AWS VPC Flow Logs

1. Sign in to the AWS Management Console.
2. Go to the VPC dashboard > Subnets.
3. Select the subnet for application VPC and switch to the Flow logs tab.
4. Create a flow log or edit an existing flow log.

   1. Enter a Name.
   2. Under Destination, select Send to an Amazon S3 bucket you created in the previous section and provide the ARN for the S3 bucket.
   3. Enter the S3 bucket ARN.
   4. For Log record format, choose Custom Format and select all the Standard attributes.
   5. To partition your flow logs per hour, choose Every 1 hour (60 mins) in Partition logs by time.
   6. Leave the remaining settings as default, unless your use case requires specific configurations.
   7. Choose Create flow log or Save.
5. Go to the AWS Bedrock Console to manage model permissions and enable model access.

   1. In the left navigation pane, select Settings under the Bedrock Configurations section.
   2. Toggle Model invocation logging to enable logging.
   3. Choose S3 only as the logging destination.
   4. In the S3 location field, select the S3 bucket name you created earlier for storing logs.
   5. Click Save settings to apply your changes.

Enable Access from AWS in EKS Authentication

1. Sign in to the AWS Management Console.
2. Go to Elastic Kubernetes Service.
3. Navigate to the EKS Console.
4. Click on your EKS cluster and select the Access tab within that cluster page.

   1. Click Manage access.
   2. Under Cluster authentication mode, select EKS API and ConfigMap.

   3. Save changes.
   4. Add the following IP addresses to allow the Strata Cloud Manager to access your public cluster for discovery (This step is applicable when you have enabled Public access to your cluster endpoint):

      • Navigate to your cluster and go to Networking > Manage endpoint access.
      • Under cluster endpoint access select Public.
      • Expand Advanced settings to allow the perimeter firewall and add the following IP addresses to access this cluster:

      For perimeter firewall IP addresses in specific regions:

      Country	Region	IP Address	Total IPs
      US	us-central1	34.135.174.89	15
      US	us-central1	34.173.206.52	15
      US	us-central1	34.172.74.250	15
      US	us-central1	34.66.246.164	15
      US	us-central1	35.225.238.124	15
      US	us-central1	35.223.231.169	15
      US	us-central1	34.58.60.130	15
      US	us-central1	35.238.28.62	15
      US	us-central1	34.67.76.48	15
      US	us-central1	104.154.217.19	15
      US	us-central1	35.202.179.253	15
      US	us-central1	34.123.101.142	15
      US	us-central1	35.223.77.154	15
      US	us-central1	34.136.4.143	15
      US	us-central1	34.136.232.4	15
      UK	europe-west2	35.197.230.50	3
      UK	europe-west2	34.142.88.154	3
      UK	europe-west2	34.153.135.44	3
      IN	asias-south1	34.47.134.16	3
      IN	asias-south1	34.47.232.163	3
      IN	asias-south1	35.200.177.181	3
      SG	asia-southeast1	34.142.217.106	2
      SG	asia-southeast1	34.124.247.210	2
      CA	northamerica-northeast1	34.118.182.133	3
      CA	northamerica-northeast1	34.19.130.171	3
      CA	northamerica-northeast1	34.19.130.16	3
      DE	europe-west10	34.32.8.22	3
      DE	europe-west10	34.32.127.161	3
      DE	europe-west10	34.32.63.252	3
      AU	australia-southeast1	34.87.236.168	3
      AU	australia-southeast1	35.244.93.204	3
      AU	australia-southeast1	34.40.145.131	3

5. Save Changes.

Associate a Role for VM Model Invocation

1. Sign in to the AWS Management Console.
2. Navigate to IAM Roles.
3. Create a new role or edit an existing one.
4. Under Trust relationships Select Trusted Entity.
5. Configure Trust Policy and add the following Trust Policy:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "ec2.amazonaws.com"
               },
               "Action": "sts:AssumeRole"
           } 
       ]    
   }

   This policy grants EC2 instances permission to assume the role, enabling them to use the permissions defined in the role's policy.
6. Under the Permissions tab, click on your policy.

   1. Search and attach the Bedrock > InvokeModel services under Add actions.
   2. Click Next and Save changes.
   3. Or, create or attach a policy with the following permissions:

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Sid": "VisualEditor0",
                  "Effect": "Allow",
                  "Action": "bedrock:InvokeModel",
                  "Resource": "*"
              }
          ]
      }

      This step ensures that the EC2 instances have the necessary permissions to invoke models using the Bedrock service.
   4. Review and Create Role.
7. Choose Next: Tags, add any tags if needed, then choose Next: Review.
8. Review your settings and select Create role.

Assign Role to Pods for Model Access

1. Sign in to the AWS Management Console.
2. Go to Elastic Kubernetes Service (EKS).
3. Select your EKS cluster.
4. Go to Access > Pod Identity associations.
5. Assign IAM roles to Kubernetes service accounts - Amazon EKS.

Migrate from Discovery Services