AWS Amplify Hosting for ML/AI Services Guide

{
  "Origin": {
    "Domain": "[internal-amplify-managed-s3-bucket].s3.amazonaws.com",
    "ID": "amplify-hosted-app"
    // Note: actual origin domain is managed by Amplify — not user-configurable
  },
  "DefaultCacheBehavior": {
    "ViewerProtocolPolicy": "redirect-to-https",
    "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
    "DefaultTTL": 86400,
    "MaxTTL": 31536000
    // Note: SPA routing (404→200) is handled automatically by Amplify
    // A separate CloudFront Function for SPA routing is not required
  },
  "CustomErrorResponses": [
    { "ErrorCode": 404, "ResponseCode": 200, "ResponsePagePath": "/index.html" }
  ],
  "WebACLId": "arn:aws:wafv2:us-east-1:[account]:global/webacl/AmplifyAppProtection/[id]",
  "Enabled": true,
  "PriceClass": "PriceClass_All"
}

{
  "apiId": "abc123def456",
  "endpointConfiguration": {
    "types": ["REGIONAL"]
  },
  "policy": {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:region:account-id:api-id/*"
    }]
  }
  // Access control is enforced by WAF Web ACL + Lambda Authorizer JWT validation
  // not by VPC endpoint restriction (which requires Private endpoint type)
}

{
  "sub": "user123",
  "iss": "https://cognito-idp.region.amazonaws.com/us-east-1_example",
  "client_id": "clientidexample",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "auth_time": 1684858239,
  "exp": 1684861839,
  "iat": 1684858239,
  "username": "[email protected]",
  "cognito:groups": ["ML_Users", "Data_Scientists"]
  // Note: scope for SAML-federated users reflects Cognito internal scopes,
  // not openid/profile/email — those appear in the ID token, not the access token
}

const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');

const client = jwksClient({
  jwksUri: `https://cognito-idp.${process.env.REGION}.amazonaws.com/${process.env.USER_POOL_ID}/.well-known/jwks.json`,
  cache: true,
  cacheMaxAge: 3600000  // 1 hour — safe given Cognito pre-publishes new keys before rotation
});

const getSigningKey = (kid) => new Promise((resolve, reject) => {
  client.getSigningKey(kid, (err, key) => {
    if (err) return reject(err);
    resolve(key.publicKey || key.rsaPublicKey);
  });
});

// Generate an IAM policy document for API Gateway
const generatePolicy = (principalId, effect, resource, context = {}) => ({
  principalId,
  policyDocument: {
    Version: '2012-10-17',
    Statement: [{ Action: 'execute-api:Invoke', Effect: effect, Resource: resource }]
  },
  context
});

// Check group membership AND optionally scope by method ARN
// methodArn format: arn:aws:execute-api:region:account:apiId/stage/METHOD/resource
const determineAccess = (groups, methodArn) => {
  const allowedGroups = ['Administrators', 'MLUsers'];
  const hasGroup = groups.some(g => allowedGroups.includes(g));
  if (!hasGroup) return false;

  // Optional: scope Administrators to all methods, MLUsers to POST /ml/* only
  const [, , , , , , method, ...resourceParts] = methodArn.split(/[:/]/);
  const isMLRoute = resourceParts.join('/').startsWith('ml');
  if (groups.includes('Administrators')) return true;
  if (groups.includes('MLUsers') && method === 'POST' && isMLRoute) return true;
  return false;
};

exports.handler = async (event) => {
  try {
    const token = event.authorizationToken.replace('Bearer ', '');
    const decoded = jwt.decode(token, { complete: true });
    if (!decoded) throw new Error('Invalid token format');

    const signingKey = await getSigningKey(decoded.header.kid);

    // Cognito ACCESS tokens use client_id, not aud — omit audience option
    const verifiedToken = jwt.verify(token, signingKey, {
      issuer: `https://cognito-idp.${process.env.REGION}.amazonaws.com/${process.env.USER_POOL_ID}`,
      // audience omitted intentionally — Cognito access tokens use client_id
    });

