
Description: Specify Custom Fine Tuned Extraction Model ARN. Leave blank to use pretrained model specified in the selected configuration.
# Evaluation
EvaluationBaselineBucketName:
Type: String
Default: ""
Description: >-
(Optional) Existing bucket used for baseline (ground truth) data for processed documents. Baseline data is used to asess the accuracy
of the processing pattern outputs.
Provide the name of an existing bucket here. Hint: you can use the Output bucket of another GenAIIDP stack to compare the outputs from
different patterns and prompts.
Leave blank to automatically create an empty bucket where you can (optionally) place your validated baseline data later.
ReportingBucketName:
Type: String
Default: ""
Description: >-
(Optional) Existing bucket used for analytics. (Currently used for evaluation analytics)
Provide the name of an existing bucket here or leave blank to automatically create a new bucket.
DocumentSectionsCrawlerFrequency:
Type: String
Default: "EveryDay"
AllowedValues:
- "Manual"
- "Every15m"
- "EveryHour"
- "EveryDay"
Description: >-
Frequency for the Glue Crawler to run and discover new document section tables and partitions.
Manual requires manual execution, other options run automatically at the specified interval.
# X-Ray Tracing
EnableXRayTracing:
Type: String
Default: 'true'
AllowedValues: [ 'true', 'false' ]
Description: Enable X-Ray tracing
# MCP Integration
EnableMCP:
Type: String
Default: 'true'
AllowedValues: [ 'true', 'false' ]
Description: Enable Model Context Protocol (MCP) integration for external application access via AWS Bedrock AgentCore Gateway
# Optional Knowledge Base Configuration
DocumentKnowledgeBase:
Default: "BEDROCK_KNOWLEDGE_BASE (Create)"
Type: String
AllowedValues:
- "DISABLED"
- "BEDROCK_KNOWLEDGE_BASE (Create)"
Description: Use document processing results as knowledge base content. Model access for amazon.titan-embed-text-v2:0 MUST be enabled in Amazon Bedrock.
KnowledgeBaseVectorStore:
Type: String
Default: "S3_VECTORS"
AllowedValues:
- "OPENSEARCH_SERVERLESS"
- "S3_VECTORS"
Description: Choose vector store type for Bedrock Knowledge Base. S3 Vectors (default) for cost-effective storage with sub-second latency, OpenSearch Serverless for sub-millisecond queries.
KnowledgeBaseModelId:
Type: String
Default: "us.amazon.nova-pro-v1:0"
AllowedValues:
- "us.amazon.nova-lite-v1:0"
- "us.amazon.nova-pro-v1:0"
- "us.amazon.nova-premier-v1:0"
- "us.amazon.nova-2-lite-v1:0"
- "us.amazon.nova-2-lite-v1:0:priority"
- "us.amazon.nova-2-lite-v1:0:flex"
- "global.amazon.nova-2-lite-v1:0"
- "global.amazon.nova-2-lite-v1:0:priority"
- "global.amazon.nova-2-lite-v1:0:flex"
- "us.anthropic.claude-3-haiku-20240307-v1:0"
- "us.anthropic.claude-3-5-haiku-20241022-v1:0"
- "us.anthropic.claude-3-5-sonnet-20241022-v2:0"
- "us.anthropic.claude-3-7-sonnet-20250219-v1:0"
- "us.anthropic.claude-sonnet-4-20250514-v1:0"
- "us.anthropic.claude-sonnet-4-5-20250929-v1:0"
- "eu.amazon.nova-lite-v1:0"
- "eu.amazon.nova-pro-v1:0"
- "eu.amazon.nova-2-lite-v1:0"
- "eu.amazon.nova-2-lite-v1:0:priority"
- "eu.amazon.nova-2-lite-v1:0:flex"
- "eu.anthropic.claude-3-haiku-20240307-v1:0"
- "eu.anthropic.claude-3-5-sonnet-20241022-v2:0"
- "eu.anthropic.claude-3-7-sonnet-20250219-v1:0"
- "eu.anthropic.claude-sonnet-4-20250514-v1:0"
- "eu.anthropic.claude-sonnet-4-5-20250929-v1:0"
- "qwen.qwen3-vl-235b-a22b"
- "global.amazon.nova-2-lite-v1:0"
- "global.anthropic.claude-haiku-4-5-20251001-v1:0"
- "global.anthropic.claude-sonnet-4-5-20250929-v1:0"
Description: Model to use for optional Document Knowledge Base. Model access MUST be enabled in Amazon Bedrock. Note - Nova Premier may not be available in all EU regions.
