Production doc builds - 2021/10/12 00:16:19 UTC

aws-quickstart · Oct 12, 2021 · 7e12941 · 7e12941
1 parent 7e9ed2a
commit 7e12941
Show file tree

Hide file tree

Showing 8 changed files with 128 additions and 247 deletions.
diff --git a/docs/boilerplate b/docs/boilerplate
diff --git a/docs/generated/parameters/index.adoc b/docs/generated/parameters/index.adoc
@@ -1,3 +1 @@
-
-=== Parameters for launching stack creation
-include::lex_bot_kendra_master.template.adoc[]
+// placeholder
diff --git a/docs/generated/services/metadata.adoc b/docs/generated/services/metadata.adoc
@@ -1,19 +1 @@
-
-:template_aws_cloudformation_stack:
-:template_aws_iam_policy:
-:template_aws_iam_role:
-:template_aws_iam_servicelinkedrole:
-:template_aws_lambda_function:
-:template_aws_lambda_layerversion:
-:template_aws_lambda_permission:
-:template_aws_s3_bucket:
-:template_cloudformation:
-:template_copyzips:
-:template_custom_copyzips:
-:template_custom_kendracustomresource:
-:template_custom_lexbotopsfunctiontrigger:
-:template_iam:
-:template_kendracustomresource:
-:template_lambda:
-:template_lexbotopsfunctiontrigger:
-:template_s3:
+// placeholder
diff --git a/index.html b/index.html
diff --git a/templates/kendra_resource.template.yaml b/templates/kendra_resource.template.yaml
@@ -80,30 +80,35 @@ Resources:
           - "logs:CreateLogStream"
           - "logs:PutLogEvents"
           Resource:
-          - arn:aws:logs:*:*:*
+           !Sub "arn:${AWS::Partition}:logs:*:*:*"
         - Effect: Allow
           Action:
           - "s3:GetObject"
           - "s3:ListBucket"
           - "s3:HeadBucket"
           Resource:
-          - !Sub "arn:aws:s3:::${ArtifactsS3BucketName}"
-          - "arn:aws:s3:*:*:accesspoint/*"
-          - !Sub "arn:aws:s3:::${ArtifactsS3BucketName}/*"
-          - !Sub "arn:aws:s3:::${KendraS3BucketName}"
-          - !Sub "arn:aws:s3:::${KendraS3BucketName}/*"
+          - !Sub "arn:${AWS::Partition}:s3:::${ArtifactsS3BucketName}"
+          - !Sub "arn:${AWS::Partition}:s3:::${ArtifactsS3BucketName}/*"
+          - !Sub "arn:${AWS::Partition}:s3:::${KendraS3BucketName}"
+          - !Sub "arn:${AWS::Partition}:s3:::${KendraS3BucketName}/*"
+        - Effect: Allow
+          Action:
+          - "kendra:CreateIndex"
+          Resource:
+          - "*"
         - Effect: Allow
           Action:
           - "kendra:DeleteIndex"
           - "kendra:CreateDataSource"
           - "kendra:DescribeIndex"
-          - "kendra:CreateIndex"
           - "kendra:StartDataSourceSyncJob"
           - "kendra:CreateFaq"
           - "kendra:TagResource"
           - "kendra:UntagResource"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:kendra:${AWS::Region}:${AWS::AccountId}:index/*"
+          - !Sub "arn:${AWS::Partition}:kendra:${AWS::Region}:${AWS::AccountId}:index/*/data-source/*"
+          - !Sub "arn:${AWS::Partition}:kendra:${AWS::Region}:${AWS::AccountId}:index/*/faq/*"
         - Effect: Allow
           Action:
           - "iam:GetRole"
@@ -116,15 +121,15 @@ Resources:
           - "lambda:AddPermission"
           - "lambda:RemovePermission"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*"
         - Effect: Allow
           Action:
           - "events:PutRule"
           - "events:DeleteRule"
           - "events:PutTargets"
           - "events:RemoveTargets"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/*"
 
