out.yml

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Full LLM Stack
Resources:
  MyLambdaFunction2:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.8
      CodeUri: s3://test-stack-saurabh/b72de5ad6621d12a4efcd2be2665cadc
      Description: lambda for solutions
      Timeout: 500
      MemorySize: 256
      Role:
        Fn::GetAtt:
        - LambdaExecutionRole2
        - Arn
      Policies:
      - AWSLambdaBasicExecutionRole
      - AWSLambda_ReadOnlyAccess
      - AWSXrayWriteOnlyAccess
      Tracing: Active
      Layers:
      - Ref: libs
      Environment:
        Variables:
          AWS_CLOUDFORMATION_STACK_NAME:
            Ref: AWS::StackName
          SECRET_NAME: llmapp
  libs:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: blank-python-lib
      Description: Dependencies for the blank-python sample app.
      ContentUri: s3://test-stack-saurabh/70003972250b13136dac4719e40f973d
      CompatibleRuntimes:
      - python3.8
  LambdaExecutionRole2:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
      - PolicyName: BedrockAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - bedrock:*
            Resource: '*'
      - PolicyName: KendraAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - kendra:*
            Resource: '*'
      - PolicyName: S3Access
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - s3:PutObject
            - s3:GetObject
            - s3:ListBucket
            Resource:
            - arn:aws:s3:::*
            - arn:aws:s3:::*/*
      - PolicyName: SecurityHubAccess
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - securityhub:GetFindings
            - securityhub:BatchGetFindings
            - securityhub:DescribeHub
            Resource: '*'
  DeploymentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName:
        Fn::Sub: ${AWS::StackName}-deployment-bucket
      VersioningConfiguration:
        Status: Enabled
Outputs:
  DeploymentBucketName:
    Description: Name of the S3 bucket used for deployment artifacts
    Value:
      Ref: DeploymentBucket