AWS Amplify Hosting for ML/AI Services Guide

{
  "Origin": {
    "Domain": "amplifyapp.com",
    "ID": "amplify-hosted-app",
    "OriginPath": "/prod/[appId]"
  },
  "DefaultCacheBehavior": {
    "ViewerProtocolPolicy": "redirect-to-https",
    "AllowedMethods": ["GET", "HEAD", "OPTIONS"],
    "DefaultTTL": 86400,
    "MaxTTL": 31536000,
    "FunctionAssociations": [
      { "EventType": "viewer-request", "FunctionARN": "arn:aws:cloudfront::function:SPA-Router" }
    ]
  },
  "CustomErrorResponses": [
    { "ErrorCode": 404, "ResponseCode": 200, "ResponsePagePath": "/index.html" }
  ],
  "WebACLId": "arn:aws:wafv2:us-east-1:[account]:global/webacl/AmplifyAppProtection/[id]",
  "Enabled": true,
  "PriceClass": "PriceClass_All"
}

{
  "apiId": "abc123def456",
  "endpointConfiguration": {
    "types": ["PRIVATE"],
    "vpcEndpointIds": ["vpce-0abc123def456789"]
  },
  "policy": {
    "Version": "2012-10-17",
    "Statement": [{
      "Effect": "Allow",
      "Principal": "*",
      "Action": "execute-api:Invoke",
      "Resource": "arn:aws:execute-api:region:account-id:api-id/*",
      "Condition": {
        "StringEquals": { "aws:SourceVpce": "vpce-0abc123def456789" }
      }
    }]
  }
}

{
  "sub": "user123",
  "iss": "https://cognito-idp.region.amazonaws.com/us-east-1_example",
  "client_id": "clientidexample",
  "token_use": "access",
  "scope": "openid profile email",
  "auth_time": 1684858239,
  "exp": 1684861839,
  "iat": 1684858239,
  "username": "[email protected]",
  "cognito:groups": ["ML_Users", "Data_Scientists"]
}

const jwt = require('jsonwebtoken');
const jwksClient = require('jwks-rsa');

const client = jwksClient({
  jwksUri: `https://cognito-idp.${process.env.REGION}.amazonaws.com/${process.env.USER_POOL_ID}/.well-known/jwks.json`,
  cache: true,
  cacheMaxAge: 600000  // 10 minutes
});

const getSigningKey = (kid) => new Promise((resolve, reject) => {
  client.getSigningKey(kid, (err, key) => {
    if (err) return reject(err);
    resolve(key.publicKey || key.rsaPublicKey);
  });
});

// Generate an IAM policy document for API Gateway
const generatePolicy = (principalId, effect, resource, context = {}) => ({
  principalId,
  policyDocument: {
    Version: '2012-10-17',
    Statement: [{ Action: 'execute-api:Invoke', Effect: effect, Resource: resource }]
  },
  context
});

// Return true if user belongs to an allowed group for this method
const determineAccess = (groups, methodArn) => {
  const allowedGroups = ['Administrators', 'MLUsers'];
  return groups.some(g => allowedGroups.includes(g));
};

exports.handler = async (event) => {
  try {
    const token = event.authorizationToken.replace('Bearer ', '');
    const decoded = jwt.decode(token, { complete: true });
    if (!decoded) throw new Error('Invalid token format');

    const signingKey = await getSigningKey(decoded.header.kid);

    // Cognito ACCESS tokens use client_id, not aud — omit audience option
    const verifiedToken = jwt.verify(token, signingKey, {
      issuer: `https://cognito-idp.${process.env.REGION}.amazonaws.com/${process.env.USER_POOL_ID}`,
      // audience omitted intentionally — Cognito access tokens use client_id
    });

    // Manually validate client_id (replaces standard audience check)
    if (verifiedToken.client_id !== process.env.CLIENT_ID) {
      throw new Error('Invalid client_id');
    }

    // Group membership is in cognito:groups — NOT groups
    const userGroups = verifiedToken['cognito:groups'] || [];
    const allowed = determineAccess(userGroups, event.methodArn);

    return generatePolicy(
      verifiedToken.sub,
      allowed ? 'Allow' : 'Deny',
      event.methodArn,
      { username: verifiedToken.username || verifiedToken.sub, groups: userGroups.join(',') }
    );
  } catch (error) {
    console.error('Authorization error:', error);
    throw new Error('Unauthorized');
  }
};

const { BedrockRuntimeClient, ConverseCommand } = require("@aws-sdk/client-bedrock-runtime");

const bedrockClient = new BedrockRuntimeClient({ region: process.env.AWS_REGION || "us-east-1" });

exports.handler = async (event) => {
  const { prompt, model = "anthropic.claude-3-5-sonnet-20241022-v2:0", maxTokens = 1000, temperature = 0.7, systemPrompt } = JSON.parse(event.body);

