Skip to content

Commit b35e6c8

Browse files
manchandakpmanchandakp
authored
Admin workflow - IAM PERMISSIONS md, utils module etc. (#1323)
* IAM PERMISSIONS md, utils module etc. * IAM PERMISSIONS md, utils module etc. * IAM PERMISSIONS md, utils module etc. * IAM PERMISSIONS md, utils module etc. * IAM PERMISSIONS md, utils module etc. * IAM PERMISSIONS md, utils module etc. * IAM PERMISSIONS md, utils module etc.
1 parent 8adf5c5 commit b35e6c8

4 files changed

Lines changed: 328 additions & 64 deletions

File tree

‎01-tutorials/10-Agent-Registry/01-advanced/admin-approval-workflow/IAM_PERMISSIONS.md‎

Lines changed: 266 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,266 @@
1+
# IAM Permissions for Admin Approval Workflow sample
2+
3+
Create IAM user or role with the following permissions.
4+
5+
> **Before using these policies**, replace every occurrence of `YOUR_ACCOUNT_ID` with your 12-digit AWS account ID.
6+
> Run the following command to find it:
7+
> ```bash
8+
> aws sts get-caller-identity --query Account --output text
9+
> ```
10+
> Then do a find-and-replace of `YOUR_ACCOUNT_ID` in the JSON below before attaching the policy.
11+
12+
## Policy for AWS Agent Registry access (Administrator)
13+
14+
```json
15+
{
16+
"Version": "2012-10-17",
17+
"Statement": [
18+
{
19+
"Sid": "AllowCreatingAndListingRegistries",
20+
"Effect": "Allow",
21+
"Action": [
22+
"bedrock-agentcore:CreateRegistry",
23+
"bedrock-agentcore:ListRegistries"
24+
],
25+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:*"]
26+
},
27+
{
28+
"Sid": "AllowGetUpdateDeleteRegistry",
29+
"Effect": "Allow",
30+
"Action": [
31+
"bedrock-agentcore:GetRegistry",
32+
"bedrock-agentcore:UpdateRegistry",
33+
"bedrock-agentcore:DeleteRegistry"
34+
],
35+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*"]
36+
},
37+
{
38+
"Sid": "AllowCreatingAndListingRegistryRecords",
39+
"Effect": "Allow",
40+
"Action": [
41+
"bedrock-agentcore:CreateRegistryRecord",
42+
"bedrock-agentcore:ListRegistryRecords"
43+
],
44+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*"]
45+
},
46+
{
47+
"Sid": "AllowRecordLevelOperations",
48+
"Effect": "Allow",
49+
"Action": [
50+
"bedrock-agentcore:GetRegistryRecord",
51+
"bedrock-agentcore:UpdateRegistryRecord",
52+
"bedrock-agentcore:DeleteRegistryRecord",
53+
"bedrock-agentcore:SubmitRegistryRecordForApproval"
54+
],
55+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*/record/*"]
56+
},
57+
{
58+
"Sid": "AllowApproveRejectDeprecateRecords",
59+
"Effect": "Allow",
60+
"Action": ["bedrock-agentcore:UpdateRegistryRecordStatus"],
61+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*/record/*"]
62+
},
63+
{
64+
"Sid": "AdditionalPermissionForRegistryManagedWorkloadIdentity",
65+
"Effect": "Allow",
66+
"Action": ["bedrock-agentcore:*WorkloadIdentity"],
67+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:workload-identity-directory/default/workload-identity/*"]
68+
}
69+
]
70+
}
71+
```
72+
73+
## Policy for AWS Agent Registry access (Publisher)
74+
75+
```json
76+
{
77+
"Version": "2012-10-17",
78+
"Statement": [
79+
{
80+
"Sid": "AllowListingAllRegistries",
81+
"Effect": "Allow",
82+
"Action": ["bedrock-agentcore:ListRegistries"],
83+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:*"]
84+
},
85+
{
86+
"Sid": "AllowGetRegistry",
87+
"Effect": "Allow",
88+
"Action": ["bedrock-agentcore:GetRegistry"],
89+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*"]
90+
},
91+
{
92+
"Sid": "AllowCreatingAndListingRegistryRecords",
93+
"Effect": "Allow",
94+
"Action": [
95+
"bedrock-agentcore:CreateRegistryRecord",
96+
"bedrock-agentcore:ListRegistryRecords"
97+
],
98+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*"]
99+
},
100+
{
101+
"Sid": "AllowRecordLevelOperations",
102+
"Effect": "Allow",
103+
"Action": [
104+
"bedrock-agentcore:GetRegistryRecord",
105+
"bedrock-agentcore:UpdateRegistryRecord",
106+
"bedrock-agentcore:DeleteRegistryRecord",
107+
"bedrock-agentcore:SubmitRegistryRecordForApproval"
108+
],
109+
"Resource": ["arn:aws:bedrock-agentcore:*:YOUR_ACCOUNT_ID:registry/*/record/*"]
110+
}
111+
]
112+
}
113+
```
114+
115+
## Permissions Required to deploy the required CI/CD stack such as DynamoDB and AWS Lambda etc.
116+
117+
```json
118+
{
119+
"Version": "2012-10-17",
120+
"Statement": [
121+
{
122+
"Sid": "STSCallerIdentity",
123+
"Effect": "Allow",
124+
