Run the room

Sample one-day agenda

Provisioning takes minutes, so start up N before breaks. Anyone behind can catch up with up N.

Set up the class

1. List companies and participants

   Edit roster.json. Participants are grouped by company under teams. Each company becomes a LiteLLM team bootcamp-<company> whose budget_usd caps what its participants spend together. Each participant gets default_budget_usd unless they set their own budget_usd; optionally add principal_arn to restrict who may assume their role. Participant roles are tagged Team=<company> as well as Participant=<name>.

   roster.jsonCopy

   {
     "default_budget_usd": 1,
     "dns_zone": "workshop.example.com",
     "dns_prefix": "bootcamp",
     "teams": {
       "acme": {
         "budget_usd": 20,
         "participants": {
           "alice": {},
           "bob": {"budget_usd": 2}
         }
       },
       "globex": {
         "budget_usd": 15,
         "participants": {"carol": {}}
       }
     },
     "alert_email": "instructor@example.com",
     "infra_limits": {"enforce": true, "monthly_budget_usd": 100, "per_participant": {"code_interpreter_sessions": 3, "browser_sessions": 3}}
   }

2. Bring up the account stack (once)

   terminalCopy

   uv run bootcamp.py account up

   Deploys the shared platform, creates a bootcamp-participant-<name> role per participant and syncs their server-side virtual keys and budgets. Adding a participant later also needs account up, because it creates their IAM role.

3. Sync server-side virtual keys and budgets

   terminalCopy

   uv run bootcamp.py account keys

   Only syncs LiteLLM virtual keys and budgets with roster.json, for example to top up someone who ran out. Keys stay on the server and are never handed out: the gateway maps each IAM role to its key.

4. Hand out names and SSO details

   Give each participant their PARTICIPANT name, the SSO start URL and region (see below), and point them at this site. The CLI derives their role; BOOTCAMP_ROLE_ARN is only an optional override.

5. Watch spend during the day

   terminalCopy

   uv run bootcamp.py account spend

   Prints spend per company team, then per participant.

6. Tear down

   Ask participants to run uv run bootcamp.py down, then check for leftovers and remove the account stack:

   terminalCopy

   uv run bootcamp.py account purge           # dry run: lists leftover participant resources
   uv run bootcamp.py account purge --force   # deletes them (only if the list wasn't empty)
   uv run bootcamp.py account down

   account down refuses while any participant resources still exist and lists them; account down --force purges first, then destroys.

Participant AWS access (SSO)

Participants sign in with AWS IAM Identity Center: share the SSO start URL and region; they run aws configure sso and put the profile in AWS_PROFILE. The CLI then assumes bootcamp-participant-<name>.

Each role's trust defaults to the account root, so the participants' permission set must allow sts:AssumeRole on arn:aws:iam::<account>:role/bootcamp/bootcamp-participant-*. To pin a role to one person, set principal_arn for that participant in roster.json.

Infra guardrails

LLM spend is capped by LiteLLM: per-participant budgets inside per-company team budgets (HTTP 429 budget_exceeded). AWS spend is watched by an infra guard Lambda, CloudWatch alarms and an AWS Budget, all alerting to the SNS topic bootcamp-alerts.

Per-participant limits

The guard reacts within seconds to new Code Interpreter / Browser sessions (a dedicated CloudTrail trail, bootcamp-agentcore-sessions, logs only those two session-start data events; nothing else in the sandbox is logged) and sweeps live resources every 5 minutes. It attributes usage by caller role (bootcamp-participant-<p> / awsworkshop-<p>-*) and resource name. Alerts are de-duplicated per hour.

Override per team (teams.<t>.infra_limits) or per participant (teams.<t>.participants.<p>.infra_limits). Class-wide totals default to per-participant × headcount (override with infra_limits.class). Auto-stop needs infra_limits.enforce: true; runtimes, gateways and memories are alert-only.

Alarms

The 5-minute sweep also reports when the LiteLLM gateway autoscaling is at its max task count.

Cost

AWS Budget bootcamp-genai-bootcamp-tagged on cost tag Project=genai-bootcamp (infra_limits.monthly_budget_usd, default $100), notifying at 80% actual and 100% forecast. AWS-managed tool sessions can't be tagged, so set infra_limits.account_budget_usd > 0 if you also want an account-wide budget.

Manual steps

1. Set alert_email in roster.json and run uv run bootcamp.py account up.
2. Confirm the SNS subscription email. Until then nobody is emailed.
3. Activate Project as a cost allocation tag in the payer account.
4. Optional billing alarm: enable billing alerts, put enable_billing_alarm = true in terraform/account/terraform.tfvars, then run account up.