Amazon Bedrock Managed Knowledge Base: A Developer's Take

On June 17, 2026, AWS launched Amazon Bedrock Managed Knowledge Base, a fully managed retrieval-augmented generation (RAG) service. It is useful when:

• Your content lives in common enterprise systems such as Amazon S3, SharePoint, Confluence, Google Drive, or OneDrive.
• You need document-level access control.
• You want managed parsing, embeddings, vector storage, hybrid retrieval, and re-ranking.
• You want multi-step retrieval without building your own orchestration.
• Retrieval supports your product but is not the product itself.

Ingestion

Managed Knowledge Base ships with connectors for:

• Amazon S3
• Microsoft SharePoint
• Atlassian Confluence
• Google Drive
• Microsoft OneDrive
• Web Crawler
• Custom data sources

They support scheduled synchronization, so the index stays current without a separate ingestion app. Document-level access control works for the enterprise connectors but not the Web Crawler, because the crawler targets publicly accessible URLs and has no authenticated identity layer to map to document permissions. Treat the crawler as a fit for public content.

Smart Parsing

Real enterprise content is rarely clean text, so Smart Parsing picks a processing strategy per file type. Two engines do the work:

• BDA (Bedrock Data Automation) — converts content to searchable text via extraction, OCR, and transcription
• Default parser — basic text extraction for plain formats; no AI model involved, no extra cost

Format	Engine	What happens
PDF (text-based)	BDA	Text, tables, and images extracted with structure preserved
PDF (scanned)	BDA	OCR applied first, then text extracted and chunked
DOCX	BDA	Converted to PDF internally, then processed
TXT, MD, HTML, CSV, XLS, XLSX	Default parser	Plain text extraction; no AI model, no extra cost

Smart Parsing selects these paths automatically. On a Managed Knowledge Base it's the only parsing strategy, so you don't choose a parser or supply a parsing prompt.

Retrieval

1. Standard retrieval

Use Retrieve when a query can usually be answered in a single pass ("What is the travel reimbursement limit?", "What is the audit-log retention period?"). Standard retrieval supports hybrid search, combining semantic vector search with keyword matching, because neither is enough alone: semantic search handles meaning and paraphrasing, while keyword search handles exact identifiers, product names, error codes, and policy terms.

2. Document re-ranking

Initial results can be re-scored before they reach the application, which helps when many chunks look relevant but only a few answer the question. A common custom design:

query -> retrieve top 20 chunks -> re-rank -> send best 5 to the model

Managed Knowledge Base performs this step with a managed model. You can use the managed re-ranker, supply your own, or disable re-ranking.

3. Agentic retrieval

Use AgenticRetrieveStream when an answer spans multiple documents or policies. Consider: "What is the ML platform team's infrastructure budget, and does the expense policy allow prepaying annual commitments?" A single retrieval may find the budget but miss the policy. Agentic retrieval decomposes the question, retrieves iteratively, evaluates whether it has enough context, and produces a citation-backed response, removing the need to build that loop in LangGraph or a similar framework. It does not remove the need for application-level validation, authorization, observability, and evaluation.

Because agentic retrieval is more expensive and more quota-constrained, route by query type:

Simple factual query    -> Retrieve
Complex multi-document  -> AgenticRetrieveStream

Handle ThrottlingException and ServiceQuotaExceededException with bounded retries, exponential backoff with jitter, and a user-safe fallback.

Agentic retrieval and the service-managed embedding model aren't available in every Region. Confirm both are offered in your target Region before you design around them.

API Quick Start

Both APIs are in the bedrock-agent-runtime service. Here is the minimum viable call for each.

