Adam Moussa a6d7e3468d Grant Bedrock IAM, drop Anthropic secrets, add fallback alarm ... Both stacks moved their processors from the Anthropic API to the Bedrock inference profile us.anthropic.claude-haiku-4-5-20251001-v1:0. Grant each processor role bedrock:InvokeModel + bedrock:InvokeModelWithResponseStream on BOTH the inference-profile ARN AND the per-region foundation-model ARNs for us-east-1/us-east-2/us-west-2 (empty-account) -- the us.* profile routes cross-region, so a profile-only grant AccessDenies at runtime. Remove both anthropic-api-key Secret constructs, their grant_read, and the ANTHROPIC_API_KEY_SECRET_ARN env; add BEDROCK_MODEL_ID. The secrets had RemovalPolicy.RETAIN so they are orphaned, not deleted -- flagged in the README for manual post-deploy deletion and key revocation. Add the workorder-email-processor-template-fallback-rate alarm: a FILL(0) + >=10-sample volume-floor MathExpression over the EMF ParseOutcome metric (15-min periods) that pages when the AI-fallback share exceeds 15% sustained, catching Hexagon template drift. ALARM-only SnsAction to site-alerts, no OK action, NOT_BREACHING, matching the existing stack idiom.		2026-07-15 20:10:40 -04:00
..
app.py	Merge workorder-ingest into unified procurement repo (#22)	2026-05-12 15:21:06 -04:00
cdk.json	Initial commit: PO email ingestion pipeline	2026-04-07 12:12:30 -04:00
po_stack.py	Grant Bedrock IAM, drop Anthropic secrets, add fallback alarm	2026-07-15 20:10:40 -04:00
requirements.txt	Bump aws-cdk-lib in /cdk in the minor-and-patch group across 1 directory (#86)	2026-07-07 18:20:00 +00:00
wo_stack.py	Grant Bedrock IAM, drop Anthropic secrets, add fallback alarm	2026-07-15 20:10:40 -04:00