adam/proposal-system
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/proposal-system.git synced 2026-10-03 10:23:17 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(infra): grant KB role rds:DescribeDBClusters (prod deploy blocker) (#229)

Browse source 
The seahaven-prod deploy failed at CreateKnowledgeBase: the Bedrock KB execution
role (proposal-system-kb-role) was denied rds:DescribeDBClusters, which Bedrock
calls to validate the Aurora pgvector store config. Add it. rds:DescribeDBClusters
does NOT support resource-level scoping (account/region list action) so it must be
Resource:*; the role's sensitive actions (rds-data:*, s3, InvokeModel, secret) stay
tightly scoped. GPT-4.1 cross-review APPROVE (caught the Resource:* requirement).
This commit is contained in:
Adam Moussa 2026-07-15 15:54:14 -04:00 • committed by GitHub
parent 0c5b294ffc
commit 590f0c075c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 11 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

11
infra/lib/compute-stack.ts
View file

@ -86,6 +86,17 @@ export class ComputeStack extends cdk.Stack {
resources: [`arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0`], resources: [`arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0`],
})); }));
// Bedrock validates the Aurora vector-store config at KB-create time by calling
// rds:DescribeDBClusters — required or CreateKnowledgeBase 400s with "storage
// configuration provided is invalid" / rds:DescribeDBClusters AccessDenied.
// NOTE: rds:DescribeDBClusters does NOT support resource-level permissions (it is an
// account/region list action), so it must be Resource:* — scoping to the cluster ARN
// grants nothing. Read-only metadata; the role's sensitive actions stay scoped.
kbRole.addToPolicy(new iam.PolicyStatement({
actions: ['rds:DescribeDBClusters'],
resources: ['*'],
}));
// KB queries the pgvector table via the RDS Data API as bedrock_user. // KB queries the pgvector table via the RDS Data API as bedrock_user.
kbRole.addToPolicy(new iam.PolicyStatement({ kbRole.addToPolicy(new iam.PolicyStatement({
actions: [ actions: [