Fix: [AEA-6112] - kb logging 🤞

[bencegadanyi1-nhs]

summary

adds configurable aws bedrock model invocation logging so we can capture + monitor all bedrock api interactions in cloudwatch logs

details

this pr adds the infra + lambda glue to enable aws bedrock model invocation logging

cdk doesn’t currently expose bedrock’s logging config, so we wire it up via a custom cloudformation resource (backed by a lambda) that calls the bedrock api

logging is off by default. you can toggle it via the enableLogging flag in EpsAssistMeStack.ts during deployment or by invoking the lambda in aws console with the following body:

{"enable_logging": true}

           OR

{"enable_logging": false}

• BedrockLoggingConfiguration construct

  • creates a cloudwatch log group (kms encrypted) for invocation logs
  • creates an iam role that the bedrock service can assume to write logs
  • creates a custom resource lambda to apply/remove the bedrock logging config

• bedrockLoggingConfigFunction lambda

  • on create/update: applies the model invocation logging config
  • on delete: removes the logging config
  • supports toggling via ENABLE_LOGGING env var (so deploys can keep the resource but no-op when disabled)
  • derives log group + role arns from cdk-provided env vars

[github-actions]

This PR is linked to a ticket in an NHS Digital JIRA Project. Here's a handy link to the ticket:

AEA-6112

[jonathanwelch1-nhs]

leaving to Kieran

leaving to Kieran

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud