# yaml-language-server: $schema=../../schemas/@aws-mdaa/roles.json
generatePolicies:
  DataAdminPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "S3 account-level actions (ListAllMyBuckets, GetAccountPublicAccessBlock) and kms:ListAliases do not support resource-level permissions and require resource: '*'. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html"
    policyDocument:
      Statement:
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
            - s3:GetBucketLocation
          Resource: "*"

        # Allows basic listing of KMS keys (required for up)
        - Sid: BasicKMSAccess
          Effect: Allow
          Action:
            - kms:ListAliases
          Resource: "*"

  DataUserPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "S3 actions use org-prefixed wildcard ({{org}}-*) to scope access to organization buckets only. KMS key/* wildcard is required because key IDs are generated at deployment time. S3 account-level actions require resource: '*'. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazons3.html"
    policyDocument:
      Statement:
        # Basic S3 account-level permissions
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
          Resource: "*"

        # S3 bucket read and write permissions
        - Sid: S3BucketReadWriteAccess
          Effect: Allow
          Action:
            - s3:GetObject
            - s3:GetObjectVersion
            - s3:PutObject
            - s3:PutObjectAcl
            - s3:DeleteObject
            - s3:DeleteObjectVersion
            - s3:ListBucket
            - s3:ListBucketVersions
            - s3:GetBucketLocation
            - s3:GetBucketVersioning
          Resource:
            - "arn:{{partition}}:s3:::{{org}}-*"
            - "arn:{{partition}}:s3:::{{org}}-*/*"

        # KMS permissions for encrypted buckets
        - Sid: KMSBucketAccess
          Effect: Allow
          Action:
            - kms:Decrypt
            - kms:GenerateDataKey
            - kms:DescribeKey
            - kms:ListAliases
          Resource:
            - "arn:{{partition}}:kms:{{region}}:{{account}}:key/*"

        # Basic KMS listing permissions
        - Sid: BasicKMSAccess
          Effect: Allow
          Action:
            - kms:ListAliases
          Resource: "*"

  BedrockAdminPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Bedrock agent/*, knowledge-base/*, and guardrail/* use wildcard suffixes because resource IDs are generated at deployment time. Foundation model resource uses region wildcard (bedrock:*::foundation-model/*) to support cross-region inference profiles. EC2 Describe* and S3 bucket-level actions do not support resource-level permissions. IAM role/* is required because CDK-generated role names are not known at authoring time. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonbedrock.html"
    policyDocument:
      Statement:
        - SID: BedrockAgentAccess
          Effect: Allow
          Action:
            - "bedrock:CreateAgent"
            - "bedrock:DeleteAgent"
            - "bedrock:GetAgent"
            - "bedrock:ListAgents"
            - "bedrock:UpdateAgent"
            - "bedrock:CreateAgentAlias"
            - "bedrock:DeleteAgentAlias"
            - "bedrock:GetAgentAlias"
            - "bedrock:ListAgentAliases"
            - "bedrock:UpdateAgentAlias"
            - "bedrock:CreateAgentActionGroup"
            - "bedrock:DeleteAgentActionGroup"
            - "bedrock:GetAgentActionGroup"
            - "bedrock:ListAgentActionGroups"
            - "bedrock:UpdateAgentActionGroup"
            - "bedrock:PrepareAgent"
            - "bedrock:AssociateAgentKnowledgeBase"
            - "bedrock:DisassociateAgentKnowledgeBase"
            - "bedrock:ListAgentKnowledgeBases"
            - "bedrock:InvokeAgent"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:agent/*"
        
        # Bedrock Knowledge Base permissions
        - SID: BedrockKnowledgeBaseAccess
          Effect: Allow
          Action:
            - "bedrock:CreateKnowledgeBase"
            - "bedrock:DeleteKnowledgeBase"
            - "bedrock:GetKnowledgeBase"
            - "bedrock:ListKnowledgeBases"
            - "bedrock:UpdateKnowledgeBase"
            - "bedrock:CreateDataSource"
            - "bedrock:DeleteDataSource"
            - "bedrock:GetDataSource"
            - "bedrock:ListDataSources"
            - "bedrock:UpdateDataSource"
            - "bedrock:StartIngestionJob"
            - "bedrock:GetIngestionJob"
            - "bedrock:ListIngestionJobs"
            - "bedrock:StopIngestionJob"
            - "bedrock:RetrieveAndGenerate"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:knowledge-base/*"
        