Standard retrieval — Retrieve

import boto3

client = boto3.client("bedrock-agent-runtime", region_name="us-east-1")

response = client.retrieve(
    knowledgeBaseId="KB12345678",
    retrievalQuery={"text": "What is the travel reimbursement limit?"},
    retrievalConfiguration={
        "managedSearchConfiguration": {
            "numberOfResults": 5
        }
    },
    userContext={"userId": "user-123"}  # required for per-user ACL filtering
)

for result in response["retrievalResults"]:
    print(result["content"]["text"])
    print(result["score"])
    print(result["location"])

Agentic retrieval — AgenticRetrieveStream

import boto3

client = boto3.client("bedrock-agent-runtime", region_name="us-east-1")

response = client.agentic_retrieve_stream(
    messages=[{
        "role": "user",
        "content": {"text": "What is the ML platform budget and does the expense policy allow annual prepayments?"}
    }],
    retrievers=[{
        "description": "Company policy knowledge base",
        "configuration": {
            "knowledgeBase": {"knowledgeBaseId": "KB12345678"}
        }
    }],
    agenticRetrieveConfiguration={
        "foundationModelType": "MANAGED",
        "maxAgentIteration": 5
    },
    generateResponse=True,
    userContext={"userId": "user-123"}
)

# response["stream"] follows standard boto3 EventStream handling
for event in response["stream"]:
    if "responseEvent" in event:
        print(event["responseEvent"]["text"], end="", flush=True)
    elif "result" in event:
        for citation in event["result"].get("generatedResponse", {}).get("citations", []):
            print(citation)

Both calls return a location field on each result identifying the source connector and document URI, which is what you use to build citations in the UI.

Limitations

• No external vector store — Managed Knowledge Base uses AWS-managed internal storage only. If you need OpenSearch Serverless, Aurora, or Neptune, use a customer-managed Knowledge Base instead.
• Guardrails on agentic retrieval: BLOCK only — AgenticRetrieveStream supports policyConfiguration with a Bedrock Guardrail, but only the BLOCK action is supported. MASK is not available on this path.
• Web Crawler has no ACL support — The crawler targets publicly accessible URLs and has no authenticated identity layer. Document-level permission filtering does not apply to crawled content.
• X-Ray traces for Retrieve only — Distributed tracing is not available for AgenticRetrieveStream.
• Metric delivery is best effort — A missing cloudwatch:PutMetricData permission silently drops metrics without failing the request or returning an error.

AgentCore Integration

Managed Knowledge Base integrates with Amazon Bedrock AgentCore and can be exposed through AgentCore Gateway as MCP-compatible tools for both Retrieve and AgenticRetrieveStream. Supported frameworks include Strands Agents, LangChain, CrewAI, LlamaIndex, and LangGraph, giving a standard tool interface without locking the whole application into one framework.

One important point to consider is that when, when the knowledge base is exposed via AgentCore, IAM identity is not passed along as the document-level user. Your application must send userContext explicitly, or the retrieval layer silently skips the per-user filtering you were counting on.

Guardrails

For standard Retrieve, the request accepts a guardrail configuration. For agentic retrieval, AgenticRetrieveStream accepts policyConfiguration with an Amazon Bedrock Guardrail; AWS currently supports the BLOCK action on this path, not MASK.

Observability

Managed Knowledge Base publishes metrics, ingestion logs, and X-Ray traces. All three need to be set up deliberately — none are on by default.

• CloudWatch Metrics — Published to the AWS/Bedrock/KnowledgeBases namespace. Key metrics include Invocations, ClientErrors, ServerErrors, Throttles, and TotalIterationCount (agentic retrieval only). RawDataSize is published after each ingestion job and tracks total indexed data in GB. Metric delivery is best effort — a missing cloudwatch:PutMetricData permission silently drops metrics without failing the request.
• X-Ray Traces — Distributed traces for the Retrieve operation delivered to AWS X-Ray. Configure with logType: TRACES and destination type XRAY. Not available for AgenticRetrieveStream.
• AgentCore Observability — If the knowledge base is exposed through AgentCore Gateway, metrics and traces automatically appear in the AgentCore observability console alongside other AgentCore telemetry. No additional configuration required.

Pricing

Pricing is pay-per-use with no minimum commitment.

Component	Price
Index storage	$5.00 per GB per month
Standard retrieval	$1.00 per 1,000 calls
Agentic retrieval	$4.00 per 1,000 agentic calls, plus $1.00 per 1,000 retrieval calls
Smart Parsing	Free with managed models
Managed embeddings	Free
Managed re-ranking	Free
Custom models	Standard Amazon Bedrock model pricing

As a rough estimate, 10 GB of indexed data plus 10,000 standard retrieval calls per month lands near $60. For a small or medium workload, the managed service can come in below the cost of operating a dedicated vector platform once engineering and operational effort are counted.