# Optional - Post processing Lambda hook
PostProcessingLambdaHookFunctionArn:
Default: ""
Type: String
AllowedPattern: "^(|arn:aws[a-z-]*:lambda:.*)$"
Description: >
(Optional) The specified Lambda function is invoked by EventBridge after the document processing workflow is processed.
This function can implement custom logic to initiate downstream processing on the output of the processing pattern.
# Optional Bedrock Guardrail Configuration
BedrockGuardrailId:
Type: String
Default: ""
AllowedPattern: "^(|[a-z0-9]+)$"
Description: >
Optionally provide the *Id* (not name) of an *existing* Bedrock Guardrail (looks like: wxyz3ab12x34) to be used for all Bedrock and Bedrock Knowledge Base interactions.
BedrockGuardrailVersion:
Type: String
Default: "DRAFT"
AllowedPattern: "^(|(([1-9][0-9]{0,7})|(DRAFT)))$"
Description: >
If you provided a Bedrock Guardrail Id above, provide the corresponding Guardrail version here (e.g. DRAFT|1|2|...).
# General Configuration
MaxConcurrentWorkflows:
Type: Number
Default: 100
Description: Maximum number of concurrent workflow executions allowed
MinValue: 1
DataRetentionInDays:
Type: Number
Default: 365
Description: Number of days to retain documents (S3) and tracking records (DynamoDB)
MinValue: 1
ErrorThreshold:
Type: Number
Default: 1
Description: Number of workflow errors that triggers an alert (per 5 minutes)
MinValue: 1
ExecutionTimeThresholdMs:
Type: Number
Default: 300000
Description: Maximum acceptable execution time in milliseconds before alerting (default 300000 = 300 seconds)
MinValue: 1000
# Security Configuration
PermissionsBoundaryArn:
Type: String
Default: ""
Description: >-
(Optional) ARN of an existing IAM Permissions Boundary policy to attach to all IAM roles.
Required by some organizations with Service Control Policies (SCPs).
Format: arn:partition:iam::account-id:policy/policy-name
Leave blank if no Permissions Boundary is required.
AllowedPattern: "^(|arn:aws[a-z-]*:iam::[0-9]{12}:policy/.+)$"
ConstraintDescription: Must be empty or a valid IAM policy ARN
EnableECRImageScanning:
Type: String
Default: "false"
AllowedValues:
- "true"
- "false"
Description: >-
Enable automatic vulnerability scanning for Lambda container images in ECR (applies to Pattern-1 and Pattern-2).
Disabling may improve deployment reliability but reduces security posture.
Recommended: true for production, false only if experiencing deployment issues.
# Logging configuration
LogLevel:
Type: String
Default: INFO
AllowedValues:
- DEBUG
- INFO
- WARN
- ERROR
Description: Default logging level for all logs
LogRetentionDays:
Type: Number
Default: 30
Description: Number of days to retain CloudWatch logs
AllowedValues:
[
1,
3,
5,
7,
14,
30,
60,
90,
120,
150,
180,
365,
400,
545,
731,
1827,
3653,
]
WebUIHosting:
Type: String
Default: CloudFront
AllowedValues:
- CloudFront
- ALB
Description: >-
Frontend hosting method. Use CloudFront for public/standard deployments.
Use ALB for GovCloud or private network deployments that require
VPC-based hosting.
