Secure multi-tenant RAG with Amazon Bedrock and Verified Permissions | Amazon Web Services

What this post added

Introduces a two-layer, defense-in-depth authorization pattern for granular, intra-tenant access control in RAG applications using Amazon Bedrock and Verified Permissions. This pattern allows for dynamic, runtime-evaluated authorization decisions based on Cedar policies, enabling fine-grained document-level access control at retrieval time within a single Amazon Bedrock Knowledge Bases instance, without redeploying code. It details the use of Amazon API Gateway with Lambda Authorizer for initial API access control and a middleware Lambda function to orchestrate calls to Amazon Bedrock's RetrieveAndGenerate API with dynamically constructed metadata filters derived from Verified Permissions policy evaluations.