Merge branch 'main' into bedrock-guardrails-l2

Author: krokoko

.github/workflows/pr-build.yml

@@ -19,7 +19,7 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  build:
+  pr-build:
     if: github.repository != 'aws/aws-cdk'
     runs-on: aws-cdk_ubuntu-latest_32-core
 

package.json

@@ -25,10 +25,10 @@
     "fs-extra": "^9.1.0",
     "graceful-fs": "^4.2.11",
     "jest-junit": "^13.2.0",
-    "jsii-diff": "1.112.0",
-    "jsii-pacmak": "1.112.0",
-    "jsii-reflect": "1.112.0",
-    "lerna": "^8.2.3",
+    "jsii-diff": "1.113.0",
+    "jsii-pacmak": "1.113.0",
+    "jsii-reflect": "1.113.0",
+    "lerna": "^8.2.4",
     "nx": "^20",
     "semver": "^7.7.2",
     "standard-version": "^9.5.0",

packages/@aws-cdk-testing/framework-integ/package.json

@@ -30,7 +30,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.188.3",
+    "@aws-cdk/integ-runner": "^2.189.2",
     "@aws-cdk/pkglint": "0.0.0",
     "@aws-sdk/client-acm": "3.632.0",
     "@aws-sdk/client-rds": "3.632.0",
@@ -49,7 +49,7 @@
     "@aws-cdk/lambda-layer-kubectl-v33": "^2.0.0",
     "@aws-cdk/region-info": "0.0.0",
     "aws-cdk-lib": "0.0.0",
-    "cdk8s": "2.69.76",
+    "cdk8s": "2.70.3",
     "cdk8s-plus-27": "2.9.5",
     "constructs": "^10.0.0"
   },

packages/@aws-cdk/app-staging-synthesizer-alpha/package.json

@@ -89,7 +89,7 @@
   },
   "devDependencies": {
     "aws-cdk-lib": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.188.3",
+    "@aws-cdk/integ-runner": "^2.189.2",
     "@aws-cdk/integ-tests-alpha": "0.0.0",
     "constructs": "^10.0.0",
     "@aws-cdk/cdk-build-tools": "0.0.0",

packages/@aws-cdk/aws-amplify-alpha/package.json

@@ -87,7 +87,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.188.3",
+    "@aws-cdk/integ-runner": "^2.189.2",
     "@aws-cdk/pkglint": "0.0.0",
     "@aws-cdk/custom-resource-handlers": "0.0.0",
     "@aws-sdk/client-amplify": "3.632.0",

packages/@aws-cdk/aws-applicationsignals-alpha/package.json

@@ -84,7 +84,7 @@
   "license": "Apache-2.0",
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.188.3",
+    "@aws-cdk/integ-runner": "^2.189.2",
     "@aws-cdk/integ-tests-alpha": "0.0.0",
     "@aws-cdk/pkglint": "0.0.0",
     "@types/jest": "^29.5.14",

packages/@aws-cdk/aws-apprunner-alpha/package.json

@@ -86,7 +86,7 @@
   "devDependencies": {
     "@aws-cdk/cdk-build-tools": "0.0.0",
     "aws-cdk-lib": "0.0.0",
-    "@aws-cdk/integ-runner": "^2.188.3",
+    "@aws-cdk/integ-runner": "^2.189.2",
     "@aws-cdk/pkglint": "0.0.0",
     "@types/jest": "^29.5.14",
     "constructs": "^10.0.0",

packages/@aws-cdk/aws-bedrock-alpha/README.md

@@ -57,6 +57,12 @@ This construct library facilitates the deployment of Bedrock Agents, enabling yo
   - [Prompt Properties](#prompt-properties)
   - [Prompt Version](#prompt-version)
   - [Import Methods](#import-methods)
+- [Inference Profiles](#inference-profiles)
+  - [Using Inference Profiles](#using-inference-profiles)
+  - [Types of Inference Profiles](#types-of-inference-profiles)
+  - [Prompt Routers](#prompt-routers)
+  - [Inference Profile Permissions](#inference-profile-permissions)
+  - [Inference Profiles Import Methods](#inference-profiles-import-methods)
 
