Skip to content

Commit 87718b2

Browse files
isadeksisadeks
authored
Merge branch 'main' into feat/agentcore-oauth-2-0b
2 parents 0b95e23 + 90a6580 commit 87718b2

21 files changed

Lines changed: 1899 additions & 4 deletions

‎cdk/bootstrap/BOOTSTRAP_HASH‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
4892570024965c2e99ef0d9f7ef0a61e4b939ba69c5df52e4bc1647522dad283

‎cdk/bootstrap/BOOTSTRAP_VERSION‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
1.0.0

‎cdk/bootstrap/policies/application.json‎

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
{
2+
"Statement": [
3+
{
4+
"Action": [
5+
"dynamodb:CreateTable",
6+
"dynamodb:DeleteTable",
7+
"dynamodb:DescribeTable",
8+
"dynamodb:DescribeTimeToLive",
9+
"dynamodb:UpdateTimeToLive",
10+
"dynamodb:UpdateTable",
11+
"dynamodb:UpdateContinuousBackups",
12+
"dynamodb:DescribeContinuousBackups",
13+
"dynamodb:TagResource",
14+
"dynamodb:UntagResource",
15+
"dynamodb:ListTagsOfResource",
16+
"dynamodb:PutItem",
17+
"dynamodb:UpdateItem",
18+
"dynamodb:DescribeContributorInsights",
19+
"dynamodb:DescribeKinesisStreamingDestination",
20+
"dynamodb:GetResourcePolicy"
21+
],
22+
"Effect": "Allow",
23+
"Resource": "arn:aws:dynamodb:*:*:table/backgroundagent-dev-*",
24+
"Sid": "DynamoDB"
25+
},
26+
{
27+
"Action": [
28+
"lambda:CreateFunction",
29+
"lambda:DeleteFunction",
30+
"lambda:GetFunction",
31+
"lambda:GetFunctionConfiguration",
32+
"lambda:UpdateFunctionCode",
33+
"lambda:UpdateFunctionConfiguration",
34+
"lambda:AddPermission",
35+
"lambda:RemovePermission",
36+
"lambda:GetPolicy",
37+
"lambda:TagResource",
38+
"lambda:UntagResource",
39+
"lambda:ListTags",
40+
"lambda:PublishVersion",
41+
"lambda:CreateAlias",
42+
"lambda:DeleteAlias",
43+
"lambda:GetAlias",
44+
"lambda:UpdateAlias",
45+
"lambda:PutFunctionEventInvokeConfig",
46+
"lambda:DeleteFunctionEventInvokeConfig",
47+
"lambda:GetFunctionEventInvokeConfig",
48+
"lambda:PutFunctionConcurrency",
49+
"lambda:DeleteFunctionConcurrency",
50+
"lambda:GetFunctionCodeSigningConfig",
51+
"lambda:GetFunctionRecursionConfig",
52+
"lambda:GetProvisionedConcurrencyConfig",
53+
"lambda:GetRuntimeManagementConfig",
54+
"lambda:ListVersionsByFunction",
55+
"lambda:InvokeFunction"
56+
],
57+
"Effect": "Allow",
58+
"Resource": [
59+
"arn:aws:lambda:*:*:function:backgroundagent-dev-*",
60+
"arn:aws:lambda:*:*:function:backgroundagent-dev-AWS*"
61+
],
62+
"Sid": "Lambda"
63+
},
64+
{
65+
"Action": [
66+
"apigateway:POST",
67+
"apigateway:GET",
68+
"apigateway:PUT",
69+
"apigateway:PATCH",
70+
"apigateway:DELETE",
71+
"apigateway:TagResource",
72+
"apigateway:UntagResource",
73+