"Action": ["sts:GetCallerIdentity"],
125+
"Resource": "*"
126+
},
127+
{
128+
"Sid": "CloudFormationValidate",
129+
"Effect": "Allow",
130+
"Action": ["cloudformation:ValidateTemplate"],
131+
"Resource": "*"
132+
},
133+
{
134+
"Sid": "CloudFormationStackManagement",
135+
"Effect": "Allow",
136+
"Action": [
137+
"cloudformation:CreateStack",
138+
"cloudformation:UpdateStack",
139+
"cloudformation:DeleteStack",
140+
"cloudformation:DescribeStacks",
141+
"cloudformation:DescribeStackEvents",
142+
"cloudformation:DescribeStackResources",
143+
"cloudformation:GetTemplate",
144+
"cloudformation:ListStackResources",
145+
"cloudformation:CreateChangeSet",
146+
"cloudformation:DescribeChangeSet",
147+
"cloudformation:ExecuteChangeSet",
148+
"cloudformation:DeleteChangeSet"
149+
],
150+
"Resource": "arn:aws:cloudformation:*:YOUR_ACCOUNT_ID:stack/*/*"
151+
},
152+
{
153+
"Sid": "S3StagingBucketManagement",
154+
"Effect": "Allow",
155+
"Action": [
156+
"s3:CreateBucket",
157+
"s3:DeleteBucket",
158+
"s3:HeadBucket",
159+
"s3:PutBucketPublicAccessBlock",
160+
"s3:GetBucketPublicAccessBlock",
161+
"s3:ListBucket",
162+
"s3:DeleteObject",
163+
"s3:PutObject",
164+
"s3:GetObject"
165+
],
166+
"Resource": [
167+
"arn:aws:s3:::*",
168+
"arn:aws:s3:::*/*"
169+
]
170+
},
171+
{
172+
"Sid": "LambdaFunctionManagement",
173+
"Effect": "Allow",
174+
"Action": [
175+
"lambda:CreateFunction",
176+
"lambda:UpdateFunctionCode",
177+
"lambda:UpdateFunctionConfiguration",
178+
"lambda:DeleteFunction",
179+
"lambda:GetFunction",
180+
"lambda:GetFunctionConfiguration",
181+
"lambda:AddPermission",
182+
"lambda:RemovePermission"
183+
],
184+
"Resource": "arn:aws:lambda:*:YOUR_ACCOUNT_ID:function:*"
185+
},
186+
{
187+
"Sid": "LambdaLayerManagement",
188+
"Effect": "Allow",
189+
"Action": [
190+
"lambda:PublishLayerVersion",
191+
"lambda:DeleteLayerVersion",
192+
"lambda:GetLayerVersion",
193+
"lambda:ListLayerVersions"
194+
],
195+
"Resource": "arn:aws:lambda:*:YOUR_ACCOUNT_ID:layer:*"
196+
},
197+
{
198+
"Sid": "IAMRoleManagement",
199+
"Effect": "Allow",
200+
"Action": [
201+
"iam:CreateRole",
202+
"iam:DeleteRole",
203+
"iam:GetRole",
204+
"iam:PassRole",
205+
"iam:AttachRolePolicy",
206+
"iam:DetachRolePolicy",
207+
"iam:PutRolePolicy",
208+
"iam:DeleteRolePolicy",
209+
"iam:GetRolePolicy",
210+
"iam:ListRolePolicies",
211+
"iam:ListAttachedRolePolicies"
212+
],
213+
"Resource": "arn:aws:iam::YOUR_ACCOUNT_ID:role/*"
214+
},
215+
{
216+
"Sid": "KMSCreateKey",
217+
"Effect": "Allow",
218+
"Action": ["kms:CreateKey"],
219+
"Resource": "*"
220+
},
221+
{
222+
"Sid": "KMSManageTaggedKeys",
223+
"Effect": "Allow",
224+
"Action": [
225+
"kms:DescribeKey",
226+
"kms:EnableKeyRotation",
227+
"kms:GetKeyPolicy",
228+
"kms:PutKeyPolicy",
229+
"kms:ScheduleKeyDeletion",
230+
"kms:CancelKeyDeletion",
231+
"kms:TagResource",
232+
"kms:UntagResource"
233+
],
234+
"Resource": "*"
235+
},
236+
{
237+
"Sid": "DynamoDBTableManagement",
238+
"Effect": "Allow",
239+
"Action": [
240+
"dynamodb:CreateTable",
241+
"dynamodb:DeleteTable",
242+
"dynamodb:DescribeTable",
243+
"dynamodb:UpdateTable",
244+
"dynamodb:DescribeContinuousBackups",
245+
"dynamodb:DescribeTimeToLive"
246+
],
247+
"Resource": "arn:aws:dynamodb:*:YOUR_ACCOUNT_ID:table/*"
248+
},
249+
{
250+
"Sid": "EventBridgeManagement",
251+
"Effect": "Allow",
252+
"Action": [
253+
"events:PutRule",
254+
"events:DeleteRule",
255+
"events:DescribeRule",
256+
"events:PutTargets",
257+
"events:RemoveTargets",
258+
"events:ListTargetsByRule"
259+
],
260+
"Resource": "arn:aws:events:*:YOUR_ACCOUNT_ID:rule/*"
261+
}
262+
]
263+
}
264+
```
265+
266+

‎01-tutorials/10-Agent-Registry/01-advanced/admin-approval-workflow/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ As an Administrator, you can use the **AWS CLI** commands included in the notifi
6767

6868
## Prerequisites
6969

70-
- IAM credentials with appropriate permissions (see [`IAM_PERMISSIONS.md`](../../IAM_PERMISSIONS.md)). This tutorial requires both admin and publisher permissions. In addition, the following permissions are required to deploy and destroy the CI/CD stack:
70+
- IAM credentials with appropriate permissions (see [`IAM_PERMISSIONS.md`](./IAM_PERMISSIONS.md)). In addition to Agent Registry related operations, the following permissions are being used:
7171

7272
| Service | Permissions |
7373
|:--------|:------------|

0 commit comments

Comments
 (0)