-
Notifications
You must be signed in to change notification settings - Fork 356
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
To use the project, Cognito user need a Cognito group (for example admin, user). Chatbot design was replaced to use CloudScape design pattern. - Support Amazon Nova LLMs Integration. - Add bedrock guardrails to all models in the langchain interface. - Add document support to chatbot sessions. - Add custom system prompts for non-bedrock models. - Add happy path selenium tests. - Update chatbot to use latest cloudscape components. - Create configurable applications with frontend implementation. - Bug fixes: - Fixed video understanding input. - Fixed integration tests following appsec findings. - Fixed input validation & presign URL role verification. - Fixed federation + application update. - Fixed RSS Feed, Application validation, RDS permissions. - Fixed semantic search validation. - Fixed import and unit test snapshots. - Security improvements: - Disabled Appsync introspection. - Updated security documentation. - Access control improvements: - Added access control to APIs. - Added unauthorized unit tests. - Implemented sendQuery access control. - Added role API. - Hide application attributes for non-admin users. Co-authored-by: Nikolai Grinko <[email protected]> Co-authored-by: Charles Marion <[email protected]>
- Loading branch information
3 people
committed
Jan 22, 2025
1 parent
6117b0d
commit 1efd010
Showing
213 changed files
with
13,325 additions
and
4,689 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Binary file not shown.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,132 @@ | ||
| # Access Control | ||
|
|
||
| **NOTE** | ||
|
|
||
| You need to assign the admin role to a user to be able to use the project after the first deployment revision with this feature. Users without a role will not be able to use the Chatbot. | ||
|
|
||
|
|
||
| Users can have one or more roles defining their permissions. It can be used to restrict access to the functionalities as defined below. | ||
|
|
||
|
|
||
| Rubicon has 3 pre-defined roles. They are created during deployment by CDK code. | ||
| 1. admin - _full access_ | ||
| 2. workspace_manager - _full access except the admin pages such as managing applications_ | ||
| 3. user - _access to assigned applications_ | ||
|
|
||
| Instead of using pre-defined `user` role you can create new roles in Cognito and assign them to applications. | ||
|
|
||
|
|
||
| ## Create users and Roles | ||
|
|
||
| Users are created in Cognito user pool - [Create new users](https://docs.aws.amazon.com/cognito/latest/developerguide/how-to-create-user-accounts.html). If Cognito federation is used then users should be created in third-party identity provider. See [Cognito Federation](./cognito/overview.md) configuration examples. | ||
|
|
||
| User roles are defined using [Cognito user group](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html). When using federation with Cognito, the user's role is assigned on user log in reading the "custom:chatbot_role" user attribute. | ||
|
|
||
|
|
||
| ## Page Access by Role | ||
|
|
||
| * **admin** | ||
| * ✅ Home (documentation) | ||
| * ✅ Chatbot - Playground | ||
| * ✅ Chatbot - Multi-chat playground | ||
| * ✅ Chatbot - Sessions | ||
| * ✅ Chatbot - Models | ||
| * ✅ RAG - Dashboard | ||
| * ✅ RAG - Semantic search | ||
| * ✅ RAG - Workspaces | ||
| * ✅ RAG - Embeddings | ||
| * ✅ RAG - Engines | ||
| * ✅ Admin - Applications | ||
| * ✅ Applications - End user view | ||
|
|
||
| * **workspaces_manager** | ||
| * ✅ Home (documentation) | ||
| * ✅ Chatbot - Playground | ||
| * ✅ Chatbot - Multi-chat playground | ||