"apigateway:SetWebACL",
74+
"apigateway:UpdateRestApiPolicy"
75+
],
76+
"Effect": "Allow",
77+
"Resource": [
78+
"arn:aws:apigateway:*::/restapis",
79+
"arn:aws:apigateway:*::/restapis/*",
80+
"arn:aws:apigateway:*::/account",
81+
"arn:aws:apigateway:*::/tags/*"
82+
],
83+
"Sid": "APIGateway"
84+
},
85+
{
86+
"Action": [
87+
"cognito-idp:CreateUserPool",
88+
"cognito-idp:DeleteUserPool",
89+
"cognito-idp:DescribeUserPool",
90+
"cognito-idp:UpdateUserPool",
91+
"cognito-idp:CreateUserPoolClient",
92+
"cognito-idp:DeleteUserPoolClient",
93+
"cognito-idp:DescribeUserPoolClient",
94+
"cognito-idp:UpdateUserPoolClient",
95+
"cognito-idp:TagResource",
96+
"cognito-idp:UntagResource",
97+
"cognito-idp:ListTagsForResource",
98+
"cognito-idp:GetUserPoolMfaConfig"
99+
],
100+
"Effect": "Allow",
101+
"Resource": "arn:aws:cognito-idp:*:*:userpool/*",
102+
"Sid": "Cognito"
103+
},
104+
{
105+
"Action": [
106+
"wafv2:CreateWebACL",
107+
"wafv2:DeleteWebACL",
108+
"wafv2:GetWebACL",
109+
"wafv2:UpdateWebACL",
110+
"wafv2:AssociateWebACL",
111+
"wafv2:DisassociateWebACL",
112+
"wafv2:ListTagsForResource",
113+
"wafv2:TagResource",
114+
"wafv2:UntagResource",
115+
"wafv2:GetWebACLForResource"
116+
],
117+
"Effect": "Allow",
118+
"Resource": [
119+
"arn:aws:wafv2:*:*:regional/webacl/*",
120+
"arn:aws:wafv2:*:*:regional/managedruleset/*"
121+
],
122+
"Sid": "WAFv2"
123+
},
124+
{
125+
"Action": [
126+
"events:PutRule",
127+
"events:DeleteRule",
128+
"events:DescribeRule",
129+
"events:PutTargets",
130+
"events:RemoveTargets",
131+
"events:ListTargetsByRule",
132+
"events:TagResource",
133+
"events:UntagResource",
134+
"events:ListTagsForResource"
135+
],
136+
"Effect": "Allow",
137+
"Resource": "arn:aws:events:*:*:rule/backgroundagent-dev-*",
138+
"Sid": "EventBridge"
139+
},
140+
{
141+
"Action": [
142+
"secretsmanager:CreateSecret",
143+
"secretsmanager:DeleteSecret",
144+
"secretsmanager:DescribeSecret",
145+
"secretsmanager:GetSecretValue",
146+
"secretsmanager:PutSecretValue",
147+
"secretsmanager:UpdateSecret",
148+
"secretsmanager:TagResource",
149+
"secretsmanager:UntagResource",
150+
"secretsmanager:GetResourcePolicy",
151+
"secretsmanager:PutResourcePolicy",
152+
"secretsmanager:DeleteResourcePolicy"
153+
],
154+
"Effect": "Allow",
155+
"Resource": [
156+
"arn:aws:secretsmanager:*:*:secret:backgroundagent-*",
157+
"arn:aws:secretsmanager:*:*:secret:GitHubTokenSecret*"
158+
],
159+
"Sid": "SecretsManager"
160+
},
161+
{
162+
"Action": "secretsmanager:GetRandomPassword",
163+
"Effect": "Allow",
164+
"Resource": "*",
165+
"Sid": "SecretsManagerAccountLevel"
166+
}
167+
],
168+
"Version": "2012-10-17"
169+
}