   KendraOperationsFunction:
     DependsOn:

diff --git a/templates/lambda_kendra_search.template.yaml b/templates/lambda_kendra_search.template.yaml
@@ -54,18 +54,17 @@ Resources:
           - "logs:CreateLogStream"
           - "logs:PutLogEvents"
           Resource:
-          - arn:aws:logs:*:*:*
+          - !Sub "arn:${AWS::Partition}:logs:*:*:*"
         - Effect: Allow
           Action:
           - "s3:GetObject"
           - "s3:ListBucket"
           - "s3:HeadBucket"
           Resource:
-          - !Sub "arn:aws:s3:::${ArtifactsS3BucketName}"
-          - "arn:aws:s3:*:*:accesspoint/*"
-          - !Sub "arn:aws:s3:::${ArtifactsS3BucketName}/*"
-          - !Sub "arn:aws:s3:::${KendraS3BucketName}"
-          - !Sub "arn:aws:s3:::${KendraS3BucketName}/*"
+          - !Sub "arn:${AWS::Partition}:s3:::${ArtifactsS3BucketName}"
+          - !Sub "arn:${AWS::Partition}:s3:::${ArtifactsS3BucketName}/*"
+          - !Sub "arn:${AWS::Partition}:s3:::${KendraS3BucketName}"
+          - !Sub "arn:${AWS::Partition}:s3:::${KendraS3BucketName}/*"
         - Effect: Allow
           Action:
           - "lex:DeleteBot"
@@ -83,12 +82,23 @@ Resources:
           - "lex:DeleteIntentVersion"
           - "lex:GetBuiltinIntents"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:lex:${AWS::Region}:${AWS::AccountId}:bot:*"
+          - !Sub "arn:${AWS::Partition}:lex:${AWS::Region}:${AWS::AccountId}:intent:*:*"
+          - !Sub "arn:${AWS::Partition}:lex:${AWS::Region}:${AWS::AccountId}:slottype:*:*"
         - Effect: Allow
           Action:
           - "kendra:Query"
           Resource:
-          - "*"
+          - Fn::Join:
+              - ""
+              - - "arn:"
+                - !Ref 'AWS::Partition'
+                - ":kendra:"
+                - !Ref 'AWS::Region'
+                - ":"
+                - !Ref 'AWS::AccountId'
+                - ":index/"
+                - Fn::ImportValue: KendraIndexID
         - Effect: Allow
           Action:
           - "iam:GetRole"
@@ -101,7 +111,7 @@ Resources:
           - "lambda:AddPermission"
           - "lambda:RemovePermission"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*"
 
   LambdaFunction:
     Type: AWS::Lambda::Function

diff --git a/templates/lex_bot_kendra_master.template.yaml b/templates/lex_bot_kendra_master.template.yaml
@@ -1,5 +1,5 @@
 AWSTemplateFormatVersion: 2010-09-09
-Description: A master template which creates a Lex Bot and integrate it with a Kendra Index with S3 bucket as a document respository. (qs-1qu380l7l)
+Description: A primary template which creates a Lex Bot and integrate it with a Kendra Index with S3 bucket as a document respository. (qs-1qu380l7l)
 Metadata:
   QuickStartDocumentation:
     EntrypointName: "Parameters for launching stack creation"
@@ -167,7 +167,7 @@ Resources:
           - "logs:CreateLogStream"
           - "logs:PutLogEvents"
           Resource:
-          - arn:aws:logs:*:*:*
+          - !Sub "arn:${AWS::Partition}:logs:*:*:*"
         - Effect: Allow
           Action:
           - "s3:GetObject"
@@ -176,23 +176,22 @@ Resources:
           - "s3:PutObjectTagging"
           - "s3:DeleteObject"
           Resource:
-          - "arn:aws:s3:*:*:accesspoint/*"
           - !Join
             - ''
-            - - 'arn:aws:s3:::'
+            - - !Sub 'arn:${AWS::Partition}:s3:::'
               - !Ref RegionalArtifactBucket
           - !Join
             - ''
-            - - 'arn:aws:s3:::'
+            - - !Sub 'arn:${AWS::Partition}:s3:::'
               - !Ref RegionalArtifactBucket
               - '/*'
           - !Join
             - ''
-            - - 'arn:aws:s3:::'
+            - - !Sub 'arn:${AWS::Partition}:s3:::'
               - !Ref QSS3BucketName
           - !Join
             - ''
-            - - 'arn:aws:s3:::'
+            - - !Sub 'arn:${AWS::Partition}:s3:::'
               - !Ref QSS3BucketName
               - '/*'
         - Effect: Allow
@@ -205,7 +204,8 @@ Resources:
           Action:
           - lambda:InvokeFunction
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*"
+
   RegionalArtifactBucket:
     Type: AWS::S3::Bucket
 
