AwsBedrock

Service-level AWS Bedrock component.

Remarks

The first capability creates a Bedrock Guardrail with typed content, PII, topic, and word policies or creates an explicitly acknowledged, expiring Bedrock bearer API key.

Naming:

• Root: type ${namespace}:aws:AwsBedrock; capability guardrail; shared raw identity args.guardrail.name; ${env}-${projectHash}-guardrail-${sanitiseNamePart(args.guardrail.name)}.
• Direct aws:bedrock/guardrail:Guardrail child: [args.guardrail.name]; ${env}-${projectHash}-${sanitiseNamePart(args.guardrail.name)}.
• Provider name: stackAndPurpose from args.guardrail.name: ${env}-${projectHash}-${purpose}. Bedrock permits 50 characters, so the purpose is limited to 37 characters.
• topicPolicyConfig.topicsConfigs[].name is a semantic Bedrock topic identifier sourced from the raw args.guardrail.deniedTopics map key and forwarded unchanged. The component rejects only empty or whitespace-only keys; Bedrock validates its remaining provider constraints.
• API-key capability root: type ${namespace}:aws:AwsBedrock; capability api-key; raw identity args.apiKey.name; ${env}-${projectHash}-api-key-${sanitiseNamePart(args.apiKey.name)}. It composes AwsIam policy components for args.apiKey.customPolicies, then two nested AwsIam components. Each custom policy component has type ${namespace}:aws:AwsIam, parent ${namespace}:aws:AwsBedrock, root identity args.apiKey.customPolicies.<key>.name, and root formula ${env}-${projectHash}-iam-${sanitiseNamePart(args.apiKey.customPolicies.<key>.name)}. Its aws:iam/policy:Policy child uses [args.apiKey.customPolicies.<key>.name], producing ${env}-${projectHash}-${sanitiseNamePart(args.apiKey.customPolicies.<key>.name)}. The user component root is ${env}-${projectHash}-iam-${sanitiseNamePart(args.apiKey.name)} under this component; the credential component has the same root formula under the user component. Its aws:iam/serviceSpecificCredential:ServiceSpecificCredential child uses [args.apiKey.name], producing ${env}-${projectHash}-${sanitiseNamePart(args.apiKey.name)}. The user provider name is stackAndPurpose from args.apiKey.name, ${env}-${projectHash}-${purpose}. IAM permits 64 characters, so the purpose is limited to 51 characters.

Example

const guardrail = new AwsBedrock({
  guardrail: {
    name: 'customerSupport',
    description: 'Protects the customer-support assistant.',
    piiEntities: { email: 'anonymise', ukNationalInsuranceNumber: 'block' },
  },
});

const thirdPartyApiKey = new AwsBedrock({
  apiKey: {
    name: 'thirdPartyIntegration',
    credentialAgeDays: 396,
    allowLongTermCredential: true,
    customPolicies: {
      invokeSelectedModel: {
        name: 'thirdPartyBedrockInvoke',
        policy: {
          path: './policies/bedrock-invoke.json',
          variables: { modelArn: 'arn:aws:bedrock:eu-west-1::foundation-model/amazon.nova-lite-v1:0' },
        },
      },
    },
  },
});

export const bearerToken = thirdPartyApiKey.apiKey;

Constructors

new AwsBedrock( args: AwsBedrockArgs, options?: ComponentResourceOptions, ): AwsBedrock

Parameters

• args (AwsBedrockArgs)
• options (ComponentResourceOptions, optional)

Returns

AwsBedrock

Hierarchy

• ComponentResource
• AwsBedrock

Properties

apiKey: Output<string>

Generated Bedrock bearer API-key secret, when the API-key capability is selected.

apiKeyCredentialId: Output<string>

IAM service-specific credential ID, when the API-key capability is selected.

apiKeyExpirationDate: Output<string>

API-key expiry timestamp, when the API-key capability is selected.

guardrailArn: Output<string>

ARN of the Bedrock guardrail, when the guardrail capability is selected.

guardrailId: Output<string>

Identifier of the Bedrock guardrail, when the guardrail capability is selected.

guardrailVersion: Output<string>

Current Bedrock guardrail version, when the guardrail capability is selected.

urn: Output<string>

Inherited from urn

The stable logical URN used to distinctly address a resource, both before and after deployments.

Methods

getData(): Promise<any>

Inherited from getData

Retrieves the data produces by initialize. The data is immediately available in a derived class's constructor after the super(...) call to ComponentResource.

Returns

• Promise<any>

getProvider(moduleMember: string): ProviderResource | undefined

Inherited from getProvider

Returns the provider for the given module member, if one exists.

Parameters

• moduleMember (string)

Returns

• ProviderResource | undefined

initialize( args: Inputs, opts?: ComponentResourceOptions, name?: string, type?: string, ): Promise<any>

Inherited from initialize

Can be overridden by a subclass to asynchronously initialize data for this component automatically when constructed. The data will be available immediately for subclass constructors to use. To access the data use getData.

Parameters

• args (Inputs)
• opts (ComponentResourceOptions, optional)
• name (string, optional)
• type (string, optional)

Returns

• Promise<any>

registerOutputs( outputs?: Inputs | Promise<Inputs> | Output<Inputs>, ): void

Inherited from registerOutputs

Registers synthetic outputs that a component has initialized, usually by allocating other child sub-resources and propagating their resulting property values.

Component resources can call this at the end of their constructor to indicate that they are done creating child resources. This is not strictly necessary as this will automatically be called after the initialize method completes.

Parameters

• outputs (Inputs | Promise<Inputs> | Output<Inputs>, optional)

Returns

• void

Static Methods

isInstance(obj: any): obj is ComponentResource<any>

Inherited from isInstance

Returns true if the given object is a CustomResource. This is designed to work even when multiple copies of the Pulumi SDK have been loaded into the same process.

Parameters

• obj (any)

Returns

• obj is ComponentResource<any>