  const params = {
    modelId: model,
    messages: [{ role: "user", content: [{ text: prompt }] }],
    inferenceConfig: { maxTokens, temperature, topP: 0.9 }
  };
  if (systemPrompt) params.system = [{ text: systemPrompt }];

  const response = await bedrockClient.send(new ConverseCommand(params));
  const completion = response.output?.message?.content?.[0]?.text || "";

  return {
    statusCode: 200,
    headers: { "Content-Type": "application/json" },
    body: JSON.stringify({
      model,
      completion,
      stopReason: response.stopReason,
      usage: {
        input_tokens:  response.usage?.inputTokens  || 0,
        output_tokens: response.usage?.outputTokens || 0,
        total_tokens: (response.usage?.inputTokens  || 0) + (response.usage?.outputTokens || 0)
      }
    })
  };
};

import jwt, requests, os
from functools import lru_cache

REGION     = os.environ['COGNITO_REGION']
POOL_ID    = os.environ['USER_POOL_ID']
CLIENT_ID  = os.environ['CLIENT_ID']
JWKS_URL   = f'https://cognito-idp.{REGION}.amazonaws.com/{POOL_ID}/.well-known/jwks.json'

@lru_cache(maxsize=1)
def get_jwks():
    return requests.get(JWKS_URL, timeout=10).json()

def get_public_key(kid):
    for key in get_jwks()['keys']:
        if key['kid'] == kid:
            return jwt.algorithms.RSAAlgorithm.from_jwk(key)
    raise ValueError(f'Key not found: {kid}')

def validate_token(token):
    header = jwt.get_unverified_header(token)
    public_key = get_public_key(header['kid'])

    # Cognito access tokens use client_id not aud — disable audience verification
    claims = jwt.decode(
        token, public_key, algorithms=['RS256'],
        options={'verify_aud': False},
        issuer=f'https://cognito-idp.{REGION}.amazonaws.com/{POOL_ID}'
    )
    if claims.get('client_id') != CLIENT_ID:
        raise ValueError('Invalid client_id')
    if claims.get('token_use') != 'access':
        raise ValueError('Invalid token_use')
    return claims

def lambda_handler(event, context):
    token = event.get('authorizationToken', '').replace('Bearer ', '')
    claims = validate_token(token)

    username = claims.get('username', claims.get('sub'))
    # Group membership is in cognito:groups (not groups)
    groups   = claims.get('cognito:groups', [])

    if not any(g in ['Administrators', 'MLUsers'] for g in groups):
        return generate_policy(username, 'Deny', event['methodArn'])

    return generate_policy(username, 'Allow', event['methodArn'], {
        'username': username,
        'email':    claims.get('email', ''),
        'groups':   ','.join(groups),
        'sub':      claims.get('sub', '')
    })

defaultCorsPreflightOptions: {
  // Explicitly list allowed origins — never use Cors.ALL_ORIGINS in production
  allowOrigins: [
    'https://your-app.amplifyapp.com',  // Amplify hosted domain
    'https://your-custom-domain.com'    // Custom domain (if applicable)
  ],
  allowMethods: ['GET', 'POST', 'OPTIONS'],
  allowHeaders: ['Content-Type', 'Authorization', 'X-Amz-Date', 'X-Api-Key'],
  allowCredentials: true
}

# Install and configure Amplify CLI
npm install -g @aws-amplify/cli
amplify configure

# Initialize Amplify in your Angular project
cd your-angular-project
amplify init

# Add hosting (choose Amplify Console for CI/CD)
amplify add hosting
amplify publish

version: 1
frontend:
  phases:
    preBuild:
      commands:
        - cd frontend
        - npm ci
    build:
      commands:
        - npm run build:prod
  artifacts:
    baseDirectory: frontend/dist/ml-app
    files:
      - '**/*'
  cache:
    paths:
      - frontend/node_modules/**/*

import * as cognito from 'aws-cdk-lib/aws-cognito';

this.userPool = new cognito.UserPool(this, 'MLAppUserPool', {
  selfSignUpEnabled: false,
  signInAliases: { email: true },
  passwordPolicy: {
    minLength: 12,
    requireLowercase: true, requireUppercase: true,
    requireDigits: true,    requireSymbols: true
  },
  mfa: cognito.Mfa.REQUIRED,
  mfaSecondFactor: { sms: true, otp: true },
  accountRecovery: cognito.AccountRecovery.EMAIL_ONLY
});

this.userPoolClient = new cognito.UserPoolClient(this, 'MLAppClient', {
  userPool: this.userPool,
  generateSecret: false,
  authFlows: { userSrp: true },
  oAuth: {
    flows: { authorizationCodeGrant: true },
    scopes: [cognito.OAuthScope.OPENID, cognito.OAuthScope.EMAIL, cognito.OAuthScope.PROFILE],
    callbackUrls:  ['https://your-app.amplifyapp.com/auth/callback'],
    logoutUrls:    ['https://your-app.amplifyapp.com/auth/logout']
  },
  accessTokenValidity: cdk.Duration.hours(1),
  idTokenValidity:     cdk.Duration.hours(1),
  refreshTokenValidity: cdk.Duration.days(30)
});