ALBVpcId:
Type: String
Default: ""
Description: >-
(Required when WebUIHosting=ALB or AppSyncVisibility=PRIVATE) VPC ID.
When using ALB hosting, this is the VPC for the ALB and S3 VPC endpoint.
When using private AppSync (AppSyncVisibility=PRIVATE), this VPC ID is
also used for the Lambda security group - private AppSync requires all
Lambda functions to be in the same VPC as the AppSync VPC endpoint, so
ALB hosting and private AppSync always use the same VPC.
ALBSubnetIds:
Type: CommaDelimitedList
Default: ""
Description: >-
(Required when WebUIHosting=ALB) Comma-separated subnet IDs for the ALB
(minimum 2 subnets in different AZs).
ALBCertificateArn:
Type: String
Default: ""
Description: >-
(Required when WebUIHosting=ALB) ACM certificate ARN for the ALB HTTPS
listener. Can be ACM-issued or imported (including self-signed). Use
scripts/generate_self_signed_cert.sh for demo/testing.
ALBScheme:
Type: String
Default: internal
AllowedValues:
- internal
- internet-facing
Description: >-
(ALB hosting only) ALB scheme. Use 'internal' for private network access,
'internet-facing' for public access.
ALBAllowedCIDRs:
Type: String
Default: ""
Description: >-
(ALB hosting only) Comma-separated CIDR ranges allowed to access the ALB.
Leave empty to automatically use the VPC CIDR range (recommended for
internal ALBs). Specify explicit CIDRs to override.
AppSyncVisibility:
Type: String
Default: GLOBAL
AllowedValues:
- GLOBAL
- PRIVATE
Description: >-
Controls AppSync API accessibility. GLOBAL (default) is the standard
internet-facing mode. Set to PRIVATE for private network deployments
where the API must only be accessible from within the VPC via VPC
endpoints. Requires WebUIHosting=ALB and LambdaSubnetIds to be set.
All Lambda functions will be deployed in VPC when PRIVATE.
LambdaSubnetIds:
Type: CommaDelimitedList
Default: ""
Description: >-
(Required when AppSyncVisibility=PRIVATE) Comma-separated private subnet
IDs for Lambda functions. Should be private subnets with no direct
internet route - Lambda traffic reaches AWS services via VPC endpoints.
Can be the same as ALBSubnetIds for simpler deployments, or different
private subnets for stricter network isolation. Minimum 2 subnets in
different Availability Zones recommended.
CloudFrontPriceClass:
Type: String
Default: PriceClass_100
Description: >-
(CloudFront hosting only) Specify the CloudFront price class. See
https://aws.amazon.com/cloudfront/pricing/ for a description of each
price class.
AllowedValues:
- PriceClass_100
- PriceClass_200
- PriceClass_All
ConstraintDescription: >-
Allowed Price Classes PriceClass_100 PriceClass_200 and PriceClass_All
CloudFrontAllowedGeos:
Type: String
Default: ""
Description: >-
Specify a comma separated list of two letter country codes (uppercase ISO 3166-1)
that are
allowed to access the web user interface via CloudFront. For example: US,CA.
Leave empty if
you do not want geo restrictions to be applied.
AllowedPattern: "^(|[A-Z]{2}(,[A-Z]{2})*)$"
ConstraintDescription: >-
Comma separated list of uppercase two letter country codes or empty
WAFAllowedIPv4Ranges:
Type: String
Default: "0.0.0.0/0"
Description: >-
Comma-separated list of IPv4 CIDR ranges to allow. Default (0.0.0.0/0) disables WAF and allows all IPs.
Example to restrict: "192.168.1.0/24, 10.0.0.0/16"
AllowedPattern: '^([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2}(,\s*([0-9]{1,3}\.){3}[0-9]{1,3}\/[0-9]{1,2})*$'
ConstraintDescription: Must be valid comma-separated list of IPv4 CIDR ranges
ArtifactsBucketKmsKeyArn:
Type: String
Default: ""
Description: >-
(Optional) ARN of a KMS CMK used to encrypt the artifacts S3 bucket.
