エンタープライズAIゲートウェイ基盤（ECS + Amazon Bedrock）

import * as cdk from "aws-cdk-lib";
import { Construct } from "constructs";
import * as ec2 from "aws-cdk-lib/aws-ec2";
import * as ecs from "aws-cdk-lib/aws-ecs";
import * as ecsPatterns from "aws-cdk-lib/aws-ecs-patterns";
import * as iam from "aws-cdk-lib/aws-iam";
import * as s3 from "aws-cdk-lib/aws-s3";
import * as oss from "aws-cdk-lib/aws-opensearchserverless";

// 社内AIゲートウェイ：内部ALB配下のECS。Bedrock は PrivateLink(VPCエンドポイント)で閉域アクセス。
export class AiGatewayStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);

    const vpc = new ec2.Vpc(this, "Vpc", { maxAzs: 2, natGateways: 1 });
    const cluster = new ecs.Cluster(this, "Cluster", { vpc });

    // Bedrock への閉域アクセス（Interface VPC Endpoint = PrivateLink）
    vpc.addInterfaceEndpoint("BedrockRuntime", {
      service: new ec2.InterfaceVpcEndpointService(`com.amazonaws.${this.region}.bedrock-runtime`),
    });

    const docs = new s3.Bucket(this, "Docs", {
      encryption: s3.BucketEncryption.KMS_MANAGED,
      enforceSSL: true,
      blockPublicAccess: s3.BlockPublicAccess.BLOCK_ALL,
    });

    // RAG 用ベクトルストア（OpenSearch Serverless コレクション）
    new oss.CfnCollection(this, "VectorStore", { name: "enterprise-ai-gateway-ecs-bedrock-vectors", type: "VECTORSEARCH" });

    const svc = new ecsPatterns.ApplicationLoadBalancedFargateService(this, "Gateway", {
      cluster,
      cpu: 1024,
      memoryLimitMiB: 2048,
      desiredCount: 2,
      publicLoadBalancer: false, // 内部ALB（社内/閉域からのみ）
      taskImageOptions: { image: ecs.ContainerImage.fromRegistry("public.ecr.aws/nginx/nginx:stable"), containerPort: 80 },
    });

    // タスクロールに Bedrock 呼び出し権限（最小権限）
    svc.taskDefinition.taskRole.addToPrincipalPolicy(new iam.PolicyStatement({
      actions: ["bedrock:InvokeModel", "bedrock:InvokeModelWithResponseStream"],
      resources: ["*"],
    }));
    docs.grantRead(svc.taskDefinition.taskRole);
  }
}