const samlProvider = new cognito.CfnUserPoolIdentityProvider(this, 'EntraIDProvider', {
  userPoolId: this.userPool.userPoolId,
  providerName: 'EntraID',
  providerType: 'SAML',
  providerDetails: {
    MetadataURL: 'https://login.microsoftonline.com/[tenant-id]/federationmetadata/2007-06/federationmetadata.xml',
    IDPSignout: 'true'
  },
  attributeMapping: {
    email:              'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress',
    given_name:         'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname',
    family_name:        'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname',
    'custom:department': 'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/department'
  }
});

export const environment = {
  production: false,
  cognito: {
    userPoolId:         'us-east-1_XXXXXXXXX',
    userPoolWebClientId: 'XXXXXXXXXXXXXXXXXXXXXXXXXX',
    // domainPrefix is the Cognito hosted UI prefix — NOT the userPoolId
    domainPrefix: 'my-company-ml-app-dev',
    region:       'us-east-1',
    identityPoolId: 'us-east-1:XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
  },
  api: {
    baseUrl: 'https://api.example.com/dev',
    region:  'us-east-1'
  }
};

import { Amplify } from 'aws-amplify';
import { environment } from '../environments/environment';

// Amplify v6 configuration structure
Amplify.configure({
  Auth: {
    Cognito: {
      userPoolId:       environment.cognito.userPoolId,
      userPoolClientId: environment.cognito.userPoolWebClientId,
      identityPoolId:   environment.cognito.identityPoolId,
      loginWith: {
        oauth: {
          // Use domainPrefix — NOT userPoolId — for the OAuth domain
          domain: `${environment.cognito.domainPrefix}.auth.${environment.cognito.region}.amazoncognito.com`,
          scopes: ['email', 'openid', 'profile'],
          redirectSignIn:  [window.location.origin + '/auth/callback'],
          redirectSignOut: [window.location.origin + '/auth/logout'],
          responseType: 'code'
        }
      }
    }
  }
});

// Amplify v6: modular imports from 'aws-amplify/auth'
import { signIn, signOut, getCurrentUser, fetchAuthSession, signInWithRedirect } from 'aws-amplify/auth';

@Injectable({ providedIn: 'root' })
export class AuthService {
  private currentUserSubject = new BehaviorSubject<User | null>(null);

  async initializeAuth(): Promise<void> {
    try {
      const { username, userId } = await getCurrentUser();
      const session = await fetchAuthSession();
      const payload = session.tokens?.idToken?.payload;
      this.currentUserSubject.next({
        username, userId,
        email:  payload?.['email'] as string || '',
        groups: (payload?.['cognito:groups'] as string[]) || []
      });
    } catch { /* no active session */ }
  }

  async signInWithSAML(): Promise<void> {
    await signInWithRedirect({ provider: { custom: 'EntraID' } });
  }

  async getAccessToken(): Promise<string> {
    const session = await fetchAuthSession();
    return session.tokens?.accessToken?.toString() ?? '';
  }

  async signOut(): Promise<void> {
    await signOut();
    this.currentUserSubject.next(null);
  }
}

import * as apigateway from 'aws-cdk-lib/aws-apigateway';
import * as logs from 'aws-cdk-lib/aws-logs';

this.api = new apigateway.RestApi(this, 'MLAppAPI', {
  restApiName: 'ML App API',
  endpointConfiguration: { types: [apigateway.EndpointType.REGIONAL] },
  defaultCorsPreflightOptions: {
    allowOrigins: ['https://your-app.amplifyapp.com'],
    allowMethods: ['GET', 'POST', 'OPTIONS'],
    allowHeaders: ['Content-Type', 'Authorization', 'X-Amz-Date'],
    allowCredentials: true
  },
  deployOptions: {
    stageName: 'prod',
    throttlingRateLimit:  1000,
    throttlingBurstLimit: 2000,
    loggingLevel: apigateway.MethodLoggingLevel.ERROR,
    dataTraceEnabled: false,  // Never enable in production
    metricsEnabled: true,
    accessLogDestination: new apigateway.LogGroupLogDestination(
      new logs.LogGroup(this, 'ApiAccessLogs', { retention: logs.RetentionDays.THIRTY_DAYS })
    ),
    accessLogFormat: apigateway.AccessLogFormat.jsonWithStandardFields()
  }
});

import boto3, json

sagemaker_runtime = boto3.client('sagemaker-runtime', region_name=os.environ['AWS_REGION'])

def invoke_sagemaker_endpoint(endpoint_name, payload):
    response = sagemaker_runtime.invoke_endpoint(
        EndpointName=endpoint_name,
        ContentType='application/json',
        Accept='application/json',
        Body=json.dumps(payload)
    )
    result = json.loads(response['Body'].read().decode())
    return result