Secure multi-tenant RAG with Amazon Bedrock and Verified Permissions

This article demonstrates a defense-in-depth authorization pattern for secure multi-tenant RAG applications using Amazon Bedrock Knowledge Bases and Amazon Verified Permissions to enforce document-level access control across departments within a single tenant.

• Use a single Amazon Bedrock Knowledge Base with metadata filtering to isolate documents by department, reducing infrastructure costs versus per-department instances.
• Implement two independent authorization layers: Layer 1 (API-level via Lambda Authorizer) and Layer 2 (document-level via middleware Lambda) both evaluating Cedar policies.
• Externalize authorization logic into Cedar policies managed by Amazon Verified Permissions, enabling runtime policy updates without code redeployment.
• Tag documents with department metadata during ingestion using an event-driven pipeline with S3 sidecars and scheduled Amazon Bedrock ingestion jobs.
• Apply metadata filters at retrieval time to exclude unauthorized documents before the foundation model processes them.
• Add Guardrails for Amazon Bedrock as an output safety layer to validate response grounding and content filtering.
• Deny by default: both authorization layers fail closed if Verified Permissions is unavailable, preventing unauthorized access.

This pattern enables organizations to serve multiple departments from a single RAG application with granular, auditable access control while maintaining logical document isolation and cost efficiency within a single tenant boundary.