 ## Agents
 
@@ -1343,3 +1349,202 @@ const importedPrompt = bedrock.Prompt.fromPromptAttributes(this, 'ImportedPrompt
   promptVersion: '1', // optional, defaults to 'DRAFT'
 });
 ```
+
+## Inference Profiles
+
+Amazon Bedrock Inference Profiles provide a way to manage and optimize inference configurations for your foundation models. They allow you to define reusable configurations that can be applied across different prompts and agents.
+
+### Using Inference Profiles
+
+Inference profiles can be used with prompts and agents to maintain consistent inference configurations across your application.
+
+#### With Agents
+
+```ts fixture=default
+// Create a cross-region inference profile
+const crossRegionProfile = bedrock.CrossRegionInferenceProfile.fromConfig({
+  geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
+  model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,
+});
+
+// Use the cross-region profile with an agent
+const agent = new bedrock.Agent(this, 'Agent', {
+  foundationModel: crossRegionProfile,
+  instruction: 'You are a helpful and friendly agent that answers questions about agriculture.',
+});
+```
+
+#### With Prompts
+
+```ts fixture=default
+// Create a prompt router for intelligent model selection
+const promptRouter = bedrock.PromptRouter.fromDefaultId(
+  bedrock.DefaultPromptRouterIdentifier.ANTHROPIC_CLAUDE_V1,
+  'us-east-1'
+);
+
+// Use the prompt router with a prompt variant
+const variant = bedrock.PromptVariant.text({
+  variantName: 'variant1',
+  promptText: 'What is the capital of France?',
+  model: promptRouter,
+});
+
+new bedrock.Prompt(this, 'Prompt', {
+  promptName: 'prompt-router-test',
+  variants: [variant],
+});
+```
+
+### Types of Inference Profiles
+
+Amazon Bedrock offers two types of inference profiles:
+
+#### Application Inference Profiles
+
+Application inference profiles are user-defined profiles that help you track costs and model usage. They can be created for a single region or for multiple regions using a cross-region inference profile.
+
+##### Single Region Application Profile
+
+```ts fixture=default
+// Create an application inference profile for one Region
+const appProfile = new bedrock.ApplicationInferenceProfile(this, 'MyApplicationProfile', {
+  applicationInferenceProfileName: 'claude-3-sonnet-v1',
+  modelSource: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_SONNET_V1_0,
+  description: 'Application profile for cost tracking',
+  tags: {
+    Environment: 'Production',
+  },
+});
+```
+
+##### Multi-Region Application Profile
+
+```ts fixture=default
+// Create a cross-region inference profile
+const crossRegionProfile = bedrock.CrossRegionInferenceProfile.fromConfig({
+  geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
+  model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V2_0,
+});
+
+// Create an application inference profile across regions
+const appProfile = new bedrock.ApplicationInferenceProfile(this, 'MyMultiRegionProfile', {
+  applicationInferenceProfileName: 'claude-35-sonnet-v2-multi-region',
+  modelSource: crossRegionProfile,
+  description: 'Multi-region application profile for cost tracking',
+});
+```
+
+#### System Defined Inference Profiles
+
+Cross-region inference enables you to seamlessly manage unplanned traffic bursts by utilizing compute across different AWS Regions. With cross-region inference, you can distribute traffic across multiple AWS Regions, enabling higher throughput and enhanced resilience during periods of peak demands.
+
+Before using a CrossRegionInferenceProfile, ensure that you have access to the models and regions defined in the inference profiles. For instance, if you use the system defined inference profile "us.anthropic.claude-3-5-sonnet-20241022-v2:0", inference requests will be routed to US East (Virginia) us-east-1, US East (Ohio) us-east-2 and US West (Oregon) us-west-2. Thus, you need to have model access enabled in those regions for the model anthropic.claude-3-5-sonnet-20241022-v2:0.
+
+##### System Defined Profile Configuration
+
+```ts fixture=default
+const crossRegionProfile = bedrock.CrossRegionInferenceProfile.fromConfig({
+  geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
+  model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V2_0,
+});
+```
+
+### Prompt Routers
+
+Amazon Bedrock intelligent prompt routing provides a single serverless endpoint for efficiently routing requests between different foundational models within the same model family. It can help you optimize for response quality and cost. They offer a comprehensive solution for managing multiple AI models through a single serverless endpoint, simplifying the process for you. Intelligent prompt routing predicts the performance of each model for each request, and dynamically routes each request to the model that it predicts is most likely to give the desired response at the lowest cost.
+
+#### Default and Custom Prompt Routers
+
+```ts fixture=default
+// Use a default prompt router
+const variant = bedrock.PromptVariant.text({
+  variantName: 'variant1',
+  promptText: 'What is the capital of France?',
+  model: bedrock.PromptRouter.fromDefaultId(
+    bedrock.DefaultPromptRouterIdentifier.ANTHROPIC_CLAUDE_V1,
+    'us-east-1'
+  ),
+});
+
+new bedrock.Prompt(this, 'Prompt', {
+  promptName: 'prompt-router-test',
+  variants: [variant],
+});
+```
+
+### Inference Profile Permissions
+
