agent: cannot disable user input for an agent

[tmokmss]

Describe the bug

When we try to disable user input for an agent, we get the below error.

Expected Behavior

User input can be disabled without any error.

Current Behavior

We get the below error on CFn deployment.

13:45:52 | UPDATE_FAILED | AWS::Bedrock::Agent | Agent1Agent01A464A5 Resource handler returned message: "Invalid request provided: ActionGroup with name UserInputAction cannot be deleted when it is Enabled. Either use SkipResourceInUseCheckOnDelete flag or mark it as Disabled." (RequestToken: , HandlerErrorCode: InvalidRequest)

Reproduction Steps

Create an agent

import { bedrock } from '@cdklabs/generative-ai-cdk-constructs';

   new bedrock.Agent(this, 'Agent', {
      foundationModel: bedrock.BedrockFoundationModel.ANTHROPIC_CLAUDE_SONNET_V1_0,
      instruction: 'You are a helpful and friendly agent that answers questions about literature.',
      shouldPrepareAgent: true,
      enableUserInput: true,
    });

Run cdk deploy, and then change enableUserInput: false:

-      enableUserInput: true,
+      enableUserInput: false,

cdk deploy, and we get the above error.

Possible Solution

As the error message suggests, we need to use SkipResourceInUseCheckOnDelete flag or mark it as Disabled. As the stateless nature of CDK, SkipResourceInUseCheckOnDelete seems to be a better option, but not sure the risk of defaulting it to true.

Additional Information/Context

No response

CDK CLI Version

2.151.0

Framework Version

No response

Node.js Version

v20.10.0

OS

macOS

Language

Typescript

Language Version

No response

Region experiencing the issue

us-west-2

Code modification

no

Other information

No response

Service quota

• [X] I have reviewed the service quotas for this construct

[krokoko]

Hi @tmokmss , thank you for reporting this issue ! Just to be clear, could you please confirm the reproduction steps ? My understanding is:

• Deploy the code sample listed above with enableUserInput: true
• Update the stack code, and change enableUserInput to false, then re-deploy
• Deployment error

[tmokmss]

@krokoko yes exactly! Thank you for taking care of the issue.

[krokoko]

Thanks @tmokmss ! I will try to reproduce and update this ticket as soon as I have more information

[krokoko]

Hi @tmokmss , I was able to reproduce the issue. Will update the ticket when I have more details

[krokoko]

Notes:

• It seems the issue happens only with the action group related to enableUserInput, any other action group can be removed properly
• This specific action group is not visible through the console
• Still through the console, if you explicitly change the "enableUserInput" to false, and try to destroy the stack, the same error appears and the action group still seems to be marked as "enabled"

[aws-rafams]

I have understood what is the problem here, when enableUserInput: true, this action group is visible on the console under Agent builder -> Additional Settings -> User Input. This part gets created by this piece of code here: https://github.com/awslabs/generative-ai-cdk-constructs/blob/6b5bbeb84de1515d620f88762276ad91c788b9c9/src/cdk-lib/bedrock/agent.ts#L492-L498 the problem is that when the update happens, this content of this if statement is not executed and thus the ActionGroup is not synthesized, thus disappearing from the template and triggering DELETE operation, however, this delete operation is not allowed, because it should either be set to DISABLED (an update to the ActionGroup resource), or skipResourceInUseCheckOnDelete must be set to true. I believe the easiest solution to this bug is to set:

+      skipResourceInUseCheckOnDelete: true,

during the ActionGroup Creation as in PR #642. Otherwise the other solution would be to always create the action group and according to whether it must be enabled, set the actionGroupState accordingly:

this.addActionGroup(new AgentActionGroup(this, 'userInputEnabledActionGroup', {
    actionGroupName: 'UserInputAction',
    parentActionGroupSignature: 'AMAZON.UserInput',
    actionGroupState: props.enableUserInput ? 'ENABLED' :  'DISABLED',
}));