        # Bedrock Guardrail permissions
        - SID: BedrockGuardrailAccess
          Effect: Allow
          Action:
            - "bedrock:CreateGuardrail"
            - "bedrock:DeleteGuardrail"
            - "bedrock:GetGuardrail"
            - "bedrock:ListGuardrails"
            - "bedrock:UpdateGuardrail"
            - "bedrock:CreateGuardrailVersion"
            - "bedrock:GetGuardrailVersion"
            - "bedrock:ListGuardrailVersions"
            - "bedrock:ApplyGuardrail"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:guardrail/*"
        
        # Bedrock Foundation Model permissions
        - SID: BedrockModelAccess
          Effect: Allow
          Action:
            - "bedrock:InvokeModel"
            - "bedrock:InvokeModelWithResponseStream"
            - "bedrock:GetFoundationModel"
            - "bedrock:ListFoundationModels"
          Resource:
            - "arn:{{partition}}:bedrock:*::foundation-model/*"
        
        # Lambda permissions for action groups
        - SID: LambdaAccess
          Effect: Allow
          Action:
            - "lambda:CreateFunction"
            - "lambda:DeleteFunction"
            - "lambda:GetFunction"
            - "lambda:UpdateFunctionCode"
            - "lambda:UpdateFunctionConfiguration"
            - "lambda:AddPermission"
            - "lambda:RemovePermission"
            - "lambda:InvokeFunction"
            - "lambda:ListFunctions"
            - "lambda:PublishLayerVersion"
            - "lambda:GetLayerVersion"
            - "lambda:DeleteLayerVersion"
            - "lambda:ListLayerVersions"
          Resource:
            - "arn:{{partition}}:lambda:{{region}}:{{account}}:function:*"
            - "arn:{{partition}}:lambda:{{region}}:{{account}}:layer:*"
        
        # S3 permissions for knowledge bases
        - SID: S3Access
          Effect: Allow
          Action:
            - "s3:CreateBucket"
            - "s3:DeleteBucket"
            - "s3:GetBucketLocation"
            - "s3:GetBucketPolicy"
            - "s3:PutBucketPolicy"
            - "s3:GetObject"
            - "s3:PutObject"
            - "s3:DeleteObject"
            - "s3:ListBucket"
          Resource:
            - "arn:{{partition}}:s3:::*"
        
        # IAM permissions for roles
        - SID: IAMAccess
          Effect: Allow
          Action:
            - "iam:CreateRole"
            - "iam:DeleteRole"
            - "iam:GetRole"
            - "iam:PassRole"
            - "iam:PutRolePolicy"
            - "iam:GetRolePolicy"
            - "iam:DeleteRolePolicy"
            - "iam:AttachRolePolicy"
            - "iam:DetachRolePolicy"
          Resource:
            - "arn:{{partition}}:iam::{{account}}:role/*"
        
        # KMS permissions for encryption
        - SID: KMSAccess
          Effect: Allow
          Action:
            - "kms:CreateKey"
            - "kms:DescribeKey"
            - "kms:EnableKey"
            - "kms:DisableKey"
            - "kms:ScheduleKeyDeletion"
            - "kms:CancelKeyDeletion"
            - "kms:GenerateDataKey"
            - "kms:Encrypt"
            - "kms:Decrypt"
            - "kms:ReEncrypt*"
            - "kms:CreateAlias"
            - "kms:DeleteAlias"
            - "kms:ListAliases"
            - "kms:PutKeyPolicy"
            - "kms:GetKeyPolicy"
          Resource:
            - "arn:{{partition}}:kms:{{region}}:{{account}}:key/*"
        
