Skip to content

Commit

Permalink
fix (#402)
Browse files Browse the repository at this point in the history
  • Loading branch information
statefb authored Jun 25, 2024
1 parent afb6f7e commit ad030b4
Show file tree
Hide file tree
Showing 3 changed files with 6 additions and 7 deletions.
7 changes: 3 additions & 4 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ By using the [Agent functionality](./docs/AGENT.md), your chatbot can automatica
</details>

- Open [CloudShell](https://console.aws.amazon.com/cloudshell/home) at the region where you want to deploy
- Run deployment via following commands
- Run deployment via following commands. If you have specific security policy, please also refer [Optional Parameters](#optional-parameters).

```sh
git clone https://github.com/aws-samples/bedrock-claude-chat.git
Expand All @@ -69,11 +69,10 @@ chmod +x bin.sh
```

- You will be asked if a new user or using v1. If so, enter `y`.
- After about 30 minutes, you will get the following output, which you can access from your browser

### Optional Parameters

You can now specify the following parameters during deployment to enhance security and customization:
You can specify the following parameters during deployment to enhance security and customization:

- **--disable-self-register**: Disable self-registration (default: enabled). If this flag is set, you will need to create all users on cognito and it will not allow users to self register their accounts.
- **--ipv4-ranges**: Comma-separated list of allowed IPv4 ranges. (default: allow all ipv4 addresses)
Expand All @@ -98,7 +97,7 @@ Frontend URL: https://xxxxxxxxx.cloudfront.net
The sign-up screen will appear as shown above, where you can register your email and log in.

> [!Important]
> This deployment method allows anyone with the URL to sign up if optional parameters are not configured. For production use, we strongly recommend adding IP address restrictions and disabling self-signup to mitigate security risks (Defining the `allowed-signup-email-domains` to allow only your emails from your company domain to be able to sing-up to restrict the users). For ip address restriction use both `ipv4-ranges` and `ipv6-ranges` and to disable self-signup use `disable-self-register` when executing `./bin`.
> Without setting the optional parameter, this deployment method allows anyone who knows the URL to sign up. For production use, it is strongly recommended to add IP address restrictions and disable self-signup to mitigate security risks (you can define allowed-signup-email-domains to restrict users so that only email addresses from your company’s domain can sign up). Use both ipv4-ranges and ipv6-ranges for IP address restrictions, and disable self-signup by using disable-self-register when executing ./bin.
## Architecture

Expand Down
2 changes: 1 addition & 1 deletion bin.sh
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ echo "!!! !!!"
echo "!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"
echo ""
while true; do
read -p "Are you a new user or already using v1.x of Bedrock Claude Chat? (y/N): " answer
read -p "Are you a new user starting with v1.x or later? (y/N): " answer
case ${answer:0:1} in
y|Y )
echo "Starting deployment..."
Expand Down
4 changes: 2 additions & 2 deletions docs/README_ja.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@

- [CloudShell](https://console.aws.amazon.com/cloudshell/home)をデプロイしたいリージョン (ap-northeast-1 など) で開きます

- 下記のコマンドでデプロイ実行します
- 下記のコマンドでデプロイ実行します。もし何らかのセキュリティポリシーがある場合は[オプションのパラメータ](#オプションのパラメータ)もご覧ください。

```sh
git clone https://github.com/aws-samples/bedrock-claude-chat.git
Expand All @@ -58,7 +58,7 @@ chmod +x bin.sh

### オプションのパラメータ

デプロイ時に以下のパラメータを指定することで、セキュリティとカスタマイズを強化できるようになりました
デプロイ時に以下のパラメータを指定することで、セキュリティとカスタマイズを強化できます

- --disable-self-register: セルフ登録を無効にします(デフォルト: 有効)。このフラグを設定すると、Cognito 上で全てのユーザーを作成する必要があり、ユーザーが自分でアカウントを登録することはできなくなります。
- --ipv4-ranges: 許可する IPv4 範囲のカンマ区切りリスト。(デフォルト: 全ての IPv4 アドレスを許可)
Expand Down

0 comments on commit ad030b4

Please sign in to comment.