Jerad
8bb4db3009
* feat(cdk): reorganize CDK samples into python/ and typescript/ folders - Move existing Python CDK samples to cdk/python/ - Add TypeScript CDK samples folder with knowledge-base-rag-agent - Update cdk/README.md with language comparison table - Update parent README with new paths and TypeScript mention - Add cdk/python/README.md for Python-specific guidance 🤖 Assisted by Amazon Q Developer * docs: add Jerad Engebreth to CONTRIBUTORS.md 🤖 Assisted by Amazon Q Developer * fix(cdk/typescript): document known vulnerabilities and fix npm workspaces build - Add Known Dependency Vulnerabilities section to README documenting upstream issues in aws-amplify (fast-xml-parser, lodash) - Add build/test scripts to Lambda layer package.json to fix npm workspaces build command 🤖 Assisted by Amazon Q Developer * fix(security): add HEALTHCHECK and non-root USER to Dockerfile - Add HEALTHCHECK instruction for container orchestration - Create non-root appuser for security best practices - Addresses CKV_DOCKER_2, CKV_DOCKER_3 security findings * fix(security): address CodeQL findings for insecure randomness and HTML sanitization - Replace Math.random() with crypto.randomBytes() for session ID generation - Use iterative sanitization loop to handle nested/obfuscated HTML tags - Addresses CodeQL insecure randomness and incomplete sanitization findings * fix(security): improve HTML sanitization to address CodeQL findings - Handle closing tags with spaces like </script > - Add data: and vbscript: URL scheme blocking - Use tag-based approach instead of content-matching regex - Add more dangerous tags (form, input, button, etc.) * remove unused import * fix(lint): fix import ordering and remove extra blank lines - Sort imports alphabetically (logging before os) - Remove extra blank line in knowledge_base.py - Consistent import grouping (stdlib, then third-party) * fix(security): use HTML entity encoding instead of regex-based sanitization - Replace regex-based tag stripping with HTML entity encoding - Encode all special characters (&, <, >, ", ', /, `, =) - This approach is CodeQL-compliant and more secure - Regex-based HTML filtering is inherently flawed * fix(lint): add __all__ to fix F401 unused import warnings - Add __all__ exports to infra_utils/__init__.py files - Explicitly declares AgentCoreRole as public API * style: apply ruff formatting to all Python files in 04-infrastructure-as-code - Format 32 Python files with ruff - Includes CDK Python samples, Terraform samples, and TypeScript agent code * refactor: rename project from bedrock-agentcore-template to knowledge-base-rag-agent - Update package.json names for root and infrastructure packages - Update README and docs with new project name and paths - Update CloudWatch, SNS, KMS, and Cognito resource names - Regenerate package-lock.json with new package names * refactor: complete project rename to knowledge-base-rag-agent - Update README title and all documentation headers - Update TypeScript stack descriptions and resource names - Update Python agent module docstrings - Update Dockerfile header comment - Update Lambda function package description - Rename runtime to knowledge_base_rag_agent - Rename memory to knowledge_base_rag_agent_memory - Rename API to Knowledge Base RAG Agent API - Update