    // Manually validate client_id (replaces standard audience check)
    if (verifiedToken.client_id !== process.env.CLIENT_ID) {
      throw new Error('Invalid client_id');
    }

    // Confirm this is an access token, not an ID token
    if (verifiedToken.token_use !== 'access') {
      throw new Error('Invalid token_use: expected access token');
    }

    // Group membership is in cognito:groups — NOT groups
    const userGroups = verifiedToken['cognito:groups'] || [];
    const allowed = determineAccess(userGroups, event.methodArn);

    return generatePolicy(
      verifiedToken.sub,
      allowed ? 'Allow' : 'Deny',
      event.methodArn,
      { username: verifiedToken.username || verifiedToken.sub, groups: userGroups.join(',') }
    );
  } catch (error) {
    console.error('Authorization error:', error);
    throw new Error('Unauthorized');
  }
};

const { BedrockRuntimeClient, ConverseCommand } = require("@aws-sdk/client-bedrock-runtime");

const bedrockClient = new BedrockRuntimeClient({ region: process.env.AWS_REGION || "us-east-1" });

// Map Bedrock error codes to appropriate HTTP status codes
const mapBedrockError = (error) => {
  const errorMap = {
    ThrottlingException:        { statusCode: 429, message: 'Model throttled — retry after backoff' },
    AccessDeniedException:      { statusCode: 403, message: 'Model access denied — check Bedrock model access permissions' },
    ModelTimeoutException:      { statusCode: 504, message: 'Model inference timed out' },
    ValidationException:        { statusCode: 400, message: `Invalid request: ${error.message}` },
    ServiceUnavailableException:{ statusCode: 503, message: 'Bedrock service temporarily unavailable' },
    ModelNotReadyException:     { statusCode: 503, message: 'Model not ready — access may not be enabled' },
  };
  return errorMap[error.name] || { statusCode: 500, message: `Bedrock error: ${error.message}` };
};

exports.handler = async (event) => {
  try {
    const { prompt, model = "anthropic.claude-3-5-sonnet-20241022-v2:0", maxTokens = 1000, temperature = 0.7, systemPrompt } = JSON.parse(event.body);

    const params = {
      modelId: model,
      messages: [{ role: "user", content: [{ text: prompt }] }],
      inferenceConfig: { maxTokens, temperature, topP: 0.9 }
    };
    if (systemPrompt) params.system = [{ text: systemPrompt }];

    const response = await bedrockClient.send(new ConverseCommand(params));
    const completion = response.output?.message?.content?.[0]?.text || "";

    return {
      statusCode: 200,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({
        model,
        completion,
        stopReason: response.stopReason,
        usage: {
          input_tokens:  response.usage?.inputTokens  || 0,
          output_tokens: response.usage?.outputTokens || 0,
          total_tokens: (response.usage?.inputTokens  || 0) + (response.usage?.outputTokens || 0)
        }
      })
    };

  } catch (error) {
    console.error('Bedrock invocation error:', { name: error.name, message: error.message });
    const { statusCode, message } = mapBedrockError(error);
    return {
      statusCode,
      headers: { "Content-Type": "application/json" },
      body: JSON.stringify({ error: message, errorType: error.name })
    };
  }
};

import jwt, requests, os
from functools import lru_cache

REGION     = os.environ['COGNITO_REGION']
POOL_ID    = os.environ['USER_POOL_ID']
CLIENT_ID  = os.environ['CLIENT_ID']
JWKS_URL   = f'https://cognito-idp.{REGION}.amazonaws.com/{POOL_ID}/.well-known/jwks.json'

@lru_cache(maxsize=1)
def get_jwks():
    return requests.get(JWKS_URL, timeout=10).json()

def get_public_key(kid):
    for key in get_jwks()['keys']:
        if key['kid'] == kid:
            return jwt.algorithms.RSAAlgorithm.from_jwk(key)
    raise ValueError(f'Key not found: {kid}')

def validate_token(token):
    header = jwt.get_unverified_header(token)
    public_key = get_public_key(header['kid'])

