AI Platform Engineering sur AWS.

# Bedrock guardrail, filter content + mask PII
resource "aws_bedrock_guardrail" "assistant" {
  name                      = "assistant-guardrail"
  blocked_input_messaging   = "Request blocked."
  blocked_outputs_messaging = "Response filtered."

  sensitive_information_policy_config {
    pii_entities_config { type = "EMAIL", action = "ANONYMIZE" }
  }
}

# Least-privilege execution role for the agent / MCP server
resource "aws_iam_role" "agent" {
  name               = "genai-agent-exec"
  assume_role_policy = data.aws_iam_policy_document.assume.json
}

resource "aws_iam_role_policy" "agent" {
  role = aws_iam_role.agent.id
  policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Effect   = "Allow"
      Action   = ["bedrock:InvokeModel", "bedrock:Retrieve"]
      Resource = [var.model_arn, aws_opensearchserverless_collection.kb.arn]
    }]
  })
}

# MCP server container on ECS Fargate, behind a private API
module "mcp_server" {
  source        = "./modules/fargate-service"
  name          = "mcp-crm"
  image         = "${aws_ecr_repository.mcp.repository_url}:${var.git_sha}"
  task_role_arn = aws_iam_role.agent.arn
  private       = true
}

Pipeline CI/CD, serveurs MCP & agents

1. 01

   Commit

   Code agent / serveur MCP, prompts, config Terraform.

2. 02

   Lint & tests

   Tests unitaires, validation des schémas d'outils MCP, scan IaC.

3. 03

   Build image

   Conteneur MCP / agent poussé sur ECR, scan de vulnérabilités.

4. 04

   Évaluation

   Jeux de tests agent : pertinence, garde-fous, non-régression.

5. 05

   Déploiement

   Terraform apply, ECS/Fargate ou AgentCore, dev → prod.

6. 06

   Run & observabilité

   Traces, coûts, alertes ; rollback si régression.

Promotion dev → prod approuvée ; secrets injectés via Secrets Manager, jamais en clair. Outils : GitLab CI / GitHub Actions / CodePipeline.