Skip to content

Commit 119ef9c

Browse files
author
Yuriy Bezsonov
committed
Roles and cleanup
1 parent 5e07960 commit 119ef9c

File tree

9 files changed

+393
-103
lines changed

9 files changed

+393
-103
lines changed

‎infra/cdk/src/main/java/sample/com/constructs/Eks.java‎

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -83,13 +83,6 @@ private Role createCloudWatchAgentRole(String prefix) {
8383
.build()
8484
);
8585

86-
// Export role ARN for workshop content
87-
CfnOutput.Builder.create(this, "CloudWatchAgentRoleArn")
88-
.value(role.getRoleArn())
89-
.description("CloudWatch Agent Pod Identity Role ARN")
90-
.exportName(prefix + "-eks-cloudwatch-agent-role-arn")
91-
.build();
92-
9386
return role;
9487
}
9588

@@ -132,6 +125,18 @@ private void createAccessEntries(EksProps props) {
132125
.accessPolicies(List.of(clusterAdminPolicy))
133126
.build();
134127
}
128+
129+
// Workshop Studio Participant Role Access Entry
130+
// This grants the WSParticipantRole cluster admin permissions for local kubectl access
131+
String accountId = software.amazon.awscdk.Stack.of(this).getAccount();
132+
String participantRoleArn = "arn:aws:iam::" + accountId + ":role/WSParticipantRole";
133+
134+
AccessEntry.Builder.create(this, "ParticipantAccessEntry")
135+
.cluster(cluster)
136+
.principal(participantRoleArn)
137+
.accessEntryType(AccessEntryType.STANDARD)
138+
.accessPolicies(List.of(clusterAdminPolicy))
139+
.build();
135140
}
136141

137142
// Getters

‎infra/cdk/src/main/java/sample/com/constructs/Ide.java‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -417,13 +417,15 @@ public Ide(final Construct scope, final String id, final IdeProps props) {
417417
ideUrl = "https://" + distribution.getDistributionDomainName();
418418
}
419419

420-
CfnOutput.Builder.create(this, "Url")
420+
// Create outputs at stack level with stable logical IDs for Workshop Studio
421+
var stack = software.amazon.awscdk.Stack.of(this);
422+
CfnOutput.Builder.create(stack, "IdeUrl")
421423
.value(ideUrl)
422424
.description("Workshop IDE Url")
423425
.exportName(instanceName + "-url")
424426
.build();
425427

426-
var idePasswordOutput = CfnOutput.Builder.create(this, "Password")
428+
var idePasswordOutput = CfnOutput.Builder.create(stack, "IdePassword")
427429
.value(getIdePassword(instanceName))
428430
.description("Workshop IDE Password")
429431
.exportName(instanceName + "-password")

‎infra/cdk/src/main/resources/iam-policy.json‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
"application-autoscaling:*",
3535
"application-signals:*",
3636
"cloudformation:*",
37+
"cloudtrail:*",
3738
"cloudwatch:*",
3839
"codewhisperer:*",
3940
"ec2:*",
@@ -68,6 +69,15 @@
6869
"arn:aws:iam::{{.AccountId}}:role/workshop-*"
6970
]
7071
},
72+
{
73+
"Sid": "CreateServiceLinkedRole",
74+
"Effect": "Allow",
75+
"Action": [
76+
"iam:CreateServiceLinkedRole",
77+
"iam:GetRole"
78+
],
79+
"Resource": "*"
80+
},
7181
{
7282
"Sid": "DenyXXLInstances",
7383
"Effect": "Deny",

