# yaml-language-server: $schema=../../../schemas/@aws-mdaa/roles.json
# Generated policy definitions
generatePolicies:
  # =============================================================================
  # BEDROCK RAG POLICY
  # =============================================================================
  # This policy grants permissions for the Bedrock RAG Lambda to invoke models.
  #
  # CROSS-REGION INFERENCE PROFILE SUPPORT:
  # When using US-based cross-region inference profiles (e.g., us.anthropic.claude-sonnet-4-5-*),
  # you need permissions for:
  # 1. The inference profile itself (bedrock:GetInferenceProfile)
  # 2. InvokeModel on the inference profile ARN
  # 3. InvokeModel on foundation models in ALL destination regions
  #
  # For US inference profiles, destination regions typically include:
  #   us-east-1, us-east-2, us-west-2
  #
  # See: https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-prereq.html
  # =============================================================================
  BedrockRagPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "Cross-region inference profiles require bedrock:* region wildcards to route requests across US regions. Foundation model ARNs use wildcards scoped to Anthropic models only. Marketplace permissions require Resource:* but are constrained by ProductId conditions and CalledViaLast:bedrock.amazonaws.com."
    policyDocument:
      Statement:
        # -----------------------------------------------------------------------
        # Inference Profile Access
        # -----------------------------------------------------------------------
        # Required to retrieve inference profile details (destination regions, etc.)
        - SID: BedrockInferenceProfileAccess
          Effect: Allow
          Action:
            - bedrock:GetInferenceProfile
          Resource:
            # US-based inference profiles in your account
            - "arn:{{partition}}:bedrock:*:{{account}}:inference-profile/us.*"
        
        # -----------------------------------------------------------------------
        # Model Invocation - Inference Profile
        # -----------------------------------------------------------------------
        # Allows invoking models through the inference profile
        - SID: BedrockInvokeViaInferenceProfile
          Effect: Allow
          Action:
            - bedrock:InvokeModel
            - bedrock:InvokeModelWithResponseStream
          Resource:
            # The configured inference model (profile or direct model ARN)
            - "{{context:inference_model_arn}}"
            # US-based inference profiles for Claude models
            - "arn:{{partition}}:bedrock:*:{{account}}:inference-profile/us.anthropic.*"
        
        # -----------------------------------------------------------------------
        # Model Invocation - Foundation Models (Cross-Region)
        # -----------------------------------------------------------------------
        # When using inference profiles, Bedrock routes requests to foundation models
        # in destination regions. You need InvokeModel permission on those models.
        #
        # IMPORTANT: Destination regions depend on your SOURCE region!
        # For US inference profiles called from ca-central-1:
        #   Destinations: ca-central-1, us-east-1, us-east-2, us-west-2
        # For US inference profiles called from US regions:
        #   Destinations: us-east-1, us-east-2, us-west-2
        #
        # See: https://docs.aws.amazon.com/bedrock/latest/userguide/inference-profiles-support.html
        - SID: BedrockInvokeFoundationModels
          Effect: Allow
          Action:
            - bedrock:InvokeModel
            - bedrock:InvokeModelWithResponseStream
          Resource:
            # Anthropic Claude models in destination regions for US inference profiles
            # Add your source region here if deploying outside US (e.g., ca-central-1)
            # - "arn:{{partition}}:bedrock:ca-central-1::foundation-model/anthropic.*"
            - "arn:{{partition}}:bedrock:us-east-1::foundation-model/anthropic.*"
            - "arn:{{partition}}:bedrock:us-east-2::foundation-model/anthropic.*"
            - "arn:{{partition}}:bedrock:us-west-2::foundation-model/anthropic.*"
        
