chore(deps): add dependency to resource for CRIS (#909)

* chore(deps): add dependency to resource for CRIS

Author: krokoko

src/cdk-lib/bedrock/agents/agent.ts

@@ -378,8 +378,6 @@ export class Agent extends AgentBase {
           },
         }),
       });
-      // add the appropriate permissions to use the FM
-      this.foundationModel.grantInvoke(this.role);
     }
     // ------------------------------------------------------
     // Set Lazy Props initial values
@@ -437,6 +435,15 @@ export class Agent extends AgentBase {
     this.agentArn = this.__resource.attrAgentArn;
     this.agentVersion = this.__resource.attrAgentVersion;
     this.lastUpdated = this.__resource.attrUpdatedAt;
+
+    // Add explicit dependency between the agent resource and the agent's role default policy
+    // See https://github.com/awslabs/generative-ai-cdk-constructs/issues/899
+    if (!props.existingRole) {
+      // add the appropriate permissions to use the FM
+      const grant = this.foundationModel.grantInvoke(this.role);
+      grant.applyBefore(this.__resource);
+    }
+
     this.testAlias = AgentAlias.fromAttributes(this, 'DefaultAlias', {
       aliasId: 'TSTALIASID',
       aliasName: 'AgentTestAlias',

test/integ/inference-profiles.integ.snapshot/aws-cdk-bedrock-guardrails-integ-test.assets.json

@@ -1,15 +1,15 @@
 {
   "version": "39.0.0",
   "files": {
-    "8371c500cdb7d7db47b783ce965da719cc175fa62f9299c41a60f868691dbe0a": {
+    "fc1142f404eb5443446b22592dc6d75ae8c80055bfb9474da78f4254ae394a4f": {
       "source": {
         "path": "aws-cdk-bedrock-guardrails-integ-test.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-eu-central-1": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-eu-central-1",
-          "objectKey": "8371c500cdb7d7db47b783ce965da719cc175fa62f9299c41a60f868691dbe0a.json",
+          "objectKey": "fc1142f404eb5443446b22592dc6d75ae8c80055bfb9474da78f4254ae394a4f.json",
           "region": "eu-central-1",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-eu-central-1"
         }

test/integ/inference-profiles.integ.snapshot/aws-cdk-bedrock-guardrails-integ-test.template.json

@@ -124,7 +124,10 @@
     "IdleSessionTTLInSeconds": 3600,
     "Instruction": "You are a test bot that needs to be very gentle and useful to the user",
     "SkipResourceInUseCheckOnDelete": false
-   }
+   },
+   "DependsOn": [
+    "TestAgentsimpleRoleDefaultPolicy585202B2"
+   ]
   },
   "TestAgentcrisRole15797E3B": {
    "Type": "AWS::IAM::Role",
@@ -277,7 +280,10 @@
     "IdleSessionTTLInSeconds": 3600,
     "Instruction": "You are a test bot that needs to be very gentle and useful to the user",
     "SkipResourceInUseCheckOnDelete": false
-   }
+   },
+   "DependsOn": [
+    "TestAgentcrisRoleDefaultPolicy6C083E13"
+   ]
   },
   "TestAppProfile97C615D8": {
    "Type": "AWS::Bedrock::ApplicationInferenceProfile",
@@ -463,7 +469,10 @@
     "IdleSessionTTLInSeconds": 3600,
     "Instruction": "You are a test bot that needs to be very gentle and useful to the user",
     "SkipResourceInUseCheckOnDelete": false
-   }
+   },
+   "DependsOn": [
+    "TestAgentaipRoleDefaultPolicyD4F0F0D5"
+   ]
   }
  },
  "Parameters": {

test/integ/issue747.integ.snapshot/aws-cdk-bedrock-agents-integ-test.assets.json

@@ -1,15 +1,15 @@
 {
   "version": "39.0.0",
   "files": {
-    "af068d207758560bdaa77dd8cf7bc3626034f1d007a7d014cb51363863752caa": {
+    "edce2cdca448655b4baa3a3f25397547640d54472ced24d6b7c09954e1b4a72c": {
       "source": {
         "path": "aws-cdk-bedrock-agents-integ-test.template.json",
         "packaging": "file"
       },
       "destinations": {
         "current_account-eu-central-1": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-eu-central-1",
-          "objectKey": "af068d207758560bdaa77dd8cf7bc3626034f1d007a7d014cb51363863752caa.json",
+          "objectKey": "edce2cdca448655b4baa3a3f25397547640d54472ced24d6b7c09954e1b4a72c.json",
           "region": "eu-central-1",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-eu-central-1"
         }

test/integ/issue747.integ.snapshot/aws-cdk-bedrock-agents-integ-test.template.json

@@ -166,7 +166,10 @@
     "IdleSessionTTLInSeconds": 3600,
     "Instruction": "You are a helpful and friendly agent that answers questions about literature.",
     "SkipResourceInUseCheckOnDelete": false
-   }
+   },
+   "DependsOn": [
+    "AgentRoleDefaultPolicyA34CCA36"
+   ]
   },
   "Agent2Role38FC3F9C": {
    "Type": "AWS::IAM::Role",
@@ -334,7 +337,10 @@
     "IdleSessionTTLInSeconds": 3600,
     "Instruction": "You are a helpful and friendly agent that answers questions about unicorns.",
     "SkipResourceInUseCheckOnDelete": false
-   }
+   },
+   "DependsOn": [
+    "Agent2RoleDefaultPolicy55328F4A"
+   ]
   },
   "ActionGroupFunctionServiceRole77660D62": {
    "Type": "AWS::IAM::Role",