Connect Amazon Bedrock AgentCore to cross-account knowledge bases
Amazon Bedrock AgentCore now supports cross-account access to knowledge bases backed by Amazon Redshift Serverless without requiring data copying between accounts Two implementation variants are provided: a code-based Strands agent using local MCP subprocess and a declarative AgentCore harness using AWS Lambda through AgentCore Gateway The core technical challenge is that Bedrock Knowledge Bases resource policies support Retrieve and GetDocumentContent but not RetrieveAndGenerate for cross-accou
Analysis
TL;DR
- Amazon Bedrock AgentCore now supports cross-account access to knowledge bases backed by Amazon Redshift Serverless without requiring data copying between accounts
- Two implementation variants are provided: a code-based Strands agent using local MCP subprocess and a declarative AgentCore harness using AWS Lambda through AgentCore Gateway
- The core technical challenge is that Bedrock Knowledge Bases resource policies support Retrieve and GetDocumentContent but not RetrieveAndGenerate for cross-account operations, requiring a narrowly scoped IAM role assumption via AWS STS
- The solution uses Claude Haiku 4.5 within RetrieveAndGenerate to translate natural language questions into structured queries against Redshift Serverless
- Teams should choose between custom control (Strands agent) versus managed orchestration (declarative harness) based on their need for customization, hooks, middleware, and operational complexity
Why It Matters
This solution addresses a critical gap for enterprise AI deployments where data governance and security require strict account boundaries between agent workloads and data repositories. It enables organizations to build production-grade RAG systems over structured data in Redshift without compromising their multi-account architecture or duplicating governed data sources.
Technical Details
- Architecture: Both variants share the same cross-account data access boundary where a model-controlled tool assumes the
bedrock_kb_access_rolein the Knowledge Base account via AWS Security Token Service (STS), then callsRetrieveAndGeneratewith Claude Haiku 4.5 - Variant 1 - Strands Agent: Deploys a code-based Strands agent on AgentCore runtime where the tool runs in a local Model Context Protocol (MCP) subprocess; orchestration loop is controlled by Python code using the Strands Agents SDK with
InvokeAgentRuntimeAPI - Variant 2 - Declarative Harness: Uses a configuration-first approach where AgentCore runs the orchestration loop from the harness definition, calling an AWS Lambda tool through AgentCore Gateway with
InvokeHarnessAPI - Security Model: Leverages narrowly scoped IAM roles for least-privilege cross-account access, maintaining clear workload boundaries between agent accounts and data accounts
- Data Flow: Natural language question → Amazon Nova Pro decides to call
query_knowledge_basetool → assumes cross-account role via STS →RetrieveAndGeneratetranslates query to Redshift Serverless → answer and citations returned through orchestration path
Industry Insight
- Enterprises with multi-account AWS architectures should adopt this pattern to maintain data governance boundaries while enabling AI agents to query governed structured data sources without data replication, reducing compliance risk and storage costs
- The choice between Strands agents and declarative harnesses represents a fundamental tradeoff between flexibility and operational simplicity; teams should start with the simplest sufficient pattern and only escalate to full agent orchestration when multi-step reasoning or tool selection is genuinely required
- The limitation around
RetrieveAndGeneratenot being supported in cross-account resource policies suggests AWS may expand permission granularity in future updates, so organizations should monitor for native support that could eliminate the IAM role assumption complexity
Disclaimer: The above content is generated by AI and is for reference only.