When the artifacts bucket was pre-created with KMS encryption, provide
the key ARN here so that CodeBuild (Docker image builds) and Lambda
(configuration copy) can perform kms:Decrypt to read source artifacts.
Leave empty if the artifacts bucket uses SSE-S3 (default AES256) encryption.
AllowedPattern: "^(|arn:aws[a-z-]*:kms:[a-z0-9-]+:[0-9]{12}:key/.+)$"
ConstraintDescription: Must be empty or a valid KMS key ARN
# MLflow Integration
EnableMLflow:
Type: String
Default: 'false'
AllowedValues: ['true', 'false']
Description: Enable MLflow experiment tracking integration
MlflowTrackingURI:
Type: String
Default: ""
Description: SageMaker MLflow tracking server ARN
# Headless API Configuration
# ------------------------------------------------------------------------
# Headless API Deployment (required for GovCloud)
#
# These parameters control the optional "headless" deployment mode, where
# the stack deploys a private Jobs REST API (API Gateway + Lambda) instead
# of (or in addition to) the web UI. This mode is REQUIRED for GovCloud
# regions because the UI-layer services (AppSync, CloudFront, Cognito UI
# pool) aren't available there. In Commercial regions the mode is OPTIONAL
# and useful for API-only / machine-to-machine integrations.
#
# All parameters below default to OFF / empty. Leaving them at defaults
# keeps the stack as a pure web-UI deployment with no Jobs API, no VPC
# placement of Lambdas, and no bastion EC2.
#
# See docs/govcloud-deployment.md for deployment patterns and
# docs/govcloud-batch-api.md for the Jobs API reference.
# ------------------------------------------------------------------------
EnableHeadless:
Type: String
Default: 'false'
AllowedValues: ['true', 'false']
Description: >-
Set to 'true' to deploy the headless Jobs REST API (Private API Gateway
+ /jobs endpoints + supporting Lambdas). Default 'false' = no Jobs API
is deployed. Required for GovCloud. When 'true', you must also set
DeployInVPC=true and populate VpcId, PrivateSubnetIds,
ApiGatewayVpcEndpointId, and LambdaSecurityGroupId.
DeployInVPC:
Type: String
Default: 'false'
AllowedValues: ['true', 'false']
Description: >-
Set to 'true' to place all document-processing Lambdas inside the
customer-supplied VPC (required for Headless API deployments and for
any compliance/exfil-control use cases). Default 'false' = Lambdas run
in the default AWS-owned network. When 'true', you must populate
VpcId, PrivateSubnetIds, and LambdaSecurityGroupId.
VpcId:
Type: String
Default: ""
Description: >-
Required when DeployInVPC=true. The customer-owned VPC that Lambdas
and (if Headless) the Private API Gateway VPC endpoint are attached
to. Leave empty for non-VPC deployments.
PrivateSubnetIds:
Type: CommaDelimitedList
Default: ""
Description: >-
Required when DeployInVPC=true. Comma-separated list of at least 2
private subnet IDs in different AZs within VpcId. Lambdas are
attached to these subnets. Leave empty for non-VPC deployments.
LambdaSecurityGroupId:
Type: String
Default: ""
Description: >-
Required when DeployInVPC=true. Security group attached to all
VPC-resident Lambdas. Must allow outbound HTTPS to AWS service
endpoints (either via VPC endpoints or a NAT gateway). Leave empty
for non-VPC deployments.
ApiGatewayVpcEndpointId:
Type: String
Default: ""
Description: >-
Required when EnableHeadless=true. The com.amazonaws.<region>.execute-api
Interface VPC endpoint that the Private API Gateway is bound to. The
API's resource policy denies all traffic not sourced from this VPCE.
Leave empty if EnableHeadless=false.
ApiStageName:
Type: String
Default: 'beta'
Description: >-
Stage name for the Headless Jobs API Gateway (e.g. 'beta', 'prod').
Ignored when EnableHeadless=false.
