Amazon BedrockのClaude 3.5 Haiku 低価格で高性能な最新AIモデルを試してみた

- Type: ARM_LAMBDA_CONTAINER
- ComputeType: BUILD_LAMBDA_1GB
- Image: aws/codebuild/amazonlinux-aarch64-lambda-standard:python3.12
の ARMのLambdaを実行環境とするCodeBuild 上で、
SDK BOTO3で STS.Client.get_caller_identity() を実行する処理をBuildSpecで定義。
実行結果は標準のログ出力にJSONで出力し、CloudWatch Logsで確認できるようにしたいです。

この処理を実現するために必要な、IAM、CloudWatchロググループを含む、CloudFormationテンプレートを生成してください。

以下に、ご要望に対応するCloudFormationテンプレートを示します：

AWSTemplateFormatVersion: '2010-09-09'
Description: CodeBuild Project for STS Caller Identity Check with ARM Lambda Environment

Resources:
  # CloudWatch Logsロググループ
  CodeBuildLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/codebuild/sts-identity-check
      RetentionInDays: 30

  # IAMロール
  CodeBuildServiceRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: codebuild.amazonaws.com
            Action: sts:AssumeRole
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
      Policies:
        - PolicyName: STSIdentityAccessPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - sts:GetCallerIdentity
                Resource: '*'

  # CodeBuildプロジェクト
  STSIdentityCheckProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Name: sts-identity-check
      ServiceRole: !GetAtt CodeBuildServiceRole.Arn
      LogsConfig:
        CloudWatchLogs:
          GroupName: !Ref CodeBuildLogGroup
          Status: ENABLED
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        Type: ARM_LAMBDA_CONTAINER
        ComputeType: BUILD_LAMBDA_1GB
        Image: aws/codebuild/amazonlinux-aarch64-lambda-standard:python3.12
        ImagePullCredentialsType: CODEBUILD
      Source:
        Type: NO_SOURCE
        BuildSpec: |
          version: 0.2
          phases:
            install:
              runtime-versions:
                python: 3.12
            build:
              commands:
                - |
                  python3 -c "
                  import boto3
                  import json
                  import sys

                  try:
                      # STSクライアントの作成
                      sts_client = boto3.client('sts')

                      # 呼び出し元のアイデンティティを取得
                      caller_identity = sts_client.get_caller_identity()

                      # 標準出力にJSONで出力
                      print(json.dumps({
                          'UserId': caller_identity['UserId'],
                          'Account': caller_identity['Account'],
                          'Arn': caller_identity['Arn']
                      }, indent=2))

                  except Exception as e:
                      print(f'Error retrieving caller identity: {str(e)}', file=sys.stderr)
                      sys.exit(1)
                  "

Outputs:
  CodeBuildProjectName:
    Description: Name of the CodeBuild Project
    Value: !Ref STSIdentityCheckProject

  CloudWatchLogGroupName:
    Description: Name of the CloudWatch Logs Group
    Value: !Ref CodeBuildLogGroup

{
  "UserId": "AROAEXAMPLEID:session-name",
  "Account": "123456789012",
  "Arn": "arn:aws:sts::123456789012:assumed-role/role-name/session-name"
}

はい、以下のようなCloudFormationテンプレートを生成することができます。このテンプレートでは、ARM_LAMBDA_CONTAINERのCodeBuildプロジェクトを作成し、BOTO3を使ってSTS.Client.get_caller_identity()の処理を実行し、その結果を標準ログ出力に出力するように設定しています。また、CloudWatchログにもログ出力されるよう設定しています。

AWSTemplateFormatVersion: '2010-09-09'
Description: CodeBuild project to execute BOTO3 STS get_caller_identity on ARM Lambda

Parameters:
  CodeBuildProjectName:
    Type: String
    Default: my-codebuild-project

Resources:

  CloudWatchLogsGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: /aws/codebuild/my-codebuild-project
      RetentionInDays: 7

  CodeBuildRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: codebuild.amazonaws.com
          Action: 'sts:AssumeRole'
      ManagedPolicyArns:
      - arn:aws:iam::aws:policy/CloudWatchLogsFullAccess
      - arn:aws:iam::aws:policy/AWSLambda_FullAccess
      - arn:aws:iam::aws:policy/AmazonSQSFullAccess
      - arn:aws:iam::aws:policy/AmazonS3FullAccess

  CodeBuildProject:
    Type: AWS::CodeBuild::Project
    Properties:
      Artifacts:
        Type: NO_ARTIFACTS
      Environment:
        ComputeType: BUILD_LAMBDA_1GB
        Image: aws/codebuild/amazonlinux-aarch64-lambda-standard:python3.12
        Type: ARM_LAMBDA_CONTAINER
        EnvironmentVariables:
        - Name: AWS_DEFAULT_REGION
          Value: !Ref AWS::Region
      Name: !Ref CodeBuildProjectName
      ServiceRole: !GetAtt CodeBuildRole.Arn
      Source:
        BuildSpec: |
          version: 0.2

          phases:
            install:
              runtime-versions:
                python: 3.12
            pre_build:
              commands:
                - pip install boto3
            build:
              commands:
                - |
                  import boto3
                  import json
                  sts = boto3.client('sts')
                  result = sts.get_caller_identity()
                  print(json.dumps(result, indent=2))
            post_build:
              commands:
                - echo "CodeBuild project finished"
        Type: CODEPIPELINE
      Logs:
        CloudWatchLogs:
          GroupName: !Ref CloudWatchLogsGroup
          StreamName: !Ref CodeBuildProject

Outputs:
  CodeBuildProjectName:
    Description: The name of the CodeBuild project
    Value: !Ref CodeBuildProject