        # RDS permissions for vector stores
        - SID: RDSAccess
          Effect: Allow
          Action:
            - "rds:CreateDBCluster"
            - "rds:DeleteDBCluster"
            - "rds:DescribeDBClusters"
            - "rds:ModifyDBCluster"
            - "rds:CreateDBInstance"
            - "rds:DeleteDBInstance"
            - "rds:DescribeDBInstances"
            - "rds:ModifyDBInstance"
            - "rds:CreateDBSubnetGroup"
            - "rds:DeleteDBSubnetGroup"
            - "rds:DescribeDBSubnetGroups"
          Resource:
            - "arn:{{partition}}:rds:{{region}}:{{account}}:cluster:*"
            - "arn:{{partition}}:rds:{{region}}:{{account}}:db:*"
            - "arn:{{partition}}:rds:{{region}}:{{account}}:subgrp:*"
        
        # CloudWatch Logs permissions
        - SID: CloudWatchLogsAccess
          Effect: Allow
          Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
            - "logs:DescribeLogGroups"
            - "logs:DescribeLogStreams"
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:*"
        
        # EC2 permissions for networking
        - SID: EC2Access
          Effect: Allow
          Action:
            - "ec2:CreateSecurityGroup"
            - "ec2:DeleteSecurityGroup"
            - "ec2:DescribeSecurityGroups"
            - "ec2:AuthorizeSecurityGroupIngress"
            - "ec2:AuthorizeSecurityGroupEgress"
            - "ec2:RevokeSecurityGroupIngress"
            - "ec2:RevokeSecurityGroupEgress"
            - "ec2:DescribeSubnets"
            - "ec2:DescribeVpcs"
          Resource: "*"

  BedrockAgentExecutionPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Bedrock InvokeModel and InvokeModelWithResponseStream use region wildcard (bedrock:*::foundation-model/*) to support cross-region inference profiles. Lambda function:* wildcard is required because action group function names are generated at deployment time. Knowledge-base/* wildcard is needed because KB IDs are dynamic. S3 uses org-prefixed wildcard ({{org}}-*) to limit scope. KMS key/* is required because key IDs are generated at deployment time."
    policyDocument:
      Statement:
        # Bedrock Foundation Model permissions
        - SID: BedrockModelAccess
          Effect: Allow
          Action:
            - "bedrock:InvokeModel"
            - "bedrock:InvokeModelWithResponseStream"
          Resource:
            - "arn:{{partition}}:bedrock:*::foundation-model/*"

        # Lambda permissions for action groups
        - SID: LambdaAccess
          Effect: Allow
          Action:
            - "lambda:InvokeFunction"
          Resource:
            - "arn:{{partition}}:lambda:{{region}}:{{account}}:function:*"
        
        # Knowledge Base permissions
        - SID: KnowledgeBaseAccess
          Effect: Allow
          Action:
            - "bedrock:RetrieveAndGenerate"
            - "bedrock:Retrieve"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:knowledge-base/*"
        
        # S3 permissions for knowledge bases
        - SID: S3Access
          Effect: Allow
          Action:
            - "s3:GetObject"
            - "s3:ListBucket"
          Resource:
            - "arn:{{partition}}:s3:::{{org}}-*/*"
            - "arn:{{partition}}:s3:::{{org}}-*"
        
        # CloudWatch Logs permissions
        - SID: CloudWatchLogsAccess
          Effect: Allow
          Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/bedrock/*"
        
        # Guardrail permissions
        - SID: GuardrailAccess
          Effect: Allow
          Action:
            - "bedrock:ApplyGuardrail"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:guardrail/enterprise-guardrail"
        
        # KMS permissions
        - SID: KMSAccess
          Effect: Allow
          Action:
            - "kms:Decrypt"
            - "kms:GenerateDataKey"
          Resource:
            - "arn:{{partition}}:kms:{{region}}:{{account}}:key/*"

  KnowledgeBaseExecutionPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "S3 uses org-prefixed wildcard ({{org}}-*) to scope access to organization buckets. Lambda function:* is required because custom transformer function names are generated at deployment time. Foundation model uses region wildcard for cross-region inference. InvokeDataAutomationAsync and GetDataAutomationStatus do not support resource-level permissions and require resource: '*'. KMS key/* is required because key IDs are dynamic. See https://docs.aws.amazon.com/bedrock/latest/userguide/kb-permissions.html"
    policyDocument:
      Statement:
        # S3 permissions for knowledge bases
        - SID: S3Access
          Effect: Allow
          Action:
            - "s3:GetObject"
            - "s3:ListBucket"
            - "s3:PutObject"
          Resource:
            - "arn:{{partition}}:s3:::{{org}}-*/*"
            - "arn:{{partition}}:s3:::{{org}}-*"
        
        # CloudWatch Logs permissions
        - SID: CloudWatchLogsAccess
          Effect: Allow
          Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/bedrock/*"
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/lambda/*"
        
        # Lambda permissions for custom transformers
        - SID: LambdaAccess
          Effect: Allow
          Action:
            - "lambda:InvokeFunction"
          Resource:
            - "arn:{{partition}}:lambda:{{region}}:{{account}}:function:*"
        
        # Bedrock Foundation Model permissions for parsing
        - SID: BedrockModelAccess
          Effect: Allow
          Action:
            - "bedrock:InvokeModel"
          Resource:
            - "arn:{{partition}}:bedrock:*::foundation-model/*"

        # Bedrock Data Automation permissions for parsing
        - SID: BedrockDataAutomationAccess
          Effect: Allow
          Action:
            - "bedrock:InvokeDataAutomationAsync"
            - "bedrock:GetDataAutomationStatus"
          Resource: "*"
        
        # Bedrock Knowledge Base ingestion permissions
        - SID: BedrockIngestionAccess
          Effect: Allow
          Action:
            - "bedrock:StartIngestionJob"
            - "bedrock:GetIngestionJob"
            - "bedrock:ListIngestionJobs"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:knowledge-base/*"
        
        # KMS permissions
        - SID: KMSAccess
          Effect: Allow
          Action:
            - "kms:Decrypt"
            - "kms:GenerateDataKey"
          Resource:
            - "arn:{{partition}}:kms:{{region}}:{{account}}:key/*"

  AgentLambdaExecutionPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "CloudWatch Logs log-group:/aws/lambda/* wildcard is required because Lambda function log group names are generated at deployment time. S3 uses org-prefixed wildcard ({{org}}-*) to scope to organization buckets. KMS key/* is required because key IDs are generated at deployment time."
    policyDocument:
      Statement:
        # CloudWatch Logs permissions
        - SID: CloudWatchLogsAccess
          Effect: Allow
          Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/lambda/*"
        
        # S3 permissions for accessing documents
        - SID: S3Access
          Effect: Allow
          Action:
            - "s3:GetObject"
            - "s3:PutObject"
            - "s3:ListBucket"
          Resource:
            - "arn:{{partition}}:s3:::{{org}}-*/*"
            - "arn:{{partition}}:s3:::{{org}}-*"
        
        # KMS permissions
        - SID: KMSAccess
          Effect: Allow
          Action:
            - "kms:Decrypt"
            - "kms:GenerateDataKey"
          Resource:
            - "arn:{{partition}}:kms:{{region}}:{{account}}:key/*"

  KnowledgeBaseSyncLambdaExecutionPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "CloudWatch Logs log-group:/aws/lambda/* wildcard is required because Lambda log group names are generated at deployment time. SQS uses org-prefixed wildcard ({{org}}-*) to scope to organization queues. Knowledge-base/* wildcard is needed because KB IDs are dynamic. KMS key/* is constrained by kms:ViaService condition to S3 operations only. cloudwatch:PutMetricData does not support resource-level permissions and requires resource: '*'. See https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazoncloudwatch.html"
    policyDocument:
      Statement:
        # CloudWatch Logs permissions
        - SID: CloudWatchLogsAccess
          Effect: Allow
          Action:
            - "logs:CreateLogGroup"
            - "logs:CreateLogStream"
            - "logs:PutLogEvents"
          Resource:
            - "arn:{{partition}}:logs:{{region}}:{{account}}:log-group:/aws/lambda/*"
        