# ------------------------------------------------------------------------
# Headless API Deployment - Bastion Host (optional, requires VPC Secured Mode)
#
# The bastion host is an OPTIONAL developer-convenience feature for
# reaching the Private API Gateway from outside the VPC during
# development. It provisions a small EC2 instance (Amazon Linux 2, t3.small,
# IMDSv2-required, encrypted EBS, no inbound SSH) reachable via AWS SSM
# Session Manager. Use scripts/bastion.sh to establish a local tunnel
# through it for running scripts/e2e_test_headless.py or similar.
#
# These parameters are ONLY used when DeployBastionHost=true AND
# DeployInVPC=true (the bastion shares the customer-supplied VPC).
# Nothing is deployed if DeployBastionHost=false (the default).
# ------------------------------------------------------------------------
DeployBastionHost:
Type: String
Default: 'false'
AllowedValues: ['true', 'false']
Description: >-
Set to 'true' to provision an SSM-reachable bastion EC2 for dev-time
access to the Private API Gateway (useful for running e2e tests or
calling the API from a local machine). Default 'false' = no EC2 is
deployed. Requires DeployInVPC=true and the two Bastion* parameters
below. Typically only used in dev accounts.
BastionHostSubnetId:
Type: String
Default: ""
Description: >-
Required when DeployBastionHost=true. A PUBLIC subnet in VpcId where
the bastion EC2 will launch. The subnet needs SSM egress so Session
Manager can reach the instance. Leave empty when DeployBastionHost=false.
BastionHostSecurityGroupId:
Type: String
Default: ""
Description: >-
Required when DeployBastionHost=true. Security group attached to the
bastion EC2. No inbound SSH rule is needed - SSM Session Manager is
the only ingress path. Leave empty when DeployBastionHost=false.
BastionHostAmiId:
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
Default: /aws/service/ami-amazon-linux-latest/amzn2-ami-hvm-x86_64-gp2
Description: >-
SSM Parameter Store path for the AMI to use on the bastion EC2. The
default resolves to the latest Amazon Linux 2 AMI and is the right
choice for almost all deployments. Only change if you need a custom
hardened AMI. Ignored when DeployBastionHost=false.
Rules:
MLflowTrackingURIRequired:
RuleCondition: !Equals [ !Ref EnableMLflow, "true" ]
Assertions:
- Assert: !Not [ !Equals [ !Ref MlflowTrackingURI, "" ] ]
AssertDescription: "MlflowTrackingURI is required when EnableMLflow is true"
# EnableHeadless=true stands up a Private API Gateway + VPC-resident Lambdas
# that !Ref VpcId/PrivateSubnetIds/ApiGatewayVpcEndpointId/LambdaSecurityGroupId
# unconditionally. Those params default to empty, so without this rule a
# misconfigured deploy would fail deep in CREATE_IN_PROGRESS with an opaque
# Lambda/API Gateway error. Fail fast at changeset creation instead.
HeadlessRequiresVPC:
RuleCondition: !Equals [ !Ref EnableHeadless, "true" ]
Assertions:
- Assert: !Equals [ !Ref DeployInVPC, "true" ]
AssertDescription: "EnableHeadless=true requires DeployInVPC=true (the Jobs API uses a Private API Gateway and VPC-resident Lambdas)."
- Assert: !Not [ !Equals [ !Ref VpcId, "" ] ]
AssertDescription: "VpcId is required when EnableHeadless=true"
- Assert: !Not [ !Equals [ !Ref ApiGatewayVpcEndpointId, "" ] ]
AssertDescription: "ApiGatewayVpcEndpointId is required when EnableHeadless=true"
- Assert: !Not [ !Equals [ !Ref LambdaSecurityGroupId, "" ] ]
AssertDescription: "LambdaSecurityGroupId is required when EnableHeadless=true"
