deploy.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: A template to deploy the Bedrock-Claude Chat application with customizable parameters.

Parameters:
  AllowSelfRegister:
    Type: String
    Default: "true"
  Ipv4Ranges:
    Type: String
    Default: '["0.0.0.0/1","128.0.0.0/1"]' # Set default values based on current config
  Ipv6Ranges:
    Type: String
    Default: '["0000:0000:0000:0000:0000:0000:0000:0000/1","8000:0000:0000:0000:0000:0000:0000:0000/1"]' # Set default values based on current config
  DisableIpv6:
    Type: String
    Default: "false"
  AllowedSignUpEmailDomains:
    Type: String
    Default: "[]"
  BedrockRegion:
    Type: String
    Default: "ap-southeast-2"
  Version:
    Type: String
    Default: "v1"

Resources:
  ProjectRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Statement:
          - Action: sts:AssumeRole
            Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
        Version: "2012-10-17"
      ManagedPolicyArns:
        - Fn::Join:
            - ""
            - - "arn:"
              - Ref: AWS::Partition
              - :iam::aws:policy/AdministratorAccess
  ProjectRoleDefaultPolicy:
    Type: AWS::IAM::Policy
    Properties:
      PolicyDocument:
        Statement:
          - Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
            Effect: Allow
            Resource:
              - Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":logs:"
                    - Ref: AWS::Region
                    - ":"
                    - Ref: AWS::AccountId
                    - :log-group:/aws/codebuild/
                    - Ref: Project
                    - :*
              - Fn::Join:
                  - ""
                  - - "arn:"
                    - Ref: AWS::Partition
                    - ":logs:"
                    - Ref: AWS::Region
                    - ":"
                    - Ref: AWS::AccountId
                    - :log-group:/aws/codebuild/
                    - Ref: Project
          - Action:
              - codebuild:BatchPutCodeCoverages
              - codebuild:BatchPutTestCases
              - codebuild:CreateReport
              - codebuild:CreateReportGroup
              - codebuild:UpdateReport
            Effect: Allow
            Resource:
              Fn::Join:
                - ""
                - - "arn:"
                  - Ref: AWS::Partition
                  - ":codebuild:"
                  - Ref: AWS::Region
                  - ":"
                  - Ref: AWS::AccountId
                  - :report-group/
                  - Ref: Project
                  - -*
        Version: "2012-10-17"
      PolicyName: ProjectRoleDefaultPolicy
      Roles:
        - Ref: ProjectRole
  Project:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: NO_ARTIFACTS
      Cache:
        Type: NO_CACHE
      EncryptionKey: alias/aws/s3
      Environment:
        ComputeType: BUILD_GENERAL1_SMALL
        Image: aws/codebuild/standard:7.0
        ImagePullCredentialsType: CODEBUILD
        PrivilegedMode: true
        Type: LINUX_CONTAINER
        EnvironmentVariables:
          - Name: ALLOW_SELF_REGISTER
            Value: !Ref AllowSelfRegister
          - Name: IPV4_RANGES
            Value: !Ref Ipv4Ranges
          - Name: IPV6_RANGES
            Value: !Ref Ipv6Ranges
          - Name: DISABLE_IPV6
            Value: !Ref DisableIpv6
          - Name: ALLOWED_SIGN_UP_EMAIL_DOMAINS
            Value: !Ref AllowedSignUpEmailDomains
          - Name: BEDROCK_REGION
            Value: !Ref BedrockRegion
          - Name: VERSION
            Value: !Ref Version
      ServiceRole:
        Fn::GetAtt:
          - ProjectRole
          - Arn
      Source:
        BuildSpec: |-
          {
            "version": 0.2,
            "phases": {
              "install": {
                "runtime-versions": {
                  "nodejs": "18"
                },
                "commands": [
                  "npm i -g aws-cdk"
                ],
                "on-failure": "ABORT"
              },
              "build": {
                "commands": [
                  "echo 'Build phase...'",
                  "git clone --branch $VERSION https://github.com/aws-samples/bedrock-claude-chat.git",
                  "cd bedrock-claude-chat",
                  "if [ \"$ALLOW_SELF_REGISTER\" = \"false\" ]; then sed -i 's/\"selfSignUpEnabled\": true,/\"selfSignUpEnabled\": false,/' cdk/cdk.json; fi",
                  "if [ ! -z \"$IPV4_RANGES\" ]; then jq --arg ipv4 \"$IPV4_RANGES\" '.context.allowedIpV4AddressRanges = ($ipv4 | split(\",\"))' cdk/cdk.json > temp.json && mv temp.json cdk/cdk.json; fi",
                  "if [ \"$DISABLE_IPV6\" = \"true\" ]; then jq '.context.allowedIpV6AddressRanges = []' cdk/cdk.json > temp.json && mv temp.json cdk/cdk.json; elif [ ! -z \"$IPV6_RANGES\" ]; then jq --arg ipv6 \"$IPV6_RANGES\" '.context.allowedIpV6AddressRanges = ($ipv6 | split(\",\"))' cdk/cdk.json > temp.json && mv temp.json cdk/cdk.json; fi",
                  "if [ ! -z \"$ALLOWED_SIGN_UP_EMAIL_DOMAINS\" ]; then jq --arg domains \"$ALLOWED_SIGN_UP_EMAIL_DOMAINS\" '.context.allowedSignUpEmailDomains = ($domains | split(\",\"))' cdk/cdk.json > temp.json && mv temp.json cdk/cdk.json; fi",
                  "sed -i \"s/\\\"bedrockRegion\\\": \\\"[^\\\"]*\\\"/\\\"bedrockRegion\\\": \\\"${BEDROCK_REGION}\\\"/\" cdk/cdk.json",
                  "cd cdk",
                  "npm ci",
                  "cdk bootstrap",
                  "cdk deploy --require-approval never --all"
                ]
              }
            }
          }
        Type: NO_SOURCE
Outputs:
  ProjectName:
    Value:
      Ref: Project