Bedrockナレッジベースに外部システムのAPI仕様を格納してDevOps Agentのログ調査に活用してみた

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Parameters:
  Domain:
    Type: String
    Description: Cognitoユーザープール用のドメイン
Globals:
  Function:
    Timeout: 600
    Tracing: Active
  Api:
    TracingEnabled: true
Resources:
  KnowledgeBase:
    Type: AWS::Bedrock::KnowledgeBase
    Properties:
      Description: サンプルシステムのナレッジベース
      KnowledgeBaseConfiguration: 
        Type: VECTOR
        VectorKnowledgeBaseConfiguration:
          EmbeddingModelArn: arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-embed-text-v2:0
      Name: external-system-knowledge-base
      RoleArn: !GetAtt KnowledgeBaseRole.Arn
      StorageConfiguration: 
        Type: S3_VECTORS
        S3VectorsConfiguration:
          IndexArn: !Ref KnowledgeBaseIndex
  KnowledgeBaseRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: KnowledgeBaseS3VectorsPolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - aws-marketplace:Subscribe
                  - aws-marketplace:ViewSubscriptions
                  - aws-marketplace:Unsubscribe
                Resource: 
                  - '*'                  
              - Effect: Allow
                Action:
                  - bedrock:InvokeModel
                Resource: 
                  - arn:aws:bedrock:ap-northeast-1::foundation-model/amazon.titan-embed-text-v2:0
              - Effect: Allow
                Action:
                  - s3:ListBucket
                  - s3:GetObject
                Resource: 
                  - !Sub arn:aws:s3:::${KnowledgeBaseSrc}
                  - !Sub arn:aws:s3:::${KnowledgeBaseSrc}/*
              - Effect: Allow
                Action:
                  - s3vectors:DeleteVectors
                  - s3vectors:GetIndex
                  - s3vectors:GetVectors
                  - s3vectors:QueryVectors
                  - s3vectors:PutVectors
                Resource: 
                  - !Ref KnowledgeBaseIndex
  KnowledgeBaseSrc:  
    Type: AWS::S3::Bucket
  KnowledgeBaseVectorDB:  
    Type: AWS::S3Vectors::VectorBucket
  KnowledgeBaseIndex:
    Type: AWS::S3Vectors::Index
    Properties:
      DataType: float32
      Dimension: 1024
      DistanceMetric: euclidean
      MetadataConfiguration: 
        NonFilterableMetadataKeys: 
          - AMAZON_BEDROCK_TEXT
          - AMAZON_BEDROCK_METADATA
      VectorBucketArn: !Ref KnowledgeBaseVectorDB
  KnowledgeBaseDataSource:
    Type: AWS::Bedrock::DataSource
    Properties:
      DataSourceConfiguration: 
        Type: S3
        S3Configuration:
          BucketArn: !GetAtt KnowledgeBaseSrc.Arn
      KnowledgeBaseId: !Ref KnowledgeBase
      Name: external-system-knowledge-base-data-source
  McpFunction:
    Type: AWS::Serverless::Function
    Properties:
      CodeUri: mcp/
      Handler: app.lambdaHandler
      Runtime: nodejs24.x
      Architectures:
      - x86_64
      Environment:
        Variables:
          KNOWLEDGE_BASE_ID: !Ref KnowledgeBase
          MODEL_ARN: !Sub arn:aws:bedrock:ap-northeast-1:${AWS::AccountId}:inference-profile/global.anthropic.claude-sonnet-4-5-20250929-v1:0
      Policies:
        - Statement:
          - Effect: Allow
            Action:
              - bedrock:RetrieveAndGenerate
              - bedrock:Retrieve
              - bedrock:GetInferenceProfile
              - bedrock:InvokeModel
            Resource: '*'
      Events:
        mcp:
          Type: Api
          Properties:
            Path: /mcp
            Method: get
            RestApiId: !Ref McpApi
  McpApi:
    Type: AWS::Serverless::Api
    Properties:
      StageName: prd
      DefinitionBody:
        openapi: "3.0.1"
        info:
          title: "stream-mcp"
          version: "1.0"
        servers: []
        paths:
          /mcp:
            get:
              summary: Get External System Knowledge Base
              parameters: 
                - in: query
                  name: q
                  required: true 
                  schema:
                    type: string                       
                    description: ナレッジベースで検索したい内容
              operationId: getKnowledgeBase
              x-amazon-apigateway-integration:
                type: "aws_proxy"
                uri:
                  Fn::Sub: arn:aws:apigateway:${AWS::Region}:lambda:path/2021-11-15/functions/${McpFunction.Arn}/response-streaming-invocations
                httpMethod: "POST"
                passthroughBehavior: "when_no_match"
                responseTransferMode: "STREAM"
                contentHandling: "CONVERT_TO_TEXT"
              responses:
                "200":
                  description: レスポンスの取得に成功
                  content:
                    text/event-stream:
                      schema:
                        type: string
              security:
                - sigv4: []                        
        components:
          securitySchemes:
            sigv4:
              type: apiKey
              name: Authorization
              in: header
              x-amazon-apigateway-authtype: awsSigv4                      
  Gateway:
    Type: AWS::BedrockAgentCore::Gateway
    Properties:
      AuthorizerType: CUSTOM_JWT
      AuthorizerConfiguration:
        CustomJWTAuthorizer: 
          DiscoveryUrl: !Sub https://cognito-idp.${AWS::Region}.amazonaws.com/${AgentCoreGWUserPool}/.well-known/openid-configuration
          AllowedClients:
            - !Ref AgentCoreGWClient
      Description: DevOps Agentと連携させるためのゲートウェイ
      Name: gateway-for-devops-agent
      ProtocolType: MCP
      RoleArn: !GetAtt GatewayRole.Arn
      ExceptionLevel: DEBUG
  GatewayTarget:
    Type: AWS::BedrockAgentCore::GatewayTarget
    Properties:
      CredentialProviderConfigurations: 
        - CredentialProviderType: GATEWAY_IAM_ROLE
      GatewayIdentifier: !Ref Gateway
      Name: api-gateway-target
      TargetConfiguration: 
        Mcp:
          ApiGateway:
            RestApiId: !Ref McpApi
            Stage: prd
            ApiGatewayToolConfiguration:
              ToolFilters:
                - FilterPath: /mcp
                  Methods:
                    - GET
  GatewayRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
          - Effect: Allow
            Principal:
              Service: bedrock-agentcore.amazonaws.com
            Action:
              - sts:AssumeRole
      Policies:
        - PolicyName: GatewayRolePolicy
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              - Effect: Allow
                Action:
                  - execute-api:Invoke
                Resource: 
                  - !Sub arn:aws:execute-api:${AWS::Region}:${AWS::AccountId}:${McpApi}/*
  AgentCoreGWUserPool:
    Type: AWS::Cognito::UserPool
  AgentCoreGWResourceServer:
    Type: AWS::Cognito::UserPoolResourceServer
    Properties:
      Identifier: gateway
      Name: gateway
      Scopes:
        - ScopeName: genesis-gateway:invoke
          ScopeDescription: Scope for invoking the genesis gateway
      UserPoolId: !Ref AgentCoreGWUserPool    
  AgentCoreGWClient:
    Type: AWS::Cognito::UserPoolClient
    Properties:
      UserPoolId: !Ref AgentCoreGWUserPool
      GenerateSecret: true
      SupportedIdentityProviders: 
        - COGNITO
      AllowedOAuthFlows:
        - client_credentials
      AllowedOAuthFlowsUserPoolClient: true
      AllowedOAuthScopes:
        - gateway/genesis-gateway:invoke
    DependsOn: AgentCoreGWResourceServer
  AgentCoreGWUserPoolDomain:
    Type: AWS::Cognito::UserPoolDomain
    Properties:
      UserPoolId: !Ref AgentCoreGWUserPool
      Domain: !Ref Domain