# Note: PrivateSubnetIds is a CommaDelimitedList. The Rules-block
# intrinsic-function set (Fn::And / Contains / EachMember* / Equals /
# If / Not / Or / RefAll / ValueOf*) has no portable way to assert
# that a CommaDelimitedList isn't the "one empty string" default.
# The remaining VpcId / VpcEndpoint / SG assertions above cover the
# common "forgot to pass VPC parameters at all" misconfiguration;
# invalid subnet IDs are caught later by the Lambda CreateFunction
# call with a clear error rather than a mid-deploy rollback.
# Bastion host is a developer-convenience layered on top of VPC-secured mode.
# It shares the customer-supplied VPC, so DeployInVPC must be true as well.
BastionRequiresVPC:
RuleCondition: !Equals [ !Ref DeployBastionHost, "true" ]
Assertions:
- Assert: !Equals [ !Ref DeployInVPC, "true" ]
AssertDescription: "DeployBastionHost=true requires DeployInVPC=true"
- Assert: !Not [ !Equals [ !Ref BastionHostSubnetId, "" ] ]
AssertDescription: "BastionHostSubnetId is required when DeployBastionHost=true"
- Assert: !Not [ !Equals [ !Ref BastionHostSecurityGroupId, "" ] ]
AssertDescription: "BastionHostSecurityGroupId is required when DeployBastionHost=true"
Conditions:
# Headless/VPC/Bastion feature conditions
DeployInVPC: !Equals [!Ref DeployInVPC, 'true']
DeployApiGateway: !Equals [!Ref EnableHeadless, 'true']
ShouldDeployBastionHost: !Equals [!Ref DeployBastionHost, 'true']
HasGuardrailConfig:
!And [
!Not [ !Equals [ !Ref BedrockGuardrailId, "" ] ],
!Not [ !Equals [ !Ref BedrockGuardrailVersion, "" ] ],
]
# HITL and Private Workforce conditions
# General rules
ShouldAllowSignUpEmailDomain:
!Not [ !Equals [ !Ref AllowedSignUpEmailDomain, "" ] ]
ShouldEnableGeoRestriction: !Not [ !Equals [ !Ref CloudFrontAllowedGeos, "" ] ]
ShouldEnablePostProcessingLambdaHook:
!Not [ !Equals [ !Ref PostProcessingLambdaHookFunctionArn, "" ] ]
ShouldCreateEvaluationBaselineBucket:
!Equals [ !Ref EvaluationBaselineBucketName, "" ]
ShouldCreateReportingBucket: !Equals [ !Ref ReportingBucketName, "" ]
IsWafEnabled: !Not [ !Equals [ !Ref WAFAllowedIPv4Ranges, "0.0.0.0/0" ] ]
ShouldCreateDocumentKnowledgeBase:
!Equals [ !Ref DocumentKnowledgeBase, "BEDROCK_KNOWLEDGE_BASE (Create)" ]
ShouldUseDocumentKnowledgeBase: !Condition ShouldCreateDocumentKnowledgeBase
DocumentSectionsCrawlerScheduleEnabled:
!Not [ !Equals [ !Ref DocumentSectionsCrawlerFrequency, "Manual" ] ]
HasPermissionsBoundary: !Not [ !Equals [ !Ref PermissionsBoundaryArn, "" ] ]
HasCustomConfigPath: !Not [ !Equals [ !Ref CustomConfigPath, "" ] ]
IsS3VectorsVectorStore: !Equals [ !Ref KnowledgeBaseVectorStore, "S3_VECTORS" ]
CreateAgentCoreLambda: !Equals [ !Ref EnableMCP, "true" ]
CreateExternalAppClient: !Equals [ !Ref EnableMCP, "true" ]
HasExternalIdP: !Not [ !Equals [ !Ref ExternalIdPType, "" ] ]
IsExternalIdPSAML:
!And
- !Condition HasExternalIdP
- !Equals [ !Ref ExternalIdPType, "SAML" ]
IsExternalIdPOIDC:
!And
- !Condition HasExternalIdP
- !Equals [ !Ref ExternalIdPType, "OIDC" ]
HasExternalIdPGroupMapping: !Not [ !Equals [ !Ref ExternalIdPGroupAttributeName, "" ] ]