‎cdk/bootstrap/policies/infrastructure.json‎

Lines changed: 177 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,177 @@
1+
{
2+
"Statement": [
3+
{
4+
"Action": [
5+
"cloudformation:CreateStack",
6+
"cloudformation:UpdateStack",
7+
"cloudformation:DeleteStack",
8+
"cloudformation:DescribeStacks",
9+
"cloudformation:DescribeStackEvents",
10+
"cloudformation:DescribeStackResources",
11+
"cloudformation:GetTemplate",
12+
"cloudformation:GetTemplateSummary",
13+
"cloudformation:ListStackResources",
14+
"cloudformation:CreateChangeSet",
15+
"cloudformation:DeleteChangeSet",
16+
"cloudformation:DescribeChangeSet",
17+
"cloudformation:ExecuteChangeSet",
18+
"cloudformation:SetStackPolicy",
19+
"cloudformation:ValidateTemplate",
20+
"cloudformation:ListChangeSets"
21+
],
22+
"Effect": "Allow",
23+
"Resource": [
24+
"arn:aws:cloudformation:*:*:stack/backgroundagent-dev/*",
25+
"arn:aws:cloudformation:*:*:stack/CDKToolkit/*"
26+
],
27+
"Sid": "CloudFormationSelf"
28+
},
29+
{
30+
"Action": [
31+
"iam:CreateRole",
32+
"iam:DeleteRole",
33+
"iam:GetRole",
34+
"iam:UpdateRole",
35+
"iam:TagRole",
36+
"iam:UntagRole",
37+
"iam:ListRoleTags",
38+
"iam:AttachRolePolicy",
39+
"iam:DetachRolePolicy",
40+
"iam:PutRolePolicy",
41+
"iam:DeleteRolePolicy",
42+
"iam:GetRolePolicy",
43+
"iam:ListRolePolicies",
44+
"iam:ListAttachedRolePolicies",
45+
"iam:CreatePolicy",
46+
"iam:DeletePolicy",
47+
"iam:GetPolicy",
48+
"iam:GetPolicyVersion",
49+
"iam:CreatePolicyVersion",
50+
"iam:DeletePolicyVersion",
51+
"iam:ListPolicyVersions",
52+
"iam:TagPolicy",
53+
"iam:CreateServiceLinkedRole",
54+
"iam:ListInstanceProfilesForRole"
55+
],
56+
"Effect": "Allow",
57+
"Resource": [
58+
"arn:aws:iam::*:role/backgroundagent-dev-*",
59+
"arn:aws:iam::*:policy/backgroundagent-dev-*",
60+
"arn:aws:iam::*:role/aws-service-role/*"
61+
],
62+
"Sid": "IAMRolesAndPolicies"
63+
},
64+
{
65+
"Action": "iam:PassRole",
66+
"Condition": {
67+
"StringEquals": {
68+
"iam:PassedToService": [
69+
"lambda.amazonaws.com",
70+
"ecs-tasks.amazonaws.com",
71+
"ecs.amazonaws.com",
72+
"apigateway.amazonaws.com",
73+
"logs.amazonaws.com",
74+
"bedrock.amazonaws.com",
75+
"bedrock-agentcore.amazonaws.com",
76+
"events.amazonaws.com",
77+
"vpc-flow-logs.amazonaws.com"
78+
]
79+
}
80+
},
81+
"Effect": "Allow",
82+
"Resource": "arn:aws:iam::*:role/backgroundagent-dev-*",
83+
"Sid": "IAMPassRole"
84+
},
85+
{
86+
"Action": [
87+
"ec2:CreateVpc",
88+
"ec2:DeleteVpc",
89+
"ec2:DescribeVpcs",
90+
"ec2:ModifyVpcAttribute",
91+
"ec2:CreateSubnet",
92+
"ec2:DeleteSubnet",
93+
"ec2:DescribeSubnets",
94+
"ec2:CreateInternetGateway",
95+
"ec2:DeleteInternetGateway",
96+
"ec2:AttachInternetGateway",
97+
"ec2:DetachInternetGateway",
98+
"ec2:DescribeInternetGateways",
99+
"ec2:AllocateAddress",
