Vijil Dome

Vijil Dome relies on public Hugging Face models as part of its guardrail system.

Before deploying this CloudFormation stack, ensure that you have the required AWS resources and configurations in place.

Before setting up Vijil Dome, you will need the following in your AWS account:

• VPC ID: The VPC where all resources associated with this CloudFormation stack will be deployed.
• Subnet IDs: The associated Subnet IDs within the VPC.
• Security Groups:
  • ECS Cluster Security Group: Must allow inbound HTTP traffic (TCP port 80) from any IP address within the VPC's CIDR block.
  • Load Balancer Security Group:
    • If all traffic stays within the VPC, use the same security group as the ECS cluster.
    • If traffic is expected from outside the VPC, ensure this security group allows inbound HTTP traffic from external sources.

Vijil Dome requires an API key for authentication. Generate one using the following command:

• pip install bcrypt && python -c 'import bcrypt; import base64; print(base64.b64encode(bcrypt.hashpw("<your-random-password>".encode("utf-8"), bcrypt.gensalt(6))))'

Once your CloudFormation stack is deployed, it will create the following components:

1. ECS Service: Runs the Vijil Dome container on a newly created ECS cluster in the VPC you defined.
2. Application Load Balancer (ALB): Accepts HTTP calls and routes them to the ECS service.
3. IAM Role: Grants ECS the necessary permissions to retrieve secrets and interact with AWS services.
4. AWS Secrets Manager: Stores your API Key securely.
5. Logging & Monitoring: Logs are stored in Amazon CloudWatch under /ecs/VijilDomeTaskDefinition.

After deployment, verify that the Vijil Dome service is running correctly by executing the following commands:

1. Check Service Health: curl -XGET "http://<Your Load Balancer's DNS>/status"
2. Test Input Detection: curl -XGET "http://<Your Load Balancer's DNS>/async_input_detection?api_key=<Your API KEY>&input_str=hello"
3. Test Output Detection: curl -XGET "http://<Your Load Balancer's DNS>/async_output_detection?api_key=<Your API KEY>&output_str=hello"

• IAM Permissions:
  • The CloudFormation template creates an IAM Execution Role that allows ECS tasks to retrieve secrets and log events.
  • Ensure that this role is scoped appropriately to prevent unnecessary access.
• Restrict API Access:
  • Ensure your API key is securely stored and rotated if compromised.
  • Consider using AWS IAM Policies or API Gateway for additional authentication layers.
• Network Security:
  • If this service should not be publicly accessible, modify the Load Balancer Security Group to restrict access.
  • Use AWS Web Application Firewall (WAF) for additional protection.

If the service is not responding:

1. Check ECS Task Logs in CloudWatch (/ecs/VijilDomeTaskDefinition).
2. Verify that the Load Balancer Target Group reports healthy targets.
3. Ensure the ECS task is running and not stopped due to an error.

If you no longer need Vijil Dome, delete the CloudFormation stack to remove all associated AWS resources:

• aws cloudformation delete-stack --stack-name <YourStackName>

Ensure that the following resources are also cleaned up if manually modified:

• Secrets stored in AWS Secrets Manager.
• Security groups or networking resources.