Connect Amazon Bedrock AgentCore to cross-account knowledge bases
Amazon Web Services Kunal Ghosh
AWS showed how AgentCore agents can query a knowledge base in another account without copying the data. The twist: the answer comes back through a narrow STS role, not broad cross-account access.
Based on reporting by Amazon Web Services, Kunal Ghosh — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
AWS has published a pattern for one of enterprise AI’s messier problems: how an agent in one AWS account can answer questions from structured data that lives in another. The setup uses Amazon Bedrock AgentCore on one side and Amazon Bedrock Knowledge Bases backed by Amazon Redshift Serverless on the other, with no data copy in between.
The important constraint is security. Knowledge Bases resource policies can allow cross-account Retrieve and GetDocumentContent, but not RetrieveAndGenerate. Since this design needs the generated answer, the tool first assumes a tightly scoped IAM role in the Knowledge Base account with AWS STS, then calls RetrieveAndGenerate and sends the result back.
AWS lays out two generally available AgentCore paths. One is a code-based Strands agent running on AgentCore runtime. The other is a declarative AgentCore harness. Both follow the same trust boundary, but they split responsibility differently: in one case, your Python code owns the loop; in the other, AgentCore does.
The request flow is pretty specific. A user asks a question in Streamlit or through an AgentCore API. Amazon Nova Pro decides whether to use the query_knowledge_base tool. From there, the path depends on the variant: the code-based version uses a local MCP subprocess packaged with AgentCore runtime, while the harness version goes through AgentCore Gateway to an AWS Lambda tool. The assumed role then calls RetrieveAndGenerate with Claude Haiku 4.5, and the knowledge base turns the question into a structured query against Redshift Serverless.
AWS’s real point here is not that agents are magical. It’s that you should not build one when a simpler cross-account Retrieve or direct RetrieveAndGenerate call will do. Use the agent only when the model needs to choose when or how to query the knowledge base as part of a broader conversation or tool-using workflow. And if you do need the agent, pick the code-based variant for custom orchestration, hooks, retry behavior, and streaming control; pick the harness when you want the managed loop and a config-first setup.
My take — AI-written commentary, not fact-checked reporting
This is the sane part of the agent boom: less “let the model run wild,” more “give it one narrow door and lock the rest.” AWS is basically admitting that cross-account AI gets ugly fast unless the permissions story is boring. Boring is good; boring keeps auditors awake and incidents asleep.
Read more about this at: Amazon Web Services