Amazon Bedrock を使ったアプリケーションの安全性を Amazon CloudWatch でトレースする #生成AI

import { CloudFrontRequestEvent, CloudFrontRequestHandler } from "aws-lambda";
import { createHash } from "crypto";

/**
 * Calculate SHA256 hash of a payload string
 * @param payload - The payload to hash
 * @returns SHA256 hash as a hexadecimal string
 */
const hashPayload = async (payload: string): Promisestring> => {
  return createHash('sha256').update(payload).digest('hex');
};

/**
 * Lambda@Edge handler for CloudFront viewer requests
 * Adds x-amz-content-sha256 header with SHA256 hash of the request body
 * This is required for Lambda function URLs with AWS_IAM auth when accessed through CloudFront
 */
export const handler: CloudFrontRequestHandler = async (
  event: CloudFrontRequestEvent
) => {
  const request = event.Records[0].cf.request;
  console.log("Original request:", JSON.stringify(request));

  // If there's no body, return the request as is
  if (!request.body?.data) {
    console.log("No request body found, skipping hash calculation");
    return request;
  }

  try {
    // Decode the base64-encoded body
    const body = request.body.data;
    const decodedBody = Buffer.from(body, "base64").toString("utf-8");
    
    // Calculate SHA256 hash of the body
    const contentHash = await hashPayload(decodedBody);
    console.log(`Calculated content hash: ${contentHash}`);
    
    // Add the x-amz-content-sha256 header
    request.headers["x-amz-content-sha256"] = [
      { key: "x-amz-content-sha256", value: contentHash }
    ];
    
    console.log("Modified request:", JSON.stringify(request));
    return request;
  } catch (error) {
    console.error("Error processing request:", error);
    // In case of error, return the original request
    // This allows the request to proceed, though it might fail at the Lambda function URL
    return request;
  }
};

    // Create a Lambda Layer with AWS Distro for OpenTelemetry Lambda
    // https://aws-otel.github.io/docs/getting-started/lambda/lambda-js
    const adotLayer = LayerVersion.fromLayerVersionArn(
      this,
      'ADOTJSLayer',
      `arn:aws:lambda:${Stack.of(this).region}:901920570463:layer:aws-otel-nodejs-amd64-ver-1-30-1:2`
    );

    // Create Lambda function
    const chatFunction = new Function(this, 'ChatFunction', {
      runtime: Runtime.NODEJS_22_X,
      code: new AssetCode(backendPath),
      handler: 'index.handler',
      timeout: Duration.minutes(5), // Extended for streaming responses
      tracing: Tracing.ACTIVE, // Enable tracing
      environment: {
        TABLE_NAME: chatTable.tableName,
        GUARDRAIL_ID: guardrails.guardrailId,
        GUARDRAIL_VERSION: guardrailVersion,
        AWS_LAMBDA_EXEC_WRAPPER: '/opt/otel-handler'
      }, // Thanks to AWS_LAMBDA_EXEC_WRAPPER, Lambda execution is traced by otel-hander.
      layers: [adotLayer]
    });

    // Create Bedrock Guardrails
    const guardrails = new Guardrail(this, 'ChatGuardrails', {
      name: 'llm-observability-guardrails',
      description: 'Guardrails for LLM observability demo',
    });

    // Add content filters
    guardrails.addContentFilter({
      type: ContentFilterType.HATE,
      inputStrength: ContentFilterStrength.LOW,
      outputStrength: ContentFilterStrength.LOW,
    });

    const command = new ApplyGuardrailCommand({
      guardrailIdentifier: GUARDRAIL_ID,
      guardrailVersion: GUARDRAIL_VERSION,
      content: [{ 
        text: {
          text: content
        }
      }],
      source: source,
      outputScope: 'FULL' // Get full output for enhanced debugging
    });
    
    const response = await bedrockClient.send(command);

import * as api from '@opentelemetry/api';

...
  const tracer = api.trace.getTracer(TRACE_NAME);
  const currentSpan = api.trace.getActiveSpan() || tracer.startSpan(TRACE_NAME);
...

    // Apply guardrails to user message
    const userGuardrailsResult = await tracer.startActiveSpan('Guardrails-INPUT', async (span : api.Span) => {
      span.setAttribute('guardrails.id', GUARDRAIL_ID);
      span.setAttribute('guardrails.version', GUARDRAIL_VERSION);
      const result = await applyGuardrails(message, 'INPUT');
      const totalScore = Object.values(result.contentFilterResults || {}).reduce((acc, filter) => acc + (filter.score || 0), 0);
      if (totalScore > 0) {
        span.setStatus({ code: api.SpanStatusCode.ERROR, message: 'User message filtered' });
        span.setAttribute('guardrails.input', message);
      }
      span.end();
      return result;
    });