aws / aws/aws-cdk

bedrock-alpha: grant methods limit to only one region

Open
#36,774 6 comments 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-lambda bug effort/medium p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When using
```ts
const inferenceProfile = CrossRegionInferenceProfile.fromConfig({
geoRegion: CrossRegionInferenceProfileRegion.EU,
model: this.foundationModel,
});

const prompt = new Prompt(this, "DocumentMatcherPrompt", {
promptName: "prompt",
defaultVariant: variant,
variants: [variant],
});

prompt.grantGet(lambdaHandler);
inferenceProfile.grantProfileUsage(lambdaHandler);
inferenceProfile.grantInvoke(lambdaHandler);
```

the lambda does not have access to

```ts
const client = new BedrockRuntimeClient({});
const response = await client.send(new ConverseCommand(commandInput));
```

because the policies created by the grant methods only give access to the current region, but a CrossRegionInferenceProfile means that requests will also go to other regions in the same geoRegion.

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Library Version

_No response_

### Expected Behavior

Calling the client should work.

### Current Behavior

Calling the client throws the following error:
> Your account is not authorized to invoke this API operation with a prompt resource.

### Reproduction Steps

See above

### Possible Solution

The grant methods need to be updated with a list of regions based on the selected geoRegion

### Additional Information/Context

_No response_

### AWS CDK Library version (aws-cdk-lib)

2.235.0

### AWS CDK CLI version

2.1100.3

### Node.js Version

22.21.1

### OS

MacOS

### Language

TypeScript

### Language Version

5.9.3

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with CrossRegionInferenceProfile.grantProfileUsage, grantInvoke, and Prompt.grantGet, then reproduce the issue with the TypeScript snippets using ConverseCommand. Trace how each grant builds its policy and update the region coverage from the selected geoRegion; done when the Lambda can invoke the prompt through the cross-region profile without an authorization error.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, typescript
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
56/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.