Starstruk Logo MarkStarstruk

v1.0.0

aws-samples/bedrock-chatv1.0.0Jun 3, 2024by statefb

AI Summary

A major security-focused update that requires migration from v0.x.x, featuring RDS encryption, Secrets Manager integration, and bot creation permissions.

Key Highlights

  • Major security overhaul with encryption and Secrets Manager
  • Migration from v0.x.x branch required
  • Bot creation permission controls added

Breaking Changes

  • Migration from v0.x.x required
  • Main branch no longer maintained
  • RDS credentials moved to Secrets Manager
  • Public access to RDS disabled
  • WebSocket authentication changed

New Features

  • Bot creation permission control
  • RDS storage encryption
  • Secrets Manager integration
  • Athena WorkGroup encryption
  • WebSocket authentication changes

Full Release Notes

# Major Update Notice (v1)

⚠️ WARNING⚠️ 
- **This is a significant update that includes essential security improvements and a migration from the old version (v0.x.x).** Please refer to the [migration guide](https://github.com/aws-samples/bedrock-claude-chat/blob/v1/docs/migration/V0_TO_V1.md). Failure to follow the migration process may result in **ALL DATA IN Aurora cluster BEING DESTROYED**, and existing bots will no longer function.
- The main branch is no longer maintained. `v1` branch is now default.

## New Features
- Bot Creation Permission: Users can now explicitly allow bot creation, providing more control over bot management. #319 by @Yukinobu-Mine 

## Enhancements
All of enhancements are regarding security.

- RDS Encryption: Enabled storage encryption for RDS to protect data at rest.
- Credential Security: Database usernames and passwords are no longer stored in plaintext in the environment variables of ECS containers and Lambda functions. They are now securely retrieved via Secrets Manager.
- RDS Authentication: Rotated RDS authentication credentials stored in Secrets Manager for improved security.
- Public Access Disabled: RDS public access is now explicitly disabled, preventing exposure to the public internet.
- S3 Access Logs: Enabled access logs for S3 Buckets to enhance security monitoring.
- Security Compliance: Applied [pdk-nag](https://aws.github.io/aws-pdk/developer_guides/pdk-nag/index.html)  ensuring better security practices.
- Athena WorkGroup Encryption: New athena.CfnWorkGroup now has encryption configuration set by default.
- WebSocket Authentication: Changed authentication to occur at the start of session establishment to prevent unauthorized access.

#327 , #328 by @fsatsuki , @statefb