ShouldMapExternalIdPGroups:
!And
- !Condition HasExternalIdP
- !Condition HasExternalIdPGroupMapping
UseCloudFrontHosting: !Equals [ !Ref WebUIHosting, "CloudFront" ]
UseALBHosting: !Equals [ !Ref WebUIHosting, "ALB" ]
EnableXRayTracingCondition: !Equals [ !Ref EnableXRayTracing, "true" ]
UsePrivateAppSync: !Equals [ !Ref AppSyncVisibility, "PRIVATE" ]
HasArtifactsBucketKmsKey: !Not [ !Equals [ !Ref ArtifactsBucketKmsKeyArn, "" ] ]
Metadata:
cfn-lint:
config:
ignore_checks:
- W1030 # ARN pattern matching when Ref resolves to empty string
AWS::CloudFormation::Interface:
ParameterGroups:
- Label:
default: "User Authentication"
Parameters:
- AdminEmail
- AllowedSignUpEmailDomain
- Label:
default: "Configuration"
Parameters:
- ConfigurationPreset
- CustomConfigPath
- Pattern2CustomClassificationModelARN
- Pattern2CustomExtractionModelARN
- Label:
default: "Evaluation"
Parameters:
- EvaluationBaselineBucketName
- Label:
default: "Reporting"
Parameters:
- ReportingBucketName
- DocumentSectionsCrawlerFrequency
- Label:
default: "Document Knowledge Base"
Parameters:
- DocumentKnowledgeBase
- KnowledgeBaseVectorStore
- KnowledgeBaseModelId
- Label:
default: "Post Processing"
Parameters:
- PostProcessingLambdaHookFunctionArn
- Label:
default: "Bedrock Guardrails"
Parameters:
- BedrockGuardrailId
- BedrockGuardrailVersion
- Label:
default: "Security Configuration"
Parameters:
- PermissionsBoundaryArn
- WAFAllowedIPv4Ranges
- Label:
default: "MCP Integration"
Parameters:
- EnableMCP
- Label:
default: "MLflow Integration"
Parameters:
- EnableMLflow
- MlflowTrackingURI
- Label:
default: "External Identity Provider (Federation)"
Parameters:
- ExternalIdPType
- ExternalIdPName
- ExternalIdPMetadataURL
- ExternalIdPOIDCIssuer
- ExternalIdPOIDCClientId
- ExternalIdPOIDCClientSecretArn
- ExternalIdPGroupAttributeName
- ExternalIdPAdminGroupName
- ExternalIdPAuthorGroupName
- ExternalIdPReviewerGroupName
- ExternalIdPViewerGroupName
- ExternalIdPAutoLogin
- Label:
default: "Web UI Hosting"
Parameters:
- WebUIHosting
- CloudFrontPriceClass
- CloudFrontAllowedGeos
- Label:
default: "ALB Hosting (when WebUIHosting=ALB)"
Parameters:
- ALBVpcId
- ALBSubnetIds
- ALBCertificateArn
- ALBScheme
- ALBAllowedCIDRs
- Label:
default: "Private Network (AppSync=PRIVATE requires ALB hosting)"
Parameters:
- AppSyncVisibility
- LambdaSubnetIds
- Label:
default: "Headless API Deployment (required for GovCloud)"
Parameters:
- EnableHeadless
- DeployInVPC
- VpcId
- PrivateSubnetIds
- LambdaSecurityGroupId
- ApiGatewayVpcEndpointId
- ApiStageName
- Label:
default: "Headless API Deployment - Bastion Host (optional, requires VPC Secured Mode)"
Parameters:
- DeployBastionHost
- BastionHostSubnetId
- BastionHostSecurityGroupId
- BastionHostAmiId
- Label:
default: "Advanced - Artifact Bucket"
Parameters:
- ArtifactsBucketKmsKeyArn
- Label:
default: "General Configuration"
Parameters:
- MaxConcurrentWorkflows
- DataRetentionInDays
- ErrorThreshold
- ExecutionTimeThresholdMs
- LogLevel
- LogRetentionDays