        - SID: SQSAccess
          Effect: Allow
          Action:
            - "sqs:ReceiveMessage"
            - "sqs:DeleteMessage"
            - "sqs:GetQueueAttributes"
            - "sqs:SendMessage"
          Resource:
            - "arn:{{partition}}:sqs:{{region}}:{{account}}:{{org}}-*"
        
        - SID: BedrockIngestionAccess
          Effect: Allow
          Action:
            - "bedrock:StartIngestionJob"
            - "bedrock:GetIngestionJob"
            - "bedrock:ListIngestionJobs"
            - "bedrock:DeleteDataSource"
            - "bedrock:GetDataSource"
            - "bedrock:ListDataSources"
          Resource:
            - "arn:{{partition}}:bedrock:{{region}}:{{account}}:knowledge-base/*"
        
        - SID: KMSAccess
          Effect: Allow
          Action:
            - "kms:Decrypt"
            - "kms:GenerateDataKey"
          Resource:
            - "arn:{{partition}}:kms:{{region}}:{{account}}:key/*"
          Condition:
            StringLike:
              "kms:ViaService": "s3.{{region}}.amazonaws.com"
        
        - SID: CloudWatchMetricsAccess
          Effect: Allow
          Action:
            - "cloudwatch:PutMetricData"
          Resource: "*"

# The list of roles which will be generated
generateRoles:
  # Data Admin role with permissions for Bedrock Builder resources
  data-admin:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AmazonBedrockFullAccess is required for Bedrock agents to invoke models, manage knowledge bases, and access guardrails. See https://docs.aws.amazon.com/bedrock/latest/userguide/security-iam-awsmanpol.html"
    trustedPrincipal: this_account
    awsManagedPolicies:
      - "AmazonBedrockFullAccess"
    generatedPolicies:
      - BedrockAdminPolicy
      - DataAdminPolicy
      - DataUserPolicy
  
  data-user:
    trustedPrincipal: this_account
    generatedPolicies:
      - DataUserPolicy

  # Bedrock Agent Execution Role
  agent-execution-role:
    trustedPrincipal: service:bedrock.amazonaws.com
    generatedPolicies:
      - BedrockAgentExecutionPolicy

  # Knowledge Base Execution Role
  kb-execution-role:
    trustedPrincipal: service:bedrock.amazonaws.com
    additionalTrustedPrincipals:
      - trustedPrincipal: service:lambda.amazonaws.com
    generatedPolicies:
      - KnowledgeBaseExecutionPolicy

  # Lambda Execution Role for Agent Action Groups
  agent-lambda-role:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaBasicExecutionRole grants CloudWatch Logs permissions (CreateLogGroup, CreateLogStream, PutLogEvents) required for Lambda function logging. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    trustedPrincipal: service:lambda.amazonaws.com
    awsManagedPolicies:
      - "service-role/AWSLambdaBasicExecutionRole"
    generatedPolicies:
      - AgentLambdaExecutionPolicy

  # Lambda Execution Role for Knowledge Base Sync Functions
  kb-sync-lambda-role-support-docs:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaBasicExecutionRole grants CloudWatch Logs permissions (CreateLogGroup, CreateLogStream, PutLogEvents) required for Lambda function logging. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    trustedPrincipal: service:lambda.amazonaws.com
    awsManagedPolicies:
      - "service-role/AWSLambdaBasicExecutionRole"
    generatedPolicies:
      - KnowledgeBaseSyncLambdaExecutionPolicy

  kb-sync-lambda-role-product-docs:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaBasicExecutionRole grants CloudWatch Logs permissions (CreateLogGroup, CreateLogStream, PutLogEvents) required for Lambda function logging. See https://docs.aws.amazon.com/lambda/latest/dg/lambda-intro-execution-role.html"
    trustedPrincipal: service:lambda.amazonaws.com
    awsManagedPolicies:
      - "service-role/AWSLambdaBasicExecutionRole"
    generatedPolicies:
      - KnowledgeBaseSyncLambdaExecutionPolicy