    # Cognito access tokens use client_id not aud — disable audience verification
    claims = jwt.decode(
        token, public_key, algorithms=['RS256'],
        options={'verify_aud': False},
        issuer=f'https://cognito-idp.{REGION}.amazonaws.com/{POOL_ID}'
    )
    if claims.get('client_id') != CLIENT_ID:
        raise ValueError('Invalid client_id')
    if claims.get('token_use') != 'access':
        raise ValueError('Invalid token_use')
    return claims

def lambda_handler(event, context):
    token = event.get('authorizationToken', '').replace('Bearer ', '')
    claims = validate_token(token)

    username = claims.get('username', claims.get('sub'))
    # Group membership is in cognito:groups (not groups)
    groups   = claims.get('cognito:groups', [])

    if not any(g in ['Administrators', 'MLUsers'] for g in groups):
        return generate_policy(username, 'Deny', event['methodArn'])

    return generate_policy(username, 'Allow', event['methodArn'], {
        'username': username,
        'email':    claims.get('email', ''),
        'groups':   ','.join(groups),
        'sub':      claims.get('sub', '')
    })

defaultCorsPreflightOptions: {
  // Explicitly list allowed origins — never use Cors.ALL_ORIGINS in production
  allowOrigins: [
    'https://your-app.amplifyapp.com',  // Amplify hosted domain
    'https://your-custom-domain.com'    // Custom domain (if applicable)
  ],
  allowMethods: ['GET', 'POST', 'OPTIONS'],
  allowHeaders: ['Content-Type', 'Authorization', 'X-Amz-Date', 'X-Api-Key'],
  allowCredentials: true
}

# Install and configure Amplify CLI
npm install -g @aws-amplify/cli
amplify configure

# Initialize Amplify in your Angular project
cd your-angular-project
amplify init

# Add hosting (choose Amplify Console for CI/CD)
amplify add hosting
amplify publish

version: 1
frontend:
  phases:
    preBuild:
      commands:
        - cd frontend
        - npm ci
    build:
      commands:
        - npm run build:prod
  artifacts:
    baseDirectory: frontend/dist/ml-app
    files:
      - '**/*'
  cache:
    paths:
      - frontend/node_modules/**/*

import * as cognito from 'aws-cdk-lib/aws-cognito';

this.userPool = new cognito.UserPool(this, 'MLAppUserPool', {
  selfSignUpEnabled: false,
  signInAliases: { email: true },
  passwordPolicy: {
    minLength: 12,
    requireLowercase: true, requireUppercase: true,
    requireDigits: true,    requireSymbols: true
  },
  mfa: cognito.Mfa.REQUIRED,
  mfaSecondFactor: { sms: true, otp: true },
  accountRecovery: cognito.AccountRecovery.EMAIL_ONLY
});

this.userPoolClient = new cognito.UserPoolClient(this, 'MLAppClient', {
  userPool: this.userPool,
  generateSecret: false,
  authFlows: { userSrp: true },
  oAuth: {
    flows: { authorizationCodeGrant: true },
    scopes: [cognito.OAuthScope.OPENID, cognito.OAuthScope.EMAIL, cognito.OAuthScope.PROFILE],
    callbackUrls:  ['https://your-app.amplifyapp.com/auth/callback'],
    logoutUrls:    ['https://your-app.amplifyapp.com/auth/logout']
  },
  accessTokenValidity: cdk.Duration.hours(1),
  idTokenValidity:     cdk.Duration.hours(1),
  refreshTokenValidity: cdk.Duration.days(30)
});

const samlProvider = new cognito.CfnUserPoolIdentityProvider(this, 'EntraIDProvider', {
  userPoolId: this.userPool.userPoolId,
  providerName: 'EntraID',
  providerType: 'SAML',
  providerDetails: {
    MetadataURL: 'https://login.microsoftonline.com/[tenant-id]/federationmetadata/2007-06/federationmetadata.xml',
    IDPSignout: 'true'
  },
  attributeMapping: {
    email:              'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
    given_name:         'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
    family_name:        'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
    'custom:department': 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department'
  }
});

export const environment = {
  production: false,
  cognito: {
    userPoolId:         'us-east-1_XXXXXXXXX',
    userPoolWebClientId: 'XXXXXXXXXXXXXXXXXXXXXXXXXX',
    // domainPrefix is the Cognito hosted UI prefix — NOT the userPoolId
    domainPrefix: 'my-company-ml-app-dev',
    region:       'us-east-1',
    identityPoolId: 'us-east-1:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
  },
  api: {
    baseUrl: 'https://api.example.com/dev',
    region:  'us-east-1'
  }
};

import { Amplify } from 'aws-amplify';
import { environment } from '../environments/environment';

