[アップデート] Amazon Lightsail で事前セットアップ済みの OpenClaw インスタンスが登場しました

#!/bin/bash
# Usage: bash setup-lightsail-openclaw-bedrock-role.sh <lightsail-instance-name> [region]
# Run this in AWS CloudShell in the account where the Lightsail instance lives.

export AWS_PAGER=""

# ANSI colors
BOLD="\033[1m"
CYAN="\033[1;36m"
YELLOW="\033[1;33m"
GREEN="\033[1;32m"
RED="\033[1;31m"
RESET="\033[0m"

# --- CloudShell banner (shown before any arg validation) ---
echo ""
echo -e "${CYAN}${BOLD}+--------------------------------------------------------------+${RESET}"
echo -e "${CYAN}${BOLD}|              OpenClaw Bedrock Role Setup                     |${RESET}"
echo -e "${CYAN}${BOLD}+--------------------------------------------------------------+${RESET}"
echo ""
echo -e "${BOLD}What this script does:${RESET}"
echo -e "  Creates an IAM role in your AWS account so your OpenClaw"
echo -e "  Lightsail instance can call Amazon Bedrock (AI models) on"
echo -e "  your behalf."
echo ""
echo -e "${YELLOW}${BOLD}  Cost notice:${RESET}"
echo -e "  Bedrock charges per token (input + output) for every AI request."
echo -e "  You only pay when the AI is actively processing — there is no"
echo -e "  flat fee. Monitor usage in AWS Cost Explorer > Bedrock."
echo -e "  Pricing: https://aws.amazon.com/bedrock/pricing/"
echo ""
echo -e "${BOLD}  Security:${RESET}"
echo -e "  The role is scoped to your specific Lightsail instance only."
echo -e "  No other AWS principal can assume it. Deleting the role"
echo -e "  immediately revokes Bedrock access for OpenClaw."
echo ""
echo -e "${BOLD}  Required permissions in this account:${RESET}"
echo -e "  iam:CreateRole, iam:PutRolePolicy, iam:UpdateAssumeRolePolicy,"
echo -e "  iam:GetRole, lightsail:GetInstance, sts:GetCallerIdentity"
echo ""
echo -e "${GREEN}${BOLD}  Re-running this script on an existing role is safe.${RESET}"
echo -e "${GREEN}  It only updates trust policy and permissions — nothing is deleted.${RESET}"
echo ""
echo -e "${CYAN}----------------------------------------------------------------${RESET}"
echo ""

# --- Validate args ---
if [[ -z "$1" ]]; then
  echo -e "${RED}Error: missing required argument: <lightsail-instance-name>${RESET}"
  echo -e "Usage: bash $0 <lightsail-instance-name> [region]"
  echo ""
  echo -e "${YELLOW}NOTE: This script must be run in AWS CloudShell, not locally.${RESET}"
  exit 1
fi

set -e

on_error() {
  echo ""
  echo -e "${RED}${BOLD}  Something went wrong.${RESET}"
  echo -e "  ${YELLOW}- Instance name used: ${BOLD}${INSTANCE_NAME}${RESET}${YELLOW} — verify this is correct.${RESET}"
  echo -e "  ${YELLOW}- Region used:        ${BOLD}${REGION}${RESET}${YELLOW} — verify this is correct.${RESET}"
  echo -e "  ${YELLOW}- Verify your current AWS credentials have the permissions mentioned at the start of this output.${RESET}"
  echo -e "  ${CYAN}- This script works best when run in ${BOLD}AWS CloudShell${RESET}${CYAN} (preferred).${RESET}"
  echo ""
}
trap on_error ERR

INSTANCE_NAME="$1"
REGION="${2:-us-east-1}"
CUSTOM_ENDPOINT="${3:-}"  # internal use only

# Use custom endpoint if provided, otherwise default prod endpoint
if [[ -n "$CUSTOM_ENDPOINT" ]]; then
  LIGHTSAIL_ENDPOINT="$CUSTOM_ENDPOINT"
else
  LIGHTSAIL_ENDPOINT="https://lightsail.${REGION}.amazonaws.com"
fi

echo "Region:   $REGION"
echo ""
echo "Fetching Lightsail instance info for: $INSTANCE_NAME"

SUPPORT_CODE=$(aws lightsail get-instance \
  --instance-name "$INSTANCE_NAME" \
  --region "$REGION" \
  --endpoint-url "$LIGHTSAIL_ENDPOINT" \
  --query "instance.supportCode" \
  --output text)

# Validate support code format: "<account>/<instance-id>"
if [[ -z "$SUPPORT_CODE" || "$SUPPORT_CODE" == "None" || "$SUPPORT_CODE" != */* ]]; then
  echo "Error: could not retrieve a valid support code for instance '$INSTANCE_NAME'."
  echo "Make sure the instance name and region are correct and you have lightsail:GetInstance permission."
  exit 1
fi

# Support code format: "131201904162/i-0c26c6396e228734b"
LIGHTSAIL_ACCOUNT=$(echo "$SUPPORT_CODE" | cut -d'/' -f1)
INSTANCE_ID=$(echo "$SUPPORT_CODE" | cut -d'/' -f2)

echo "Instance ID: $INSTANCE_ID"

ROLE_NAME="LightsailRoleFor-${INSTANCE_ID}"
echo "Role name:   $ROLE_NAME"

TRUST_POLICY=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:sts::${LIGHTSAIL_ACCOUNT}:assumed-role/AmazonLightsailInstance/${INSTANCE_ID}"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}
EOF
)

PERMISSIONS_POLICY=$(cat <<EOF
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockInvoke",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels",
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": "*"
    },
    {
      "Sid": "MarketplaceModelAccess",
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:Subscribe",
        "aws-marketplace:Unsubscribe",
        "aws-marketplace:ViewSubscriptions"
      ],
      "Resource": "*"
    }
  ]
}
EOF
)

if aws iam get-role --role-name "$ROLE_NAME" &>/dev/null; then
  echo "Role already exists, updating trust policy..."
  aws iam update-assume-role-policy \
    --role-name "$ROLE_NAME" \
    --policy-document "$TRUST_POLICY"
else
  echo "Creating role..."
  aws iam create-role \
    --role-name "$ROLE_NAME" \
    --assume-role-policy-document "$TRUST_POLICY" \
    --description "Allows OpenClaw on Lightsail instance $INSTANCE_NAME to access Bedrock"
fi

echo "Attaching Bedrock permissions..."
aws iam put-role-policy \
  --role-name "$ROLE_NAME" \
  --policy-name "OpenClawBedrockAccess" \
  --policy-document "$PERMISSIONS_POLICY"

ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
echo ""
echo "Done."
echo "Role ARN: arn:aws:iam::${ACCOUNT_ID}:role/${ROLE_NAME}"