@@ -325,7 +325,6 @@ Resources:
         QSS3KeyPrefix: !Ref QSS3KeyPrefix
         ArtifactsS3BucketName: !Ref 'RegionalArtifactBucket'
         KendraS3BucketName: !Ref KendraS3BucketName
-
   LexBotStack:
     Type: 'AWS::CloudFormation::Stack'
     Properties:

diff --git a/templates/lex_bot_resource.template.yaml b/templates/lex_bot_resource.template.yaml
@@ -47,14 +47,8 @@ Resources:
             StringEquals:
               sts:ExternalId: !Ref ExternalID
       ManagedPolicyArns:
-        - "arn:aws:iam::aws:policy/AmazonLexReadOnly"
-        - "arn:aws:iam::aws:policy/AmazonLexRunBotsOnly"
-
-  LexSLRole:
-    Type: AWS::IAM::ServiceLinkedRole
-    Properties:
-      AWSServiceName: lex.amazonaws.com
-      Description: Amazon Lex Service Lined Role
+        - !Sub "arn:${AWS::Partition}:iam::${AWS::Partition}:policy/AmazonLexReadOnly"
+        - !Sub "arn:${AWS::Partition}:iam::${AWS::Partition}:policy/AmazonLexRunBotsOnly"
 
   LexBotIAMRole:
     Type: AWS::IAM::Role
@@ -90,16 +84,15 @@ Resources:
           - "logs:CreateLogStream"
           - "logs:PutLogEvents"
           Resource:
-          - arn:aws:logs:*:*:*
+          - !Sub "arn:${AWS::Partition}:logs:*:*:*"
         - Effect: Allow
           Action:
           - "s3:GetObject"
           - "s3:ListBucket"
           - "s3:HeadBucket"
           Resource:
-          - !Sub "arn:aws:s3:::${ArtifactsS3BucketName}"
-          - "arn:aws:s3:*:*:accesspoint/*"
-          - !Sub "arn:aws:s3:::${ArtifactsS3BucketName}/*"
+          - !Sub "arn:${AWS::Partition}:s3:::${ArtifactsS3BucketName}"
+          - !Sub "arn:${AWS::Partition}:s3:::${ArtifactsS3BucketName}/*"
         - Effect: Allow
           Action:
           - "lex:DeleteBot"
@@ -131,7 +124,9 @@ Resources:
           - "lex:CreateIntentVersion"
           - "lex:PutBotAlias"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:lex:${AWS::Region}:${AWS::AccountId}:bot:*"
+          - !Sub "arn:${AWS::Partition}:lex:${AWS::Region}:${AWS::AccountId}:intent:*:*"
+          - !Sub "arn:${AWS::Partition}:lex:${AWS::Region}:${AWS::AccountId}:slottype:*:*"
         - Effect: Allow
           Action:
           - "iam:GetRole"
@@ -143,20 +138,29 @@ Resources:
           - "lambda:AddPermission"
           - "lambda:RemovePermission"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:lambda:${AWS::Region}:${AWS::AccountId}:function:*"
         - Effect: Allow
           Action:
           - "events:PutRule"
           - "events:DeleteRule"
           - "events:PutTargets"
           - "events:RemoveTargets"
           Resource:
-          - "*"
+          - !Sub "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/*"
         - Effect: Allow
           Action:
           - "kendra:Query"
           Resource:
-          - "*"
+          - Fn::Join:
+              - ""
+              - - "arn:"
+                - !Ref 'AWS::Partition'
+                - ":kendra:"
+                - !Ref 'AWS::Region'
+                - ":"
+                - !Ref 'AWS::AccountId'
+                - ":index/"
+                - Fn::ImportValue: KendraIndexID
 
   CrHelperLayer:
     Type: AWS::Lambda::LayerVersion
@@ -211,4 +215,3 @@ Outputs:
   LexBotName:
     Description: Lex Bot Name
     Value: !GetAtt LexBotOpsFunctionTrigger.BotName
-