TLDR: Amazon Web Services (AWS) has announced a new capability allowing Amazon Bedrock agents to securely connect with knowledge bases residing in different AWS accounts. This innovation addresses a critical challenge for enterprises with multi-account architectures, enabling AI agents to leverage structured data in Amazon Redshift clusters across various accounts without duplicating data or compromising security. The solution employs a serverless architecture utilizing AWS Lambda for secure cross-account data access.
Amazon Web Services (AWS) has rolled out a significant enhancement for its Amazon Bedrock service, enabling AI agents to establish secure connections with knowledge bases located in separate AWS accounts. This new feature, announced on November 7, 2025, is designed to overcome the limitations faced by organizations operating with multi-account AWS environments, particularly when their structured data repositories, such as Amazon Redshift clusters, are distributed across different accounts.
Previously, a major hurdle for enterprises building AI agents with Amazon Bedrock was the lack of native support for cross-account Redshift integration within Amazon Bedrock Knowledge Bases. This posed challenges for companies aiming to utilize existing structured data for their AI agents, maintain strict separation of concerns across accounts, avoid data duplication, and ensure robust security and access controls.
The Solution: A Secure, Serverless Architecture
AWS’s new solution introduces a secure, serverless architecture that facilitates cross-account knowledge base integration while upholding stringent access controls. The core of this approach involves using AWS Lambda as an intermediary, enabling AI agents to query structured data securely across different accounts.
Architectural Overview:
1. User Interaction: Users initiate natural language queries through Amazon Bedrock Agents, configured within an ‘agent account’.
2. Lambda Invocation: The Amazon Bedrock Agent triggers an AWS Lambda function via action groups. This Lambda function is designed to provide access to the Amazon Bedrock knowledge base, which is set up in a separate ‘agent-kb account’.
3. Data Retrieval: The knowledge base in the ‘agent-kb account’ directly connects to Amazon Redshift Serverless within a private Virtual Private Cloud (VPC). The Lambda function then retrieves the response from this structured knowledge base.
Key Advantages of the New Architecture:
Leverages Bedrock Knowledge Bases: Fully utilizes the capabilities of Amazon Bedrock Knowledge Bases for structured data.
Seamless Integration: Provides a more integrated and efficient connection between the AI agent and its data source.
Enhanced Security: Maintains secure access controls through a well-defined, serverless architecture.
No Data Duplication: Eliminates the need to duplicate data across accounts, promoting data integrity and reducing operational overhead.
Multi-Account Compliance: Supports enterprise multi-account strategies by allowing data repositories to reside in separate AWS accounts from the AI agents.
Prerequisites for Implementation:
To implement this solution, organizations will need:
Two distinct AWS accounts.
Specific IAM permissions configured for both accounts.
AWS CLI (version 2.24.22 or current) installed and authenticated with IAM user credentials for each account.
jq (version 1.7.1 or current), a lightweight command-line JSON processor, installed.
Verified access to relevant foundation models, such as Nova Pro (us.amazon.nova-pro-v1:0) in the agent account and meta.llama3-1-70b-instruct-v1:0 in the agent-kb account.
Also Read:
- AWS and Strands Agents Revolutionize Public Sector Geospatial Data Access with Generative AI
- Amazon Unveils NOVA Act AI Agent, Bolstering US Market Presence and AI Capabilities
This development marks a significant step forward for enterprises seeking to build sophisticated and secure AI agents within complex, distributed cloud environments, offering a robust framework for cross-account data access and management.
