Building a RAG architecture on Amazon Bedrock to support CJIS compliance

This article describes a Retrieval Augmented Generation (RAG) architecture on Amazon Bedrock that enables law enforcement agencies to query sensitive CJIS-classified documents using natural language while maintaining compliance and security.

• Deploy in commercial AWS Regions or AWS GovCloud (US) with AWS KMS encryption and AWS Nitro System controls
• Amazon Bedrock Managed Knowledge Base handles chunking, embedding, vector indexing, and agentic retrieval with citation-backed answers
• Expose knowledge base through Amazon Bedrock AgentCore Gateway using Model Context Protocol for agent-agnostic access
• Implement document-level access control (ACL-aware retrieval) to enforce case compartmentalization and need-to-know access
• Security controls include encryption at rest and in transit, VPC endpoints, IAM roles, MFA, and comprehensive CloudTrail logging
• POC-scale deployment costs approximately $78–$191 per month, accessible to municipal agencies

Law enforcement agencies can deploy this fully managed, serverless architecture in commercial Regions with technical controls designed for CJIS compliance without compromising security.