Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
82 changes: 41 additions & 41 deletions browser_custom.tf
Original file line number Diff line number Diff line change
Expand Up @@ -5,148 +5,148 @@ locals {
# Browser name is now validated directly in the variable definition
# No need to sanitize here as the validation will prevent invalid names
browser_name = var.browser_name

# Data Plane Permissions

# Permissions to manage a specific browser session
browser_session_perms = [
"bedrock-agentcore:GetBrowserSession",
"bedrock-agentcore:ListBrowserSessions",
"bedrock-agentcore:StartBrowserSession",
"bedrock-agentcore:StopBrowserSession"
]

# Permissions to connect to a browser live view or automation stream
browser_stream_perms = [
"bedrock-agentcore:UpdateBrowserStream",
"bedrock-agentcore:ConnectBrowserAutomationStream",
"bedrock-agentcore:ConnectBrowserLiveViewStream"
]

# Control Plane Permissions

# Grants control plane operations to manage the browser (CRUD)
browser_admin_perms = [
"bedrock-agentcore:CreateBrowser",
"bedrock-agentcore:DeleteBrowser",
"bedrock-agentcore:GetBrowser",
"bedrock-agentcore:ListBrowsers"
]

# Permissions for reading browser information
browser_read_perms = [
"bedrock-agentcore:GetBrowser",
"bedrock-agentcore:GetBrowserSession"
]

# Permissions for listing browser resources
browser_list_perms = [
"bedrock-agentcore:ListBrowsers",
"bedrock-agentcore:ListBrowserSessions"
]

# Permissions for using browser functionality
browser_use_perms = [
"bedrock-agentcore:StartBrowserSession",
"bedrock-agentcore:UpdateBrowserStream",
"bedrock-agentcore:StopBrowserSession"
]

# Combined permissions for full access
browser_full_access_perms = distinct(concat(
local.browser_session_perms,
local.browser_stream_perms,
local.browser_admin_perms
))

# Policy documents

# Browser full access policy document
browser_full_access_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserFullAccess"
Effect = "Allow"
Action = local.browser_full_access_perms
Sid = "BedrockAgentCoreBrowserFullAccess"
Effect = "Allow"
Action = local.browser_full_access_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
}

# Browser session policy document
browser_session_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserSession"
Effect = "Allow"
Action = local.browser_session_perms
Sid = "BedrockAgentCoreBrowserSession"
Effect = "Allow"
Action = local.browser_session_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
}

# Browser stream policy document
browser_stream_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserStream"
Effect = "Allow"
Action = local.browser_stream_perms
Sid = "BedrockAgentCoreBrowserStream"
Effect = "Allow"
Action = local.browser_stream_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
}

# Browser admin policy document
browser_admin_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserAdmin"
Effect = "Allow"
Action = local.browser_admin_perms
Sid = "BedrockAgentCoreBrowserAdmin"
Effect = "Allow"
Action = local.browser_admin_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
}

# Browser read policy document
browser_read_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserRead"
Effect = "Allow"
Action = local.browser_read_perms
Sid = "BedrockAgentCoreBrowserRead"
Effect = "Allow"
Action = local.browser_read_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
}

# Browser list policy document
browser_list_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserList"
Effect = "Allow"
Action = local.browser_list_perms
Sid = "BedrockAgentCoreBrowserList"
Effect = "Allow"
Action = local.browser_list_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
}

# Browser use policy document
browser_use_policy_doc = {
Version = "2012-10-17"
Statement = [
{
Sid = "BedrockAgentCoreBrowserUse"
Effect = "Allow"
Action = local.browser_use_perms
Sid = "BedrockAgentCoreBrowserUse"
Effect = "Allow"
Action = local.browser_use_perms
Resource = "arn:aws:bedrock-agentcore:*:*:browser/*"
}
]
Expand All @@ -158,10 +158,10 @@ resource "awscc_bedrockagentcore_browser_custom" "agent_browser" {
name = "${random_string.solution_prefix.result}_${local.browser_name}"
description = var.browser_description
execution_role_arn = var.browser_role_arn != null ? var.browser_role_arn : aws_iam_role.browser_role[0].arn

network_configuration = {
network_mode = var.browser_network_mode
vpc_config = var.browser_network_mode == "VPC" ? {
vpc_config = var.browser_network_mode == "VPC" ? {
security_groups = var.browser_network_configuration.security_groups
subnets = var.browser_network_configuration.subnets
} : null
Expand All @@ -176,7 +176,7 @@ resource "awscc_bedrockagentcore_browser_custom" "agent_browser" {
} : null

tags = var.browser_tags

# Explicit dependency to avoid race conditions with IAM role creation
depends_on = [
aws_iam_role.browser_role,
Expand Down
Loading