template.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: "AWS::Serverless-2016-10-31"
Description: Full LLM Stack

Resources:
  MyLambdaFunction2:
    Type: AWS::Serverless::Function
    Properties:
      Handler: lambda_function.lambda_handler
      Runtime: python3.8
      CodeUri: function/.
      Description: lambda for solutions
      Timeout: 500
      MemorySize: 256
      Role: !GetAtt LambdaExecutionRole2.Arn
      Policies:
        - AWSLambdaBasicExecutionRole
        - AWSLambda_ReadOnlyAccess
        - AWSXrayWriteOnlyAccess
      Tracing: Active
      Layers:
        - !Ref libs
      Environment:
        Variables:
          AWS_CLOUDFORMATION_STACK_NAME: !Ref AWS::StackName
          SECRET_NAME: llmapp

  libs:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: blank-python-lib
      Description: Dependencies for the blank-python sample app.
      ContentUri: function/package/.
      CompatibleRuntimes:
        - python3.8

  LambdaExecutionRole2:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
      Policies:
        - PolicyName: BedrockAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - bedrock:*
                Resource: "*"
        - PolicyName: KendraAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - kendra:*
                Resource: "*"
        - PolicyName: S3Access
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - s3:PutObject
                  - s3:GetObject
                  - s3:ListBucket
                Resource:
                  - arn:aws:s3:::*
                  - arn:aws:s3:::*/*
        - PolicyName: SecurityHubAccess
          PolicyDocument:
            Version: "2012-10-17"
            Statement:
              - Effect: Allow
                Action:
                  - securityhub:GetFindings
                  - securityhub:BatchGetFindings
                  - securityhub:DescribeHub
                Resource: "*"

  DeploymentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub "${AWS::StackName}-deployment-bucket"
      VersioningConfiguration:
        Status: Enabled

Outputs:
  DeploymentBucketName:
    Description: Name of the S3 bucket used for deployment artifacts
    Value: !Ref DeploymentBucket