Secrets Manager secret name * fix: correct Docker references and fix Lambda bundling - Update README and docs to clarify Docker is for AgentCore Runtime container, not Lambda bundling - Add @aws-lambda-powertools/logger dependency for Lambda function - Add esbuild as dev dependency for NodejsFunction bundling - Fix S3 bucket deployment to use single deployment with auto content-type detection - Deploy config.json separately with prune:false to preserve other files --------- Co-authored-by: Jerad Engebreth <awsjerad@amazon.com>
61 lines
2.7 KiB
JSON
61 lines
2.7 KiB
JSON
{
|
|
"app": "python3 app.py",
|
|
"watch": {
|
|
"include": [
|
|
"**"
|
|
],
|
|
"exclude": [
|
|
"README.md",
|
|
"cdk*.json",
|
|
"requirements*.txt",
|
|
"source.bat",
|
|
"**/__pycache__",
|
|
"**/*.pyc"
|
|
]
|
|
},
|
|
"context": {
|
|
"@aws-cdk/aws-lambda:recognizeLayerVersion": true,
|
|
"@aws-cdk/core:checkSecretUsage": true,
|
|
"@aws-cdk/core:target-partitions": [
|
|
"aws",
|
|
"aws-cn"
|
|
],
|
|
"@aws-cdk-containers/ecs-service-extensions:enableDefaultLogDriver": true,
|
|
"@aws-cdk/aws-ec2:uniqueImdsv2TemplateName": true,
|
|
"@aws-cdk/aws-ecs:arnFormatIncludesClusterName": true,
|
|
"@aws-cdk/aws-iam:minimizePolicies": true,
|
|
"@aws-cdk/core:validateSnapshotRemovalPolicy": true,
|
|
"@aws-cdk/aws-codepipeline:crossAccountKeyAliasStackSafeResourceName": true,
|
|
"@aws-cdk/aws-s3:createDefaultLoggingPolicy": true,
|
|
"@aws-cdk/aws-sns-subscriptions:restrictSqsDescryption": true,
|
|
"@aws-cdk/aws-apigateway:disableCloudWatchRole": true,
|
|
"@aws-cdk/core:enablePartitionLiterals": true,
|
|
"@aws-cdk/aws-events:eventsTargetQueueSameAccount": true,
|
|
"@aws-cdk/aws-iam:standardizedServicePrincipals": true,
|
|
"@aws-cdk/aws-ecs:disableExplicitDeploymentControllerForCircuitBreaker": true,
|
|
"@aws-cdk/aws-iam:importedRoleStackSafeDefaultPolicyName": true,
|
|
"@aws-cdk/aws-s3:serverAccessLogsUseBucketPolicy": true,
|
|
"@aws-cdk/aws-route53-patters:useCertificate": true,
|
|
"@aws-cdk/customresources:installLatestAwsSdkDefault": false,
|
|
"@aws-cdk/aws-rds:databaseProxyUniqueResourceName": true,
|
|
"@aws-cdk/aws-codedeploy:removeAlarmsFromDeploymentGroup": true,
|
|
"@aws-cdk/aws-apigateway:authorizerChangeDeploymentLogicalId": true,
|
|
"@aws-cdk/aws-ec2:launchTemplateDefaultUserData": true,
|
|
"@aws-cdk/aws-secretsmanager:useAttachedSecretResourcePolicyForSecretTargetAttachments": true,
|
|
"@aws-cdk/aws-redshift:columnId": true,
|
|
"@aws-cdk/aws-stepfunctions-tasks:enableLogging": true,
|
|
"@aws-cdk/aws-ec2:restrictDefaultSecurityGroup": true,
|
|
"@aws-cdk/aws-apigateway:requestValidatorUniqueId": true,
|
|
"@aws-cdk/aws-kms:aliasNameRef": true,
|
|
"@aws-cdk/aws-autoscaling:generateLaunchTemplateInsteadOfLaunchConfig": true,
|
|
"@aws-cdk/core:includePrefixInUniqueNameGeneration": true,
|
|
"@aws-cdk/aws-efs:denyAnonymousAccess": true,
|
|
"@aws-cdk/aws-opensearchservice:enableLogging": true,
|
|
"@aws-cdk/aws-nordicapis-apigateway:authorizerChangeDeploymentLogicalId": true,
|
|
"@aws-cdk/aws-ec2:ebsDefaultGp3Volume": true,
|
|
"@aws-cdk/aws-ecs-patterns:removeDefaultDesiredCount": true,
|
|
"@aws-cdk/aws-rds:preventRenderingDeprecatedCredentials": true,
|
|
"@aws-cdk/aws-codepipeline-actions:useNewDefaultBranchForSourceAction": true
|
|
}
|
|
}
|