AWS’s Bedrock Chat Blueprint Carries Tenant Filters Across Every Retrieval Hop

A document-chat agent can turn one question into several searches, creating several chances to cross a user boundary. AWS has published a Bedrock Managed Knowledge Base reference architecture that applies a per-user filter to each retrieval hop while the managed service handles document processing and response generation.

The boundary starts before a file reaches the knowledge base. The application validates an Amazon Cognito JSON Web Token, derives the caller’s identity on the server, and attaches it as user_id metadata to the document. For chat, the server builds an explicit equality filter from that same verified token, rather than accepting an identifier from the browser.

AgenticRetrieveStream can break a complex request into sub-queries and run multi-hop retrieval before generating a cited response. AWS says the explicit filter travels across those hops. A filter inferred from a question’s wording may improve relevance, but AWS says it is not access control; the sample also discards returned chunks whose user_id does not match the caller.

One shared index, two isolation options

AWS outlines two ways to isolate tenants: separate knowledge bases, or one shared knowledge base with every query scoped to the caller. Its guidance favors the shared model for many end users because it avoids per-account knowledge-base quotas, the baseline cost of many small indexes, and sign-up provisioning delays. Separate bases can still fit a small number of large tenants with strict separation needs.

Uploads have a readiness gap

The design uses a custom connector and IngestKnowledgeBaseDocuments for direct uploads instead of scheduled S3 synchronization. Files up to 6 MB are sent inline; larger text files, up to 50 MB, are staged in S3 and ingested by reference. SQS separates uploads from ingestion, while DynamoDB records indexing status for the application.

Ingestion is asynchronous: documents move from STARTING through PENDING and IN_PROGRESS before reaching TEXT_INDEXED or INDEXED. Text is searchable at TEXT_INDEXED; multimodal elements, including PDF images and tables, become queryable at INDEXED. The reference app polls the status and can present received, processing, and ready states rather than treating acceptance as searchability.

AWS observed two-to-three-second queryability for small plain-text files on an idle knowledge base. Small PDFs reached text-queryable status in five to 30 seconds and full indexing in about 90 seconds, but AWS says those figures are not service commitments and vary with document and system conditions.

The result is a deployable pattern, not a finished chat product. Bedrock manages ingestion, storage, embedding, indexing, ranking, retrieval, and generation; the application still owns authentication, user isolation, and product logic. AWS provides an accompanying sample repository for deployment in a customer’s own account.