lambda.sh

#!/usr/bin/env bash
# Build & deploy the agent as a Lambda container with a public function URL.
# Idempotent: safe to re-run. Requires: aws cli, docker, uv, and .env.
#
# Usage:  deploy/lambda.sh
set -euo pipefail

REPO="$(cd "$(dirname "$0")/.." && pwd)"
cd "$REPO"
set -a; [ -f .env ] && . ./.env; set +a

: "${AWS_REGION:?set AWS_REGION in .env}"
: "${COCKROACH_URL:?set COCKROACH_URL in .env}"
FUNC="${LAMBDA_FUNCTION:-torre-de-control}"
ECR_REPO="${ECR_REPO:-torre-de-control}"
ROLE_NAME="${LAMBDA_ROLE:-torre-de-control-role}"
ACCOUNT="$(aws sts get-caller-identity --query Account --output text)"
REGISTRY="${ACCOUNT}.dkr.ecr.${AWS_REGION}.amazonaws.com"
IMAGE="${REGISTRY}/${ECR_REPO}:latest"

echo "• exporting runtime requirements"
uv export --no-dev --no-emit-project --format requirements-txt -o deploy/requirements.txt

echo "• ensuring ECR repo"
aws ecr describe-repositories --repository-names "$ECR_REPO" --region "$AWS_REGION" >/dev/null 2>&1 \
  || aws ecr create-repository --repository-name "$ECR_REPO" --region "$AWS_REGION" >/dev/null

echo "• docker build (linux/arm64) + push"
aws ecr get-login-password --region "$AWS_REGION" | docker login --username AWS --password-stdin "$REGISTRY"
# --provenance/--sbom false: Lambda rejects OCI attestation manifest lists.
docker buildx build --platform linux/arm64 --provenance=false --sbom=false \
  -f deploy/Dockerfile -t "$IMAGE" --push .

echo "• ensuring IAM role (least privilege: bedrock:InvokeModel only)"
if ! aws iam get-role --role-name "$ROLE_NAME" >/dev/null 2>&1; then
  aws iam create-role --role-name "$ROLE_NAME" \
    --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' >/dev/null
  aws iam attach-role-policy --role-name "$ROLE_NAME" \
    --policy-arn arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole
  echo "  (waiting for role propagation)"; sleep 12
fi
# idempotent: (re)apply the least-privilege Bedrock policy every run
aws iam put-role-policy --role-name "$ROLE_NAME" --policy-name bedrock-invoke \
  --policy-document "file://deploy/iam-policy.json"
ROLE_ARN="$(aws iam get-role --role-name "$ROLE_NAME" --query Role.Arn --output text)"

# NOTE: AWS_REGION is reserved & auto-set by the Lambda runtime — do not include it.
ENV_VARS="Variables={COCKROACH_URL=$COCKROACH_URL,BEDROCK_CHAT_MODEL=${BEDROCK_CHAT_MODEL:-us.anthropic.claude-haiku-4-5-20251001-v1:0},BEDROCK_EMBED_MODEL=${BEDROCK_EMBED_MODEL:-amazon.titan-embed-text-v2:0},EMBED_DIMS=${EMBED_DIMS:-1024},OFFLINE_MODE=${OFFLINE_MODE:-0}}"

if aws lambda get-function --function-name "$FUNC" --region "$AWS_REGION" >/dev/null 2>&1; then
  echo "• updating function code + config"
  aws lambda update-function-code --function-name "$FUNC" --image-uri "$IMAGE" --region "$AWS_REGION" >/dev/null
  aws lambda wait function-updated --function-name "$FUNC" --region "$AWS_REGION"
  aws lambda update-function-configuration --function-name "$FUNC" \
    --timeout 60 --memory-size 1024 --environment "$ENV_VARS" --region "$AWS_REGION" >/dev/null
else
  echo "• creating function"
  aws lambda create-function --function-name "$FUNC" --package-type Image \
    --code ImageUri="$IMAGE" --role "$ROLE_ARN" --timeout 60 --memory-size 1024 \
    --architectures arm64 \
    --environment "$ENV_VARS" --region "$AWS_REGION" >/dev/null
  aws lambda wait function-active --function-name "$FUNC" --region "$AWS_REGION"
fi

echo "• ensuring public function URL (auth NONE)"
aws lambda get-function-url-config --function-name "$FUNC" --region "$AWS_REGION" >/dev/null 2>&1 || \
  aws lambda create-function-url-config --function-name "$FUNC" --auth-type NONE \
    --cors '{"AllowOrigins":["*"],"AllowMethods":["*"],"AllowHeaders":["*"]}' --region "$AWS_REGION" >/dev/null
aws lambda add-permission --function-name "$FUNC" --statement-id public-url \
  --action lambda:InvokeFunctionUrl --principal '*' --function-url-auth-type NONE \
  --region "$AWS_REGION" >/dev/null 2>&1 || true

URL="$(aws lambda get-function-url-config --function-name "$FUNC" --query FunctionUrl --output text --region "$AWS_REGION")"
echo
echo "DEPLOYED: $URL"
echo "test:  curl ${URL}health"
echo "then set API_BASE in web/index.html (or run deploy/frontend.sh) to: ${URL%/}"