What Developers Still Own

Managed does not mean automatic. Your team still owns the decisions that shape application quality and safety.

Decision	What the team must define
Application authorization	How users and groups map to userContext
Knowledge base selection	Which data should be searched for each request
Embedding model	Managed or custom, with the same model used for ingestion and inference
Re-ranking	Managed, custom, or disabled
Chunking	Managed defaults or document-specific overrides
Agentic iteration limit	maxAgentIteration based on quality, latency, and cost
Evaluation	A repeatable set of queries, expected sources, and answer criteria
Observability	Latency, empty results, permission failures, retrieval quality, and cost
Failure handling	Timeouts, throttling, source sync failures, and fallback behavior
User experience	Citations, confidence cues, feedback, and escalation paths

A managed retrieval service reduces code, but it can't define what a correct answer means for your users.

Migrating from Amazon Kendra

On June 30, 2026, AWS placed Amazon Kendra into Maintenance Mode, meaning no new features or capabilities, and the service stops accepting new customers on July 30, 2026; existing customers can continue to use it. AWS points to Amazon Bedrock Knowledge Bases for similar capabilities. Treat this as a migration assessment rather than an API-compatible replacement: inventory Kendra indexes, connectors, metadata, ACL behavior, and relevance tuning; rebuild an evaluation set from real Kendra queries; compare retrieval quality and permission behavior; and recalculate cost and operational ownership before planning API changes.

Managed KB versus Customer-Managed KB

Bedrock Knowledge Bases existed before June 2026 — the customer-managed variant lets you bring your own vector store (OpenSearch Serverless, Aurora, Neptune) and own the full ingestion pipeline. Managed Knowledge Base removes that infrastructure entirely. AWS now recommends Managed Knowledge Base for most use cases.

Capability	Managed Knowledge Base	Customer-Managed KB
Vector storage	AWS-managed, auto-scaling	You provision (OpenSearch Serverless, Aurora, Neptune)
Connectors	S3, SharePoint, Confluence, Google Drive, OneDrive, Web Crawler	Not available
Document-level ACLs	Supported via connector ACLs	Not available
Parsing	Smart Parsing — auto-selects per file type	You build and manage
Chunking	Managed defaults with overrides	You configure
Embeddings	Managed (default) or custom	Custom only
Retrieval	Managed hybrid retrieval	You implement
Re-ranking	Managed re-ranker or your own	You implement
Multi-hop retrieval	Built-in agentic retrieval	Not available
AgentCore Gateway	Native integration	Not available
Pipeline control	AWS manages ingestion, indexing, retrieval	Full control over every step
External vector store	Not supported	Supported
Sync operations	Configured scheduled synchronization	You build

Choose customer-managed KB when you need a specific AWS vector store, cross-cloud portability, or full pipeline control. Otherwise, Managed Knowledge Base is the recommended path.

References

Topic	Source
General availability, connectors, and capabilities	Amazon Bedrock Managed Knowledge Base GA Announcement
Building a Managed Knowledge Base	Build a Managed Knowledge Base
Agentic retrieval behavior, permissions, and guardrail limitations	Use Agentic Retrieval
Retrieve API request, response model, and exception names	Retrieve API Reference
AgenticRetrieveStream request, response model, and exception names	AgenticRetrieveStream API Reference
Parsing and file-format support	Parsing Options for a Data Source
Managed Knowledge Base observability: metrics, ingestion logs, X-Ray traces, AgentCore integration	Observability for Managed Knowledge Bases
CloudFormation managed configuration and IaC limitations	ManagedKnowledgeBaseConfiguration
Managed KB vs customer-managed KB comparison	Knowledge Bases overview
Pricing	Amazon Bedrock Pricing
Kendra availability change	Amazon Kendra Availability Change
AgentCore Gateway integration and identity context	Managed Knowledge Base as an AgentCore Gateway Target