| * ✅ Chatbot - Sessions | ||
| * ✅ Chatbot - Models | ||
| * ✅ RAG - Dashboard | ||
| * ✅ RAG - Semantic search | ||
| * ✅ RAG - Workspaces | ||
| * ✅ RAG - Embeddings | ||
| * ✅ RAG - Engines | ||
| * ⛔️ Admin - Applications | ||
| * ✅ Applications - End user view | ||
|
|
||
| * **user**: | ||
| It could be a role with any name which is associated with an application. | ||
| * ⛔️ Home (documentation) | ||
| * ⛔️ Chatbot - Playground | ||
| * ⛔️ Chatbot - Multi-chat playground | ||
| * ⛔️ Chatbot - Sessions | ||
| * ⛔️ Chatbot - Models | ||
| * ⛔️ RAG - Dashboard | ||
| * ⛔️ RAG - Semantic search | ||
| * ⛔️ RAG - Workspaces | ||
| * ⛔️ RAG - Embeddings | ||
| * ⛔️ RAG - Engines | ||
| * ⛔️ Admin - Applications | ||
| * ✅ Applications - End user view | ||
|
|
||
|
|
||
| ## GraphQL operations access by Role | ||
|
|
||
| * **Workspace** | ||
| * createKendraWorkspace - _admin, workspace_manager_ | ||
| * startKendraDataSync - _admin, workspace_manager_ | ||
| * isKendraDataSynching - _admin, workspace_manager_ | ||
| * createBedrockKBWorkspace - _admin, workspace_manager_ | ||
| * createOpenSearchWorkspace - _admin, workspace_manager_ | ||
| * createAuroraWorkspace - _admin, workspace_manager_ | ||
| * performSemanticSearch - _admin, workspace_manager_ | ||
| * listWorkspaces - _admin, workspace_manager_ | ||
| * listKendraIndexes - _admin, workspace_manager_ | ||
| * listBedrockKnowledgeBases - _admin, workspace_manager_ | ||
| * listRagEngines - _admin, workspace_manager_ | ||
| * getWorkspace - _admin, workspace_manager_ | ||
| * deleteWorkspace - _admin, workspace_manager_ | ||
|
|
||
| * **Document** | ||
| * addWebsite - _admin, workspace_manager_ | ||
| * addRssFeed - _admin, workspace_manager_ | ||
| * updateRssFeed - _admin, workspace_manager_ | ||
| * setDocumentSubscriptionStatus - _admin, workspace_manager_ | ||
| * addQnADocument - _admin, workspace_manager_ | ||
| * addTextDocument - _admin, workspace_manager_ | ||
| * getUploadFileURL - _any authenticated user_ | ||
| * getDocument - _admin, workspace_manager_ | ||
| * getRSSPosts - _admin, workspace_manager_ | ||
| * listDocuments - _admin, workspace_manager_ | ||
| * deleteDocument - _admin, workspace_manager_ | ||
|
|
||
| * **Session** | ||
| * addUserFeedback - _any authenticated user_ | ||
| * deleteSession - _any authenticated user_ | ||
| * deleteUserSessions - _any authenticated user_ | ||
| * listSessions - _any authenticated user_ | ||
| * getSession - _any authenticated user_ | ||
|
|
||
| * **Model** | ||
| * listModels - _admin, workspace_manager_ | ||
| * listEmbeddingModels - _admin, workspace_manager_ | ||
| * listCrossEncoders - _admin, workspace_manager_ | ||
| * rankPassages - _admin, workspace_manager_ | ||
| * calculateEmbeddings - _admin, workspace_manager_ | ||
| * sendQuery - _any authenticated user_ | ||
| * receiveMessages - _any authenticated user_ | ||
|
|
||
| * **Application** | ||
| * createApplication - _admin_ | ||
| * updateApplication - _admin_ | ||
| * deleteApplication - _admin_ | ||
| * getApplication - _admin, workspace_manager, any other role that is assigned to the application_ | ||
| * listApplications - _admin, workspace_manager, any other role that is assigned to the application_ | ||
|
|
||
| * **Role** | ||
| * listRoles - _admin_ | ||
|
|
||
| * **Internal** | ||
| * publishResponse - _IAM Can only be called by the Lambda forwarding the chatbot responses_ | ||
|
|
||
| * **Other** | ||
| * checkHealth - _any authenticated user_ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| # Applications | ||
|
|
||
