bedrock-alpha: grant methods limit to only one region
- Dominant language
- TypeScript
- Stars
- 12.9k
- Forks
- 4.6k
- Avg merge
- 2d 3h
- Merged PRs (30d)
- 83
Description
### Describe the bug
When using
```ts
const inferenceProfile = CrossRegionInferenceProfile.fromConfig({
geoRegion: CrossRegionInferenceProfileRegion.EU,
model: this.foundationModel,
});
const prompt = new Prompt(this, "DocumentMatcherPrompt", {
promptName: "prompt",
defaultVariant: variant,
variants: [variant],
});
prompt.grantGet(lambdaHandler);
inferenceProfile.grantProfileUsage(lambdaHandler);
inferenceProfile.grantInvoke(lambdaHandler);
```
the lambda does not have access to
```ts
const client = new BedrockRuntimeClient({});
const response = await client.send(new ConverseCommand(commandInput));
```
because the policies created by the grant methods only give access to the current region, but a CrossRegionInferenceProfile means that requests will also go to other regions in the same geoRegion.
### Regression Issue
- [ ] Select this option if this issue appears to be a regression.
### Last Known Working CDK Library Version
_No response_
### Expected Behavior
Calling the client should work.
### Current Behavior
Calling the client throws the following error:
> Your account is not authorized to invoke this API operation with a prompt resource.
### Reproduction Steps
See above
### Possible Solution
The grant methods need to be updated with a list of regions based on the selected geoRegion
### Additional Information/Context
_No response_
### AWS CDK Library version (aws-cdk-lib)
2.235.0
### AWS CDK CLI version
2.1100.3
### Node.js Version
22.21.1
### OS
MacOS
### Language
TypeScript
### Language Version
5.9.3
### Other information
_No response_
Contributor guide
Research direction
Start with CrossRegionInferenceProfile.grantProfileUsage, grantInvoke, and Prompt.grantGet, then reproduce the issue with the TypeScript snippets using ConverseCommand. Trace how each grant builds its policy and update the region coverage from the selected geoRegion; done when the Lambda can invoke the prompt through the cross-region profile without an authorization error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, typescript
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 56/100