diff --git a/org-formation/600-access/_tasks.yaml b/org-formation/600-access/_tasks.yaml index 32a8b746..daebd12b 100644 --- a/org-formation/600-access/_tasks.yaml +++ b/org-formation/600-access/_tasks.yaml @@ -214,6 +214,21 @@ StackArmorReadOnlyAccess: - arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess - arn:aws:iam::aws:policy/AmazonVPCReadOnlyAccess +# Setup cross-account access to BedRock in SynapseLlmProd account +# https://repost.aws/knowledge-center/bedrock-invoke-with-cross-account +SynapseLlmProdBedrockFullAccess: + Type: update-stacks + Template: https://raw.githubusercontent.com/Sage-Bionetworks/aws-infra/v0.2.10/templates/IAM/cross-account-access.yaml + StackName: synapsellmprod-bedrock-full-access + DefaultOrganizationBinding: + Account: !Ref SynapseLlmProdAccount + Region: us-east-1 + Parameters: + PrincipalArns: + - arn:aws:iam::325565585839:root # SynapseProd AWS account ID + ManagedPolicyArns: + - arn:aws:iam::aws:policy/AmazonBedrockFullAccess + #---------- Policies ------------- CostExplorerAccessPolicy: Type: update-stacks