// Amplify v6 configuration structure
Amplify.configure({
  Auth: {
    Cognito: {
      userPoolId:       environment.cognito.userPoolId,
      userPoolClientId: environment.cognito.userPoolWebClientId,
      identityPoolId:   environment.cognito.identityPoolId,
      loginWith: {
        oauth: {
          // Use domainPrefix — NOT userPoolId — for the OAuth domain
          domain: `${environment.cognito.domainPrefix}.auth.${environment.cognito.region}.amazoncognito.com`,
          scopes: ['email', 'openid', 'profile'],
          redirectSignIn:  [window.location.origin + '/auth/callback'],
          redirectSignOut: [window.location.origin + '/auth/logout'],
          responseType: 'code'
        }
      }
    }
  }
});

// Amplify v6: modular imports from 'aws-amplify/auth'
import { signIn, signOut, getCurrentUser, fetchAuthSession, signInWithRedirect } from 'aws-amplify/auth';

@Injectable({ providedIn: 'root' })
export class AuthService {
  private currentUserSubject = new BehaviorSubject<User | null>(null);

  async initializeAuth(): Promise<void> {
    try {
      const { username, userId } = await getCurrentUser();
      const session = await fetchAuthSession();
      const payload = session.tokens?.idToken?.payload;
      this.currentUserSubject.next({
        username, userId,
        email:  payload?.['email'] as string || '',
        groups: (payload?.['cognito:groups'] as string[]) || []
      });
    } catch { /* no active session */ }
  }

  async signInWithSAML(): Promise<void> {
    await signInWithRedirect({ provider: { custom: 'EntraID' } });
  }

  async getAccessToken(): Promise<string> {
    const session = await fetchAuthSession();
    return session.tokens?.accessToken?.toString() ?? '';
  }

  async signOut(): Promise<void> {
    await signOut();
    this.currentUserSubject.next(null);
  }
}

import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as logs from 'aws-cdk-lib/aws-logs';

this.api = new apigateway.RestApi(this, 'MLAppAPI', {
  restApiName: 'ML App API',
  endpointConfiguration: { types: [apigateway.EndpointType.REGIONAL] },
  defaultCorsPreflightOptions: {
    allowOrigins: ['https://your-app.amplifyapp.com'],
    allowMethods: ['GET', 'POST', 'OPTIONS'],
    allowHeaders: ['Content-Type', 'Authorization', 'X-Amz-Date'],
    allowCredentials: true
  },
  deployOptions: {
    stageName: 'prod',
    throttlingRateLimit:  1000,
    throttlingBurstLimit: 2000,
    loggingLevel: apigateway.MethodLoggingLevel.ERROR,
    dataTraceEnabled: false,  // Never enable in production
    metricsEnabled: true,
    accessLogDestination: new apigateway.LogGroupLogDestination(
      new logs.LogGroup(this, 'ApiAccessLogs', { retention: logs.RetentionDays.THIRTY_DAYS })
    ),
    accessLogFormat: apigateway.AccessLogFormat.jsonWithStandardFields()
  }
});

import boto3, json

sagemaker_runtime = boto3.client('sagemaker-runtime', region_name=os.environ['AWS_REGION'])

def invoke_sagemaker_endpoint(endpoint_name, payload):
    response = sagemaker_runtime.invoke_endpoint(
        EndpointName=endpoint_name,
        ContentType='application/json',
        Accept='application/json',
        Body=json.dumps(payload)
    )
    result = json.loads(response['Body'].read().decode())
    return result