GenAI-FSI-Agent.yml

AWSTemplateFormatVersion: "2010-09-09"
Description: "GenAI Financial Services Agent powered by Amazon Bedrock, Amazon DynamoDB, AWS Lambda, Amazon Lex, and Amazon Kendra"
Metadata:
  LICENSE: >-
    Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.

    Permission is hereby granted, free of charge, to any person obtaining a copy of this
    software and associated documentation files (the "Software"), to deal in the Software
    without restriction, including without limitation the rights to use, copy, modify,
    merge, publish, distribute, sublicense, and/or sell copies of the Software, and to
    permit persons to whom the Software is furnished to do so.

    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
    INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
    PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
    HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
    OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
    SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

  AWS::CloudFormation::Interface:
    ParameterGroups:
      - Label:
          default: S3 Bucket, Lambda and Lex Deployment Package Keys, and Lambda Layer ARNs
        Parameters:
          - S3ArtifactBucket
          - DataLoaderS3Key
          - LambdaHandlerS3Key
          - LexBotS3Key
          - BedrockLangChainPDFRWLayerArn
          - CfnresponseLayerArn
      - Label:
          default: GitHub Secrets Manager Configuration
        Parameters:
          - GitHubTokenSecretName
      - Label:
          default: Kendra Web Crawler Root Domain
        Parameters:
          - KendraWebCrawlerUrl
      - Label:
          default: Amplify Source Repository URL
        Parameters:
          - AmplifyRepository
    ParameterLabels:
      S3ArtifactBucket:
        default: your-s3-bucket-name
      DataLoaderS3Key:
        default: /agent/lambda/data-loader/loader_deployment_package.zip
      LambdaHandlerS3Key:
        default: /agent/lambda/agent-handler/agent_deployment_package.zip
      LexBotS3Key:
        default: /agent/bot/lex.zip
      BedrockLangChainPDFRWLayerArn:
        default: bedrock-layer-arn
      CfnresponseLayerArn:
        default: cfnresponse-layer-arn
      GitHubTokenSecretName:
        default: your-github-token-secret-name
      KendraWebCrawlerUrl:
        default: your-kendra-root-domain
      AmplifyRepository:
        default: your-forked-repo-url

Parameters:
  S3ArtifactBucket:
    Description: S3 Bucket Containing Lambda Handler, Lambda Data Loader, and Lex Deployment Packages, along with Customer FAQ and Mortgage Application example documents.
    Type: String
    Default: your-s3-bucket-name
  DataLoaderS3Key:
    Description: S3 Key for DynamoDB data loader.
    Type: String
    Default: /agent/lambda/data-loader/loader_deployment_package.zip
  LambdaHandlerS3Key:
    Description: S3 Key for Lambda handler.
    Type: String
    Default: /agent/lambda/agent-handler/agent_deployment_package.zip
  LexBotS3Key:
    Description: S3 key for Lex bot deployment package. 
    Type: String
    Default: /agent/bot/lex.zip
  BedrockLangChainPDFRWLayerArn:
    Description: Bedrock LangChain PDFRW Lambda layer ARN.
    Type: String
    Default: bedrock-layer-arn
  CfnresponseLayerArn:
    Description: cfnresponse Lambda layer ARN.
    Type: String
    Default: cfnresponse-layer-arn
  GitHubTokenSecretName:
    Description: GitHub PAT secret name. 
    Type: String
    NoEcho: true
    Default: your-github-token-secret-name
  KendraWebCrawlerUrl:
    Description: Kendra Web Crawler root domain URL. 
    Type: String
    Default: your-kendra-root-domain
  AmplifyRepository:
    Description: Source repository for AWS Amplify frontend. 
    Type: String
    Default: your-forked-repo-url

Resources:
  UserPendingAccountsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${AWS::StackName}-UserPendingAccounts
      AttributeDefinitions:
      - AttributeName: userName
        AttributeType: S
      - AttributeName: planName
        AttributeType: S
      KeySchema:
      - AttributeName: userName
        KeyType: HASH
      - AttributeName: planName
        KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: '3'
        WriteCapacityUnits: '3'
      SSESpecification:
        SSEEnabled: True

  UserExistingAccountsTable:
    Type: AWS::DynamoDB::Table
    Properties:
      TableName: !Sub ${AWS::StackName}-UserExistingAccounts
      AttributeDefinitions:
      - AttributeName: userName
        AttributeType: S
      - AttributeName: planName
        AttributeType: S
      KeySchema:
      - AttributeName: userName
        KeyType: HASH
      - AttributeName: planName
        KeyType: RANGE
      ProvisionedThroughput:
        ReadCapacityUnits: '3'
        WriteCapacityUnits: '3'
      SSESpecification:
        SSEEnabled: True

  ConversationIndexTable:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub ${AWS::StackName}-ConversationIndexTable
      KeySchema:
        - AttributeName: id
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: id
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: True