| An application is a pre-configured chatbot which could be embedded to a website. Admin users can define applications by selecting a model, model settings, workspace, and system prompts. Configured applications are then available for regular users based on their assigned role, allowing controlled access to pre-configured chat experiences. | ||
|
|
||
| Roles determine which applications a user can access - for example, a "customer support" role may only be able to use applications tailored for handling support inquiries from users. Admin and workspace_manager roles are created during deployment. Additional roles can be created by creating [Cognito groups](https://docs.aws.amazon.com/cognito/latest/developerguide/cognito-user-pools-user-groups.html). Applications can then be assigned to one or more roles restricting what model and workspace an end user can use. | ||
|
|
||
|
|
||
| ## Application creation and usage | ||
|  | ||
|
|
||
|
|
||
| ## Iframe integration | ||
| 1. Deploy Rubicon. | ||
| 2. Copy `GenAIChatBotStack.UserInterfaceUserInterfaceDomainName` value from the deployment output. It has `dxxxxxxxxxxxxx.cloudfront.net` format. | ||
| 3. Open UI dxxxxxxxxxxxxx.cloudfront.net. | ||
| 4. Create an application and open it (the URL will be used in the next step). | ||
| 5. Create an Iframe with the application URL as a source. | ||
|
|
||
| ```html | ||
| <!DOCTYPE html> | ||
| <html> | ||
| <head> | ||
| <title>Chat Embed Test</title> | ||
| </head> | ||
| <body> | ||
| <iframe | ||
| src="https://dxxxxxxxxxxxxx.cloudfront.net/application/408a4758-018b-4147-ac76-ee9c169ba775" | ||
| width="400" | ||
| height="480" | ||
| allow="microphone" | ||
| style="border: 1px solid #ccc;" | ||
| ></iframe> | ||
| </body> | ||
| </html> | ||
| ``` | ||
|
|
||
| ### Example | ||
|  |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,22 +1,9 @@ | ||
| # Using AppSync | ||
|
|
||
| Define or change the schema in `./lib/chatbot-api/schema`. | ||
| The project relies on [AWS AppSync](https://docs.aws.amazon.com/appsync/latest/devguide/what-is-appsync.html) which creates serverless GraphQL and Pub/Sub APIs that simplify application development through a single endpoint to securely query, update, or publish data. One of the key advantages is [GraphQL subscriptions](https://docs.aws.amazon.com/appsync/latest/devguide/aws-appsync-real-time-data.html) which is used to receive the chatbot responses in real time using streaming. | ||
|
|
||
| At the moment we only use the `schema-ws.graphql` to define the real-time API. The REST API might be replaced by AppSync in the future. | ||
| ### Schema | ||
| The GraphQL Schema defining the possible operatiosn can be found in `lib/chatbot-api/schema/schema.graphql`. Once deployed, AWS AppSync provides a Querying tool on the [AWS Console](https://us-east-1.console.aws.amazon.com/appsync/home?region=us-east-1) which can be used to explore and test the APIs. | ||
|
|
||
| If you modified the definition for the schema, you can regenerate the client code using | ||
|
|
||
| ```bash | ||
| cd lib/user-interface/react-app | ||
| npx @npx @aws-amplify/cli codegen add --apiId <api_id> --region <region> | ||
| ``` | ||
|
|
||
| Accept all the defaults. | ||
|
|
||
| If you use a None data source, you need to modify `src/API.ts` adding: | ||
|
|
||
| ```ts | ||
| export type NoneQueryVariables = { | ||
| none?: string | null; | ||
| }; | ||
| ``` | ||
| ### Authentication | ||
| AWS AppSync supports built in authentication modes. This project relies on the [@aws_cognito_user_pools one](https://docs.aws.amazon.com/appsync/latest/devguide/security-authz.html#using-additional-authorization-modes) to authenticate Amazon Cognito users. |
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Oops, something went wrong.