aws.bedrock-evaluation-job

AWS Bedrock Evaluation Job

example:

Find terminal evaluation jobs with an S3 output location:

policies:
  - name: bedrock-terminal-evaluation-jobs
    resource: aws.bedrock-evaluation-job
    filters:
      - type: value
        key: status
        op: in
        value: [Completed, Failed, Stopped]
      - type: value
        key: outputDataConfig.s3Uri
        value: present

Filters

output-retention

Filter evaluation jobs by their S3 output artifact retention.

The filter resolves the S3 output URI for each job and evaluates the lifecycle rules that apply to the job’s artifact prefix. By default it compares the earliest guaranteed expiration, in days. A job has no EffectiveExpirationDays value when its artifacts are not covered by an enabled, unconstrained expiration rule. For versioned buckets, both current and noncurrent version expiration are required to calculate that value.

example:

Find jobs whose output artifacts are retained for more than 30 days:

policies:
  - name: evaluation-jobs-with-long-output-retention
    resource: aws.bedrock-evaluation-job
    filters:
      - type: output-retention
        op: greater-than
        value: 30
example:

Find jobs whose output artifacts have no guaranteed expiration:

policies:
  - name: evaluation-jobs-without-output-expiration
    resource: aws.bedrock-evaluation-job
    filters:
      - type: output-retention
        value: absent

The filter annotates matched jobs with c7n:OutputBucket. To evaluate another output detail, specify a key beneath c7n:BedrockEvaluationOutput. For example, identify jobs with an inaccessible output bucket or invalid output URI with:

- type: output-retention
  key: '"c7n:BedrockEvaluationOutput".Error'
  value: present

properties:
  default:
    type: object
  key:
    type: string
  op:
    enum:
    - eq
    - equal
    - ne
    - not-equal
    - gt
    - greater-than
    - ge
    - gte
    - le
    - lte
    - lt
    - less-than
    - glob
    - regex
    - regex-case
    - in
    - ni
    - not-in
    - contains
    - difference
    - intersect
    - mod
  tag_key_transforms:
    items:
      type: string
    type: array
  type:
    enum:
    - output-retention
  value:
    oneOf:
    - type: array
    - type: string
    - type: boolean
    - type: number
    - type: 'null'
  value_from:
    additionalProperties: 'False'
    properties:
      expr:
        oneOf:
        - type: integer
        - type: string
      format:
        enum:
        - csv
        - json
        - txt
        - csv2dict
      headers:
        patternProperties:
          ? ''
          : type: string
        type: object
      query:
        type: string
      url:
        type: string
    required:
    - url
    type: object
  value_path:
    type: string
  value_regex:
    type: string
  value_type:
    enum:
    - age
    - integer
    - expiration
    - normalize
    - size
    - cidr
    - cidr_size
    - swap
    - resource_count
    - expr
    - unique_size
    - date
    - version
    - float
required:
- type

Permissions - s3:GetBucketLocation, s3:GetBucketTagging, s3:GetBucketVersioning, s3:GetLifecycleConfiguration

Actions

rename-tag

Rename an existing tag key to a new value.

example:

rename Application, and Bap to App, if a resource has both of the old keys then we’ll use the value specified by Application, which is based on the order of values of old_keys.

policies:
- name: rename-tags-example
  resource: aws.log-group
  filters:
    - or:
      - "tag:Bap": present
      - "tag:Application": present
  actions:
    - type: rename-tag
      old_keys: [Application, Bap]
      new_key: App

properties:
  new_key:
    type: string
  old_key:
    type: string
  old_keys:
    items:
      type: string
    type: array
  type:
    enum:
    - rename-tag
required:
- type

Permissions - tag:TagResources, tag:UntagResources