100+
"ec2:ReleaseAddress",
101+
"ec2:DescribeAddresses",
102+
"ec2:CreateNatGateway",
103+
"ec2:DeleteNatGateway",
104+
"ec2:DescribeNatGateways",
105+
"ec2:CreateRouteTable",
106+
"ec2:DeleteRouteTable",
107+
"ec2:DescribeRouteTables",
108+
"ec2:AssociateRouteTable",
109+
"ec2:DisassociateRouteTable",
110+
"ec2:CreateRoute",
111+
"ec2:DeleteRoute",
112+
"ec2:CreateSecurityGroup",
113+
"ec2:DeleteSecurityGroup",
114+
"ec2:DescribeSecurityGroups",
115+
"ec2:AuthorizeSecurityGroupEgress",
116+
"ec2:RevokeSecurityGroupEgress",
117+
"ec2:AuthorizeSecurityGroupIngress",
118+
"ec2:RevokeSecurityGroupIngress",
119+
"ec2:CreateVpcEndpoint",
120+
"ec2:DeleteVpcEndpoints",
121+
"ec2:DescribeVpcEndpoints",
122+
"ec2:ModifyVpcEndpoint",
123+
"ec2:CreateFlowLogs",
124+
"ec2:DeleteFlowLogs",
125+
"ec2:DescribeFlowLogs",
126+
"ec2:CreateTags",
127+
"ec2:DeleteTags",
128+
"ec2:DescribeTags",
129+
"ec2:DescribeAvailabilityZones",
130+
"ec2:DescribeNetworkInterfaces",
131+
"ec2:DescribePrefixLists",
132+
"ec2:DescribeNetworkAcls",
133+
"ec2:DescribeVpcAttribute",
134+
"ec2:ModifySubnetAttribute"
135+
],
136+
"Effect": "Allow",
137+
"Resource": "*",
138+
"Sid": "VPCNetworking"
139+
},
140+
{
141+
"Action": [
142+
"route53resolver:CreateFirewallRuleGroup",
143+
"route53resolver:DeleteFirewallRuleGroup",
144+
"route53resolver:GetFirewallRuleGroup",
145+
"route53resolver:CreateFirewallRule",
146+
"route53resolver:DeleteFirewallRule",
147+
"route53resolver:ListFirewallRules",
148+
"route53resolver:UpdateFirewallRule",
149+
"route53resolver:CreateFirewallDomainList",
150+
"route53resolver:DeleteFirewallDomainList",
151+
"route53resolver:GetFirewallDomainList",
152+
"route53resolver:UpdateFirewallDomains",
153+
"route53resolver:AssociateFirewallRuleGroup",
154+
"route53resolver:DisassociateFirewallRuleGroup",
155+
"route53resolver:GetFirewallRuleGroupAssociation",
156+
"route53resolver:ListFirewallRuleGroupAssociations",
157+
"route53resolver:UpdateFirewallConfig",
158+
"route53resolver:GetFirewallConfig",
159+
"route53resolver:TagResource",
160+
"route53resolver:UntagResource",
161+
"route53resolver:ListTagsForResource",
162+
"route53resolver:CreateResolverQueryLogConfig",
163+
"route53resolver:DeleteResolverQueryLogConfig",
164+
"route53resolver:GetResolverQueryLogConfig",
165+
"route53resolver:AssociateResolverQueryLogConfig",
166+
"route53resolver:DisassociateResolverQueryLogConfig",
167+
"route53resolver:GetResolverQueryLogConfigAssociation",
168+
"route53resolver:ListResolverQueryLogConfigAssociations",
169+
"route53resolver:ListResolverQueryLogConfigs"
170+
],
171+
"Effect": "Allow",
172+
"Resource": "*",
173+
"Sid": "Route53ResolverDNSFirewall"
174+
}
175+
],
176+
"Version": "2012-10-17"
177+
}

0 commit comments

Comments
 (0)