  ConversationTable:
    Type: 'AWS::DynamoDB::Table'
    Properties:
      TableName: !Sub ${AWS::StackName}-ConversationTable
      KeySchema:
        - AttributeName: SessionId
          KeyType: HASH
      AttributeDefinitions:
        - AttributeName: SessionId
          AttributeType: S
      BillingMode: PAY_PER_REQUEST
      SSESpecification:
        SSEEnabled: True

  AgentHandlerServiceRole:
    Type: 'AWS::IAM::Role'
    Properties:
      RoleName: !Sub ${AWS::StackName}-AgentHandlerServiceRole
      AssumeRolePolicyDocument:
        Statement:
          - Action: 'sts:AssumeRole'
            Effect: Allow
            Principal:
              Service: lambda.amazonaws.com
        Version: 2012-10-17
      ManagedPolicyArns:
        - !Join 
          - ''
          - - 'arn:'
            - !Ref 'AWS::Partition'
            - ':iam::aws:policy/service-role/AWSLambdaBasicExecutionRole'

  AgentHandlerServiceRoleDefaultPolicy:
    Type: 'AWS::IAM::Policy'
    Properties:
      PolicyName: !Sub ${AWS::StackName}-AgentHandlerServiceRoleDefaultPolicy
      PolicyDocument:
        Statement:
          - Action:
              - dynamodb:BatchGetItem
              - dynamodb:BatchWriteItem
              - dynamodb:ConditionCheckItem
              - dynamodb:DeleteItem
              - dynamodb:DescribeTable
              - dynamodb:GetItem
              - dynamodb:GetRecords
              - dynamodb:GetShardIterator
              - dynamodb:PutItem
              - dynamodb:Query
              - dynamodb:Scan
              - dynamodb:UpdateItem
              - lambda:InvokeFunction
              - bedrock:InvokeModel
              - kendra:Query
              - kendra:Retrieve
              - kendra:BatchGetDocumentStatus
              - s3:GetObject
              - s3:PutObject
            Effect: Allow
            Resource: '*'        
        Version: 2012-10-17
      Roles:
        - !Ref AgentHandlerServiceRole

  AgentHandlerFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Lambda handler for GenAI FSI Agent.
      FunctionName: !Sub ${AWS::StackName}-GenAILexHandler
      Code:
        S3Bucket: !Ref S3ArtifactBucket
        S3Key: !Ref LambdaHandlerS3Key
      Runtime: python3.11
      MemorySize: 512
      Timeout: 30
      Handler: lambda_function.handler
      Layers:
        - !Ref BedrockLangChainPDFRWLayerArn
      Role: !GetAtt AgentHandlerServiceRole.Arn
      Architectures:
        - x86_64
      Environment:
        Variables:
          USER_PENDING_ACCOUNTS_TABLE: !Ref UserPendingAccountsTable
          USER_EXISTING_ACCOUNTS_TABLE: !Ref UserExistingAccountsTable
          CONVERSATION_INDEX_TABLE: !Ref ConversationIndexTable
          CONVERSATION_TABLE: !Ref ConversationTable
          KENDRA_INDEX_ID: !GetAtt KendraIndex.Id
          S3_ARTIFACT_BUCKET_NAME: !Ref S3ArtifactBucket

  LexLambdaPermissions:
    Type: AWS::Lambda::Permission
    Properties: 
      Action: lambda:InvokeFunction
      FunctionName: !Ref AgentHandlerFunction
      Principal: 'lexv2.amazonaws.com'

  DataLoaderFunction:
    Type: AWS::Lambda::Function
    Properties:
      Description: Lambda function to load the plan catalog.
      FunctionName: !Sub ${AWS::StackName}-DDBDataLoader
      Code: 
        S3Bucket: !Ref S3ArtifactBucket
        S3Key: !Ref DataLoaderS3Key
      Runtime: python3.11
      MemorySize: 256
      Timeout: 20
      Handler: index.handler
      Layers:
        - !Ref CfnresponseLayerArn
      Role: !GetAtt AgentHandlerServiceRole.Arn
      Environment:
        Variables:
          USER_EXISTING_ACCOUNTS_TABLE: !Ref UserExistingAccountsTable

  LoadPlanData:
    Type: Custom::LoadDynamoDB
    Properties:
      ServiceToken: !GetAtt DataLoaderFunction.Arn

  AmplifyRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-AmplifyRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - amplify.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: !Sub ${AWS::StackName}-Amplify
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: 
            - 'amplify:Create*'
            - 'amplify:Get*'
            - 'amplify:List*'
            - 'amplify:Start*'
            - 'amplify:Stop*'
            - 'amplify:Update*'
            Resource: '*'

  AmplifyApp:
    Type: AWS::Amplify::App
    Properties:
      Name: !Sub ${AWS::StackName}-AnyCompany-Website
      Repository: !Ref AmplifyRepository
      BuildSpec: |
        frontend:
          phases:
            # IMPORTANT - Please verify your build commands
            build:
              commands: []
          artifacts:
            # IMPORTANT - Please verify your build output directory
            baseDirectory: ./frontend/
            files:
              - '**/*'
          cache:
            paths: []
      AccessToken: !Sub "{{resolve:secretsmanager:${GitHubTokenSecretName}}}"
      Description: AnyCompany website
      IAMServiceRole: !GetAtt AmplifyRole.Arn

