Connect Amazon Bedrock AgentCore to cross-account knowledge bases
Machine Learning Blog
This article explains how AgentCore agents in one AWS account can generate answers from knowledge bases backed by Amazon Redshift Serverless in another account without copying source data.
- Agents assume a narrowly scoped IAM role to call RetrieveAndGenerate across account boundaries
- Two orchestration variants: code-based Strands agent on AgentCore runtime or declarative AgentCore harness
- Strands variant offers custom orchestration control; harness variant provides managed agent loop
- Both use same cross-account data access boundary with AWS STS role assumption
- Choose native Retrieve or direct RetrieveAndGenerate for simple workloads; use agents for model-controlled tools
- Implement least-privilege access, bound queries, and Amazon Bedrock Guardrails for security
Organizations can maintain clear workload boundaries between agent and data accounts while enabling governed cross-account knowledge base access through either custom or managed orchestration patterns.
The AWS News Feed is currently looking for gold sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.
The AWS News Feed is currently looking for silver sponsors. If you want to support the AWS community and reach a large audience of AWS professionals, consider sponsoring the AWS News Feed.