‎infra/cfn/base-stack.yaml‎

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -676,6 +676,19 @@ Resources:
676676
Fn::GetAtt:
677677
- IdeInstanceLauncherFunction803C5A2A
678678
- Arn
679+
InstanceTypes: m6a.xlarge,m7a.xlarge
680+
InstanceName: ide
681+
IamInstanceProfileArn:
682+
Fn::GetAtt:
683+
- IdeInstanceProfile61B92038
684+
- Arn
685+
VolumeSize: "50"
686+
SubnetIds:
687+
Fn::Join:
688+
- ""
689+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
690+
- ","
691+
- Ref: VpcPublicSubnet2SubnetA811849C
679692
SecurityGroupIds:
680693
Fn::Join:
681694
- ""
@@ -686,19 +699,8 @@ Resources:
686699
- Fn::GetAtt:
687700
- IdeInternalSecurityGroupB0A5D76B
688701
- GroupId
689-
SubnetIds:
690-
Fn::Join:
691-
- ""
692-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
693-
- ","
694-
- Ref: VpcPublicSubnet2SubnetA811849C
695-
VolumeSize: "50"
696-
IamInstanceProfileArn:
697-
Fn::GetAtt:
698-
- IdeInstanceProfile61B92038
699-
- Arn
700-
InstanceName: ide
701-
InstanceTypes: m6a.xlarge,m7a.xlarge
702+
ImageId:
703+
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
702704
UserData:
703705
Fn::Base64:
704706
Fn::Join:
@@ -835,8 +837,6 @@ Resources:
835837
"
836838
exit 1
837839
fi
838-
ImageId:
839-
Ref: SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter
840840
UpdateReplacePolicy: Delete
841841
DeletionPolicy: Delete
842842
IdeEipAssociationDFF81215:
@@ -1057,8 +1057,12 @@ Resources:
10571057
- Ref: IdePasswordSecretF907B9F2
10581058
UpdateReplacePolicy: Delete
10591059
DeletionPolicy: Delete
1060+
Parameters:
1061+
SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter:
1062+
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
1063+
Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
10601064
Outputs:
1061-
IdeUrl45274C27:
1065+
IdeUrl:
10621066
Description: Workshop IDE Url
10631067
Value:
10641068
Fn::Join:
@@ -1073,16 +1077,12 @@ Outputs:
10731077
- password
10741078
Export:
10751079
Name: ide-url
1076-
IdePassword51C06AAD:
1080+
IdePassword:
10771081
Description: Workshop IDE Password
10781082
Value:
10791083
Fn::GetAtt:
10801084
- IdePasswordResource07883F17
10811085
- password
10821086
Export:
10831087
Name: ide-password
1084-
Parameters:
1085-
SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter:
1086-
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
1087-
Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
10881088

‎infra/cfn/java-ai-agents-stack.yaml‎

Lines changed: 24 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -364,6 +364,7 @@ Resources:
364364
- bedrock-agentcore:*
365365
- bedrock:*
366366
- cloudformation:*
367+
- cloudtrail:*
367368
- cloudwatch:*
368369
- codewhisperer:*
369370
- ec2:*
@@ -393,6 +394,12 @@ Resources:
393394
- !Sub arn:aws:iam::${AWS::AccountId}:role/unicorn*
394395
- !Sub arn:aws:iam::${AWS::AccountId}:role/workshop-*
395396
Sid: PassRole
397+
- Action:
398+
- iam:CreateServiceLinkedRole
399+
- iam:GetRole
400+
Effect: Allow
401+
Resource: "*"
402+
Sid: CreateServiceLinkedRole
396403
- Action: ec2:RunInstances
397404
Condition:
398405
StringLike:
@@ -761,6 +768,17 @@ Resources:
761768
Fn::GetAtt:
762769
- IdeInstanceLauncherFunction803C5A2A
763770
- Arn
771+
IamInstanceProfileArn:
772+
Fn::GetAtt:
773+
- IdeInstanceProfile61B92038
774+
- Arn
775+
VolumeSize: "50"
776+
SubnetIds:
777+
Fn::Join:
778+
- ""
779+
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
780+
- ","
781+
- Ref: VpcPublicSubnet2SubnetA811849C
764782
SecurityGroupIds:
765783
Fn::Join:
766784
- ""
@@ -911,17 +929,6 @@ Resources:
911929
fi
912930
InstanceTypes: m6a.xlarge,m7a.xlarge
913931
InstanceName: ide
914-
IamInstanceProfileArn:
915-
Fn::GetAtt:
916-
- IdeInstanceProfile61B92038
917-
- Arn
918-
VolumeSize: "50"
919-
SubnetIds:
920-
Fn::Join:
921-
- ""
922-
- - Ref: VpcPublicSubnet1Subnet8E8DEDC0
923-
- ","
924-
- Ref: VpcPublicSubnet2SubnetA811849C
925932
UpdateReplacePolicy: Delete
926933
DeletionPolicy: Delete
927934
IdeEipAssociationDFF81215:
@@ -1142,8 +1149,12 @@ Resources:
11421149
- Ref: IdePasswordSecretF907B9F2
11431150
UpdateReplacePolicy: Delete
11441151
DeletionPolicy: Delete
1152+
Parameters:
1153+
SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter:
1154+
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
1155+
Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
11451156
Outputs:
1146-
IdeUrl45274C27:
1157+
IdeUrl:
11471158
Description: Workshop IDE Url
11481159
Value:
11491160
Fn::Join:
@@ -1158,16 +1169,12 @@ Outputs:
11581169
- password
11591170
Export:
11601171
Name: ide-url
1161-
IdePassword51C06AAD:
1172+
IdePassword:
11621173
Description: Workshop IDE Password
11631174
Value:
11641175
Fn::GetAtt:
11651176
- IdePasswordResource07883F17
11661177
- password
11671178
Export:
11681179
Name: ide-password
1169-
Parameters:
1170-
SsmParameterValueawsserviceamiamazonlinuxlatestal2023amikernel61x8664C96584B6F00A464EAD1953AFF4B05118Parameter:
1171-
Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
1172-
Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-6.1-x86_64
11731180

0 commit comments

Comments
 (0)