fix: do not suppress Kendra default policy unless createIndex is chosen

dairiley · Jan 24, 2024 · cf3c27a · cf3c27a
1 parent 1aa3280
commit cf3c27a
Showing 1 changed file with 15 additions and 13 deletions.
diff --git a/lib/aws-genai-llm-chatbot-stack.ts b/lib/aws-genai-llm-chatbot-stack.ts
@@ -384,19 +384,21 @@ export class AwsGenAILLMChatbotStack extends cdk.Stack {
             },
           ]
         );
-        NagSuppressions.addResourceSuppressionsByPath(
-          this,
-          [
-            `/${this.stackName}/RagEngines/KendraRetrieval/KendraRole/DefaultPolicy/Resource`,
-          ],
-          [
-            {
-              id: "AwsSolutions-IAM5",
-              reason:
-                "Access to all log groups required for CloudWatch log group creation.",
-            },
-          ]
-        );
+        if (props.config.rag.engines.kendra.createIndex) {
+          NagSuppressions.addResourceSuppressionsByPath(
+            this,
+            [
+              `/${this.stackName}/RagEngines/KendraRetrieval/KendraRole/DefaultPolicy/Resource`,
+            ],
+            [
+              {
+                id: "AwsSolutions-IAM5",
+                reason:
+                  "Access to all log groups required for CloudWatch log group creation.",
+              },
+            ]
+          );
+        }
       }
     }
     // Implicitly created resources with changing paths