add pre-signed url permission (#411)

aws-samples · Jun 27, 2024 · 409443d · 409443d
1 parent b7c862f
commit 409443d
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/cdk/lib/bedrock-chat-stack.ts b/cdk/lib/bedrock-chat-stack.ts
@@ -149,6 +149,7 @@ export class BedrockChatStack extends cdk.Stack {
       auth,
       bedrockRegion: props.bedrockRegion,
       largeMessageBucket,
+      documentBucket,
     });
     frontend.buildViteApp({
       backendApiEndpoint: backendApi.api.apiEndpoint,

diff --git a/cdk/lib/constructs/websocket.ts b/cdk/lib/constructs/websocket.ts
@@ -27,6 +27,7 @@ export interface WebSocketProps {
   readonly auth: Auth;
   readonly bedrockRegion: string;
   readonly tableAccessRole: iam.IRole;
+  readonly documentBucket: s3.IBucket;
   readonly websocketSessionTable: ITable;
   readonly largeMessageBucket: s3.IBucket;
   readonly accessLogBucket?: s3.Bucket;
@@ -83,6 +84,7 @@ export class WebSocket extends Construct {
     largePayloadSupportBucket.grantRead(handlerRole);
     props.websocketSessionTable.grantReadWriteData(handlerRole);
     props.largeMessageBucket.grantReadWrite(handlerRole);
+    props.documentBucket.grantRead(handlerRole);
 
     const handler = new DockerImageFunction(this, "Handler", {
       code: DockerImageCode.fromImageAsset(