        # -----------------------------------------------------------------------
        # AWS Marketplace Access
        # -----------------------------------------------------------------------
        - SID: BedrockMarketplaceAccess
          Effect: Allow
          Action:
            - aws-marketplace:ViewSubscriptions
            - aws-marketplace:Subscribe
          Resource: "*"
          Condition:
            ForAllValues:StringEquals:
              aws-marketplace:ProductId:
                - "1d288c71-65f9-489a-a3e2-9c7f4f6e6a85"
                - "cc0bdd50-279a-40d8-829c-4009b77a1fcc"
                - "prod-dr2vpvd4k73aq"
                - "prod-evcp4w4lurj26"
                - "prod-ggrzjm65qmjhm"
                - "c468b48a-84df-43a4-8c46-8870630108a7"
                - "b0eb9475-3a2c-43d1-94d3-56756fd43737"
                - "prod-6dw3qvchef7zy"
                - "prod-m5ilt4siql27k"
                - "prod-cx7ovbu5wex7g"
                - "prod-4dlfvry4v5hbi"
                - "prod-mxcfnwvpd6kb4"
                - "prod-xdkflymybwmvi"
                - "prod-4pmewlybdftbs"
                - "prod-ozonys2hmmpeu"
                - "prod-5oba7y7jpji56"
                - "prod-fm3feywmwerog"
                - "prod-azycxvnd5mhqi"
                - "prod-w3q2d6rfge4tw"
                - "prod-jhuafngbly644"
                - "a61c46fe-1747-41aa-9af0-2e0ae8a9ce05"
                - "216b69fd-07d5-4c7b-866b-936456d68311"
                - "prod-tukx4z3hrewle"
                - "prod-nb4wqmplze2pm"
                - "b7568428-a1ab-46d8-bab3-37def50f6f6a"
                - "38e55671-c3fe-4a44-9783-3584906e7cad"
                - "prod-2o5bej62oxkbi"
                - "prod-ft3cj5gst3spo"
                - "prod-eacdrmv7zfc5e"
                - "prod-cqfmszl26sxu4"
                - "prod-7boen2z2wnxrg"
                - "prodview-ajc3gw4mjy7my"
                - "prod-o6xchhpirymvs"
                - "prod-635pcy5x5pc2a"
                - "prod-azehe4da4pzsy"
                - "prod-23enyy63orhuk"
            StringEquals:
              aws:CalledViaLast: "bedrock.amazonaws.com"

  # Data admin policy for S3 and KMS operations
  DataAdminPolicy:
    # TODO: Review the below policyDocument permissions and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM5"
    #     reason: "s3:ListAllMyBuckets, s3:GetAccountPublicAccessBlock, s3:ListAccessPoints, and kms:ListAliases are account-level actions that do not support resource-level permissions."
    policyDocument:
      Statement:
        # Basic S3 access for listing and bucket operations
        - Sid: BasicS3Access
          Effect: Allow
          Action:
            - s3:ListAllMyBuckets
            - s3:GetAccountPublicAccessBlock
            - s3:GetBucketPublicAccessBlock
            - s3:GetBucketPolicyStatus
            - s3:GetBucketAcl
            - s3:ListAccessPoints
            - s3:GetBucketLocation
          Resource: "*"
        
        # Basic KMS access for key management
        - Sid: BasicKMSAccess
          Effect: Allow
          Action:
            - kms:ListAliases
          Resource: "*"
    
# Generated role definitions
generateRoles:
  # Bedrock Knowledge Base service role
  bedrock-knowledgebase:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "Bedrock Knowledge Base service role requires AWS-managed permissions for OpenSearch Serverless collection access and S3 data source ingestion. See https://docs.aws.amazon.com/bedrock/latest/userguide/kb-permissions.html"
    trustedPrincipal: service:bedrock.amazonaws.com

  # Bedrock RAG data source Lambda role
  bedrock-rag-datasource:
    # TODO: Review the below awsManagedPolicies and suppression. Uncomment the suppression prior to deployment.
    # suppressions:
    #   - id: "AwsSolutions-IAM4"
    #     reason: "AWSLambdaVPCAccessExecutionRole provides ENI management permissions (ec2:CreateNetworkInterface, ec2:DescribeNetworkInterfaces, ec2:DeleteNetworkInterface) required for Lambda functions deployed in a VPC. See https://docs.aws.amazon.com/lambda/latest/dg/configuration-vpc.html"
    trustedPrincipal: service:lambda.amazonaws.com
    generatedPolicies:
      - BedrockRagPolicy
    # Required for Lambda functions deployed in VPC
    awsManagedPolicies:
      - service-role/AWSLambdaVPCAccessExecutionRole

  # Data administrator role
  data-admin:
    trustedPrincipal: this_account
    generatedPolicies:
      - DataAdminPolicy

  # Data user role for read-only access
  data-user:
    trustedPrincipal: this_account