+Use the `grantProfileUsage` method to grant appropriate permissions to resources that need to use the inference profile.
+
+#### Granting Profile Usage Permissions
+
+```ts fixture=default
+// Create an application inference profile
+const profile = new bedrock.ApplicationInferenceProfile(this, 'MyProfile', {
+  applicationInferenceProfileName: 'my-profile',
+  modelSource: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,
+});
+
+// Create a Lambda function
+const lambdaFunction = new lambda.Function(this, 'MyFunction', {
+  runtime: lambda.Runtime.PYTHON_3_11,
+  handler: 'index.handler',
+  code: lambda.Code.fromInline('def handler(event, context): return "Hello"'),
+});
+
+// Grant the Lambda function permission to use the inference profile
+profile.grantProfileUsage(lambdaFunction);
+
+// Use a system defined inference profile
+const crossRegionProfile = bedrock.CrossRegionInferenceProfile.fromConfig({
+  geoRegion: bedrock.CrossRegionInferenceProfileRegion.US,
+  model: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0,
+});
+
+// Grant permissions to use the cross-region inference profile
+crossRegionProfile.grantProfileUsage(lambdaFunction);
+```
+
+The `grantProfileUsage` method adds the necessary IAM permissions to the resource, allowing it to use the inference profile. This includes permissions to call `bedrock:GetInferenceProfile` and `bedrock:ListInferenceProfiles` actions on the inference profile resource.
+
+### Inference Profiles Import Methods
+
+You can import existing application inference profiles using the following methods:
+
+```ts fixture=default
+// Import an inference profile through attributes
+const importedProfile = bedrock.ApplicationInferenceProfile.fromApplicationInferenceProfileAttributes(
+  this,
+  'ImportedProfile',
+  {
+    inferenceProfileArn: 'arn:aws:bedrock:us-east-1:123456789012:application-inference-profile/my-profile-id',
+    inferenceProfileIdentifier: 'my-profile-id',
+  }
+);
+```
+
+You can also import an application inference profile from an existing L1 CloudFormation construct:
+
+```ts fixture=default
+// Create or reference an existing L1 CfnApplicationInferenceProfile
+const cfnProfile = new aws_bedrock_cfn.CfnApplicationInferenceProfile(this, 'CfnProfile', {
+  inferenceProfileName: 'my-cfn-profile',
+  modelSource: {
+    copyFrom: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_3_5_SONNET_V1_0.invokableArn,
+  },
+  description: 'Profile created via L1 construct',
+});
+
+// Import the L1 construct as an L2 ApplicationInferenceProfile
+const importedFromCfn = bedrock.ApplicationInferenceProfile.fromCfnApplicationInferenceProfile(cfnProfile);
+
+// Grant permissions to use the imported profile
+const lambdaFunction = new lambda.Function(this, 'MyFunction', {
+  runtime: lambda.Runtime.PYTHON_3_11,
+  handler: 'index.handler',
+  code: lambda.Code.fromInline('def handler(event, context): return "Hello"'),
+});
+
+importedFromCfn.grantProfileUsage(lambdaFunction);
+```

packages/@aws-cdk/aws-bedrock-alpha/bedrock/agents/agent.ts

@@ -522,7 +522,7 @@ export class Agent extends AgentBase implements IAgent {
     this.agentCollaboration = props.agentCollaboration;
     if (props.agentCollaboration) {
       props.agentCollaboration.collaborators.forEach(ac => {
-        this.addAgentCollaborator(ac);
+        this.grantPermissionToAgent(ac);
       });
     }
 
@@ -662,11 +662,14 @@ export class Agent extends AgentBase implements IAgent {
   }
 
   /**
-   * Adds a collaborator to the agent and grants necessary permissions.
-   * @param agentCollaborator - The collaborator to add
-   * @internal This method is used internally by the constructor and should not be called directly.
+   * Grants permissions for an agent collaborator to this agent's role.
+   * This method only grants IAM permissions and does not add the collaborator
+   * to the agent's collaboration configuration. To add collaborators to the
+   * agent configuration, include them in the AgentCollaboration when creating the agent.
+   *
+   * @param agentCollaborator - The collaborator to grant permissions for
    */
-  private addAgentCollaborator(agentCollaborator: AgentCollaborator) {
+  private grantPermissionToAgent(agentCollaborator: AgentCollaborator) {
     agentCollaborator.grant(this.role);
   }
 
@@ -722,7 +725,7 @@ export class Agent extends AgentBase implements IAgent {
    * @internal This is an internal core function and should not be called directly.
    */
   private renderAgentCollaborators(): bedrock.CfnAgent.AgentCollaboratorProperty[] | undefined {
-    if (!this.agentCollaboration) {
+    if (!this.agentCollaboration || !this.agentCollaboration.collaborators || this.agentCollaboration.collaborators.length === 0) {
       return undefined;
     }
 

packages/@aws-cdk/aws-bedrock-alpha/bedrock/index.ts

@@ -33,6 +33,14 @@ export * from './prompts/prompt-inference-configuration';
 export * from './prompts/prompt-template-configuration';
 export * from './prompts/prompt-genai-resource';
 
+// ===================================
+// Inference Profiles
+// ===================================
+export * from './inference-profiles/inference-profile';
+export * from './inference-profiles/application-inference-profile';
+export * from './inference-profiles/cross-region-inference-profile';
+export * from './inference-profiles/prompt-router';
+
 // ===================================
 // Models
 // ===================================