  AmplifyBranch:
    Type: AWS::Amplify::Branch
    Properties:
      AppId: !GetAtt AmplifyApp.AppId
      BranchName: main

  KendraLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Sub ${AWS::StackName}-KendraLogGroup
      RetentionInDays: 7

  KendraLogStream:
    Type: AWS::Logs::LogStream
    Properties:
      LogGroupName: !Ref KendraLogGroup
      LogStreamName: !Sub ${AWS::StackName}-KendraLogStream
    DependsOn: KendraLogGroup

  KendraIndexRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-KendraIndexRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - kendra.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: !Sub ${AWS::StackName}-KendraIndexPolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action: cloudwatch:PutMetricData
            Resource: '*'
          - Effect: Allow
            Action: logs:DescribeLogGroups
            Resource: '*'
          - Effect: Allow
            Action:
            - 'logs:CreateLogGroup'
            - 'logs:DescribeLogStreams'
            - 'logs:CreateLogStream'
            - 'logs:PutLogEvents'
            Resource: '*'

  KendraIndex:
    Type: AWS::Kendra::Index
    Properties:
      Edition: DEVELOPER_EDITION
      Name: !Sub ${AWS::StackName}-KendraIndex
      RoleArn: !GetAtt KendraIndexRole.Arn

  KendraDataSourceRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-KendraDataSourceRole
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service:
            - kendra.amazonaws.com
          Action:
          - sts:AssumeRole
      Policies:
      - PolicyName: !Sub ${AWS::StackName}-KendraDataSourcePolicy
        PolicyDocument:
          Version: '2012-10-17'
          Statement:
          - Effect: Allow
            Action:
            - 's3:GetObject'
            - 's3:GetBucketLocation'
            - 's3:ListBucket'
            - 's3:GetBucketAcl'
            - 's3:GetObjectAcl'
            Resource:
            - !Sub arn:aws:s3:::${S3ArtifactBucket}
            - !Sub arn:aws:s3:::${S3ArtifactBucket}/*
          - Effect: Allow
            Action:
            - 'kendra:PutPrincipalMapping'
            - 'kendra:DeletePrincipalMapping'
            - 'kendra:ListGroupsOlderThanOrderingId'
            - 'kendra:DescribePrincipalMapping'
            - 'kendra:BatchPutDocument'
            - 'kendra:BatchDeleteDocument'
            Resource: '*'

  KendraWebCrawler:
    DependsOn: KendraIndex
    Type: AWS::Kendra::DataSource
    Properties:
      Name: !Sub ${AWS::StackName}-WebCrawler
      Type: WEBCRAWLER
      IndexId: !GetAtt KendraIndex.Id
      RoleArn: !GetAtt KendraDataSourceRole.Arn
      DataSourceConfiguration:
        WebCrawlerConfiguration: 
            CrawlDepth: 3
            MaxContentSizePerPageInMegaBytes: 50
            MaxLinksPerPage: 20
            MaxUrlsPerMinuteCrawlRate: 100
            Urls: 
              SeedUrlConfiguration:
                SeedUrls: 
                  - !Ref KendraWebCrawlerUrl
                WebCrawlerMode: SUBDOMAINS

  LexBotRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub ${AWS::StackName}-LexBotRole
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - lexv2.amazonaws.com
            Action:
              - 'sts:AssumeRole'
      Path: "/"
      Policies:
        - PolicyName: !Sub ${AWS::StackName}-LexBotRolePolicy
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - 'polly:SynthesizeSpeech'
                  - 'comprehend:DetectSentiment'
                Resource: "*"

  LexBot:
    DependsOn: LexBotRole
    Type: AWS::Lex::Bot
    Properties:
        Name: !Sub ${AWS::StackName}-FSI-Agent
        BotFileS3Location: 
          S3Bucket: !Ref S3ArtifactBucket
          S3ObjectKey: !Ref LexBotS3Key
        DataPrivacy: 
          ChildDirected: false
        Description: 'Financial Services Agent'
        IdleSessionTTLInSeconds: 900
        RoleArn: !GetAtt LexBotRole.Arn

Outputs:
  AmplifyDemoWebsite:
    Value: !Join ['', ['main.', !GetAtt AmplifyApp.DefaultDomain]]
  AmplifyAppID:
    Value: !GetAtt AmplifyApp.AppId
  AmplifyBranch:
    Value: !GetAtt AmplifyBranch.BranchName
  KendraIndexID:
    Value: !GetAtt KendraIndex.Id
  KendraWebCrawlerDataSourceID:
    Value: !GetAtt KendraWebCrawler.Id
  KendraDataSourceRoleARN:
    Value: !GetAtt KendraDataSourceRole.Arn
  LambdaARN:
    Value: !GetAtt AgentHandlerFunction.Arn
  LexBotID:
    Value: !GetAtt LexBot.Id