BedrockAgentからLambdaを実行するSAMテンプレート

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: bedrock agent

Parameters:
  Model:
    Type: String

Mappings:
  ConstValues:
    lambda1:
      name: "hello1"

Globals:
  Function:
    Timeout: 3

Resources:
  Lambda1:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !FindInMap [ConstValues, lambda1, name]
      CodeUri: lambda1/
      Handler: app.lambda_handler
      Runtime: python3.13
      Architectures:
        - x86_64

  LogGroup1:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Join ["/", ["/aws/lambda", !FindInMap [ConstValues, lambda1, name]]]
      RetentionInDays: 1

  LambdaInvokePermissionForBedrock:
    Type: AWS::Lambda::Permission
    Properties:
      Action: lambda:InvokeFunction
      FunctionName: !GetAtt Lambda1.Arn
      Principal: bedrock.amazonaws.com
      SourceArn: !GetAtt BedrockAgent.AgentArn

  #--------------------------
  # Bedrock Agent
  #--------------------------

  BedrockAgentRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "AmazonBedrockExecutionRoleForAgents_${AWS::StackName}"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action: sts:AssumeRole
            Condition:
              StringEquals:
                aws:SourceAccount: !Sub ${AWS::AccountId}
              ArnLike:
                aws:SourceArn: !Sub arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:agent/*
      Policies:
        - PolicyName: !Sub "AmazonBedrockExecutionRoleForAgents_${AWS::StackName}"
          PolicyDocument:
            Version: 2012-10-17
            Statement:
              - Effect: Allow
                Action:
                  - bedrock:InvokeModel
                  - bedrock:GetInferenceProfile
                  - bedrock:GetFoundationModel
                Resource:
                  - !Sub arn:aws:bedrock:${AWS::Region}:${AWS::AccountId}:inference-profile/*
                  - arn:aws:bedrock:*::foundation-model/*
              - Effect: Allow
                Action:
                  - lambda:InvokeFunction
                Resource: !GetAtt Lambda1.Arn


  BedrockAgent:
    Type: AWS::Bedrock::Agent
    Properties:
      AgentName: DemoAgent
      AgentResourceRoleArn: !GetAtt BedrockAgentRole.Arn
      FoundationModel: !Ref Model
      Instruction: |
        あなたは優秀なアシスタントです。
        質問内容を完全に理解してください。
        情報不足であれば、ユーザに追加情報を要求してください。
        回答は短く要約し、日本語で書いて下さい。
      AutoPrepare: true
      ActionGroups:
        # AIがユーザに追加情報を要求する
        - ActionGroupName: UserInputAction
          ActionGroupState: ENABLED
          ParentActionGroupSignature: AMAZON.UserInput
        # Lambda
        - ActionGroupName: wikipedia
          ActionGroupState: ENABLED
          ActionGroupExecutor:
            Lambda: !GetAtt Lambda1.Arn
          ApiSchema:
            Payload: |
              openapi: 3.0.0
              info:
                title: Lambda
                version: 1.0.0
              paths:
                /search:
                  get:
                    summary: Wikipedia Search
                    description: Wikipediaを検索します
                    operationId: search
                    parameters:
                      - name: search_text
                        in: path
                        description: 検索キーワード
                        required: true
                        schema:
                          type: string
                    responses:
                      "200":
                        description: 検索成功
                        content:
                          application/json:
                            schema:
                              type: object
                              properties:
                                body:
                                  type: string


  BedrockAgentAliasV1:
    Type: AWS::Bedrock::AgentAlias
    Properties:
      AgentAliasName: v1
      AgentId: !Ref BedrockAgent

  # Agentの修正をデプロイするときはAliasを追加すること。
  # 古いAliasは、ロールバック不要になったら、削除して良い。
  #BedrockAgentAliasV2:
  #  Type: AWS::Bedrock::AgentAlias
  #  Properties:
  #    AgentAliasName: v2
  #    AgentId: !Ref BedrockAgent