AWS adds per-user document access control to Bedrock knowledge base tools
Start here
AWS has published a method for giving a shared AI agent per-user document access on Amazon Bedrock Managed Knowledge Base. The approach exposes knowledge base search as MCP tools through AgentCore Gateway; a request interceptor takes the verified user's email from the Cognito JWT and puts it into userContext, and ACL awareness then returns only documents that user is allowed to view. Two further controls back this up: a Cedar policy in AgentCore and a resource-based policy on the knowledge base, which AWS describes as secondary defenses against spoofed or unauthorized searches. The setup is aimed at agents shared across many users, where each person should see only their own permitted documents.
Generated from reports · updated 22 h ago
Report timeline
Follow the reports to see the event from different sides.
- AWS Machine Learning BlogFine-grained access control for Amazon Bedrock Managed Knowledge Base tools
AWS shows how to give a shared AI agent per-user document access on Amazon Bedrock Managed Knowledge Base by exposing search as MCP tools through AgentCore Gateway. A request interceptor injects the verified user's email from the Cognito JWT into userContext, and ACL awareness returns only documents that user may view. A Cedar policy in AgentCore and a resource-based policy on the knowledge base add secondary defenses against spoofed or unauthorized searches.
Heat for this event
Not enough continuous observations yet to draw a trend.