ParameterLabels:
AdminEmail:
default: "Admin Email Address"
AllowedSignUpEmailDomain:
default: "Allowed Sign Up Email Domain"
Pattern2CustomClassificationModelARN:
default: "Custom Classification Model ARN"
Pattern2CustomExtractionModelARN:
default: "Custom Extraction Model ARN"
ConfigurationPreset:
default: "Configuration Preset"
CustomConfigPath:
default: "Custom Configuration Path"
PostProcessingLambdaHookFunctionArn:
default: "Post Processing Lambda Hook Function ARN"
EvaluationBaselineBucketName:
default: "Evaluation Baseline Bucket Name"
ReportingBucketName:
default: "Reporting Bucket Name"
DocumentKnowledgeBase:
default: "Document Knowledge Base Configuration"
KnowledgeBaseModelId:
default: "Knowledge Base Model Id"
BedrockGuardrailId:
default: "Bedrock Guardrail Id"
BedrockGuardrailVersion:
default: "Bedrock Guardrail Version"
PermissionsBoundaryArn:
default: "Permissions Boundary ARN"
MaxConcurrentWorkflows:
default: "Maximum Concurrent Workflows"
DataRetentionInDays:
default: "Data Retention Period (days)"
ErrorThreshold:
default: "Error Alert Threshold"
ExecutionTimeThresholdMs:
default: "Execution Time Threshold (ms)"
LogLevel:
default: "Logging Level"
LogRetentionDays:
default: "Log Retention Period (days)"
CloudFrontPriceClass:
default: "CloudFront Price Class"
CloudFrontAllowedGeos:
default: "CloudFront Allowed Geos"
WAFAllowedIPv4Ranges:
default: "WAF Allowed IPv4 Ranges"
EnableMCP:
default: "Enable MCP Integration"
EnableMLflow:
default: "Enable MLflow Integration"
MlflowTrackingURI:
default: "MLflow Tracking Server ARN"
WebUIHosting:
default: "Web UI Hosting Method"
ALBVpcId:
default: "ALB - VPC ID"
ALBSubnetIds:
default: "ALB - Subnet IDs"
ALBCertificateArn:
default: "ALB - ACM Certificate ARN"
ALBScheme:
default: "ALB - Scheme (internal/internet-facing)"
ALBAllowedCIDRs:
default: "ALB - Allowed CIDR Ranges"
AppSyncVisibility:
default: "AppSync API Visibility (GLOBAL or PRIVATE)"
LambdaSubnetIds:
default: "Lambda Subnet IDs (required when AppSyncVisibility=PRIVATE)"
ArtifactsBucketKmsKeyArn:
default: "Artifacts Bucket KMS Key ARN (optional, for pre-created KMS-encrypted bucket)"
EnableHeadless:
default: "Enable Headless API (Jobs REST API, required for GovCloud)"
DeployInVPC:
default: "Enable VPC Secured Mode (required when Headless API is enabled)"
VpcId:
default: "VPC ID (required when VPC Secured Mode is enabled)"
PrivateSubnetIds:
default: "Private Subnet IDs (required when VPC Secured Mode is enabled)"
LambdaSecurityGroupId:
default: "Lambda Security Group ID (required when VPC Secured Mode is enabled)"
ApiGatewayVpcEndpointId:
default: "API Gateway VPC Endpoint ID (required when Headless API is enabled)"
ApiStageName:
default: "API Gateway Stage Name (Headless API)"
DeployBastionHost:
default: "Deploy Bastion Host (optional, for dev access to Private API)"
BastionHostSubnetId:
default: "Bastion Host - Subnet ID (required when Bastion Host is enabled)"
BastionHostSecurityGroupId:
default: "Bastion Host - Security Group ID (required when Bastion Host is enabled)"
BastionHostAmiId: