Bedrock AgentCore Queries Cross-Account Knowledge Bases via STS Role
In this article
Amazon Bedrock AgentCore can now orchestrate agents that query knowledge bases in a completely separate AWS account — without replicating the underlying data. The pattern AWS published on 26 August 2026 addresses a concrete constraint in multi-account enterprise architectures: RetrieveAndGenerate, the Knowledge Bases API action that returns a synthesized natural-language answer, is explicitly excluded from the cross-account resource policy actions that Amazon Bedrock Knowledge Bases supports. Only Retrieve and GetDocumentContent work natively across account boundaries via resource policy. To get generated answers cross-account, the agent tool must first assume a narrowly scoped IAM role in the data account using AWS STS, then call RetrieveAndGenerate under that assumed identity. This constraint is the architectural fulcrum everything else turns on.
The motivation maps directly to how pipeline architecture rather than model capability drives production AI gains: keeping agent workloads and governed data workloads in separate accounts is standard enterprise practice, and agents that cannot cross that boundary cleanly force either data duplication or coarse permission grants.
The Cross-Account IAM Boundary
The solution introduces a dedicated IAM role named bedrock_kb_access_role in the Knowledge Base account (placeholder ID 999999999999, referred to as agent-kb). The agent account (111122223333, referred to as agent) never touches the Redshift Serverless data directly. Instead, the tool calls sts:AssumeRole to obtain a temporary session scoped to only the required Knowledge Base and model resources, then invokes RetrieveAndGenerate within that session. The assumed-role session uses us.anthropic.claude-haiku-4-5-20251001-v1:0 in the agent-kb account for answer generation; the orchestrating agent in the agent account runs on us.amazon.nova-pro-v1:0. Both model access grants must be enabled in US West (Oregon), us-west-2. STS credentials must be refreshed in long-lived runtimes and warm Lambda environments to avoid expiry mid-conversation.
Two Orchestration Variants, One Data Boundary
AWS presents two implementation paths sharing the identical cross-account data access boundary, differing in who controls the agent loop and where the tool executes.
| Decision area | Code-based Strands agent (Variant 1) | Declarative AgentCore harness (Variant 2) |
|---|---|---|
| Agent loop ownership | Your Python code via the Strands Agents SDK | AgentCore runs the loop from the harness definition |
| Tool path | AgentCore runtime → local MCP subprocess → Knowledge Base | AgentCore harness → AgentCore Gateway → AWS Lambda → Knowledge Base |
| Cross-account principal | AgentCore runtime execution role | AWS Lambda execution role behind AgentCore Gateway |
| What you maintain | agent.py, dependencies, MCP server, tool logic, runtime configuration | Harness configuration, system prompt, Lambda tool, IAM, application behavior |
| Invocation API | InvokeAgentRuntime | InvokeHarness |
| Best fit | Custom orchestration, hooks, middleware, retry logic, streaming control | Configuration-first teams whose use case fits the managed loop |
Variant 1 packages the MCP tool as a local subprocess alongside the agent on AgentCore runtime. Variant 2 routes tool calls through AgentCore Gateway to a Lambda function, which performs the STS assumption and RetrieveAndGenerate call. Harness cleanup must complete before code-based runtime cleanup, because the Lambda execution role trust grant must be removed from the shared bedrock_kb_access_role first.
Prerequisites and Request Flow
Deploying either variant requires two AWS accounts, AWS CLI v2.24.22 or later with credentials for both, Python 3.10 or later, jq, and a structured Bedrock Knowledge Base already connected to Amazon Redshift Serverless. The harness variant additionally requires the @aws/agentcore Node.js CLI alongside the Python bedrock-agentcore CLI. Account IDs should be discovered dynamically via aws sts get-caller-identity rather than hardcoded.
The request sequence: a user submits a natural-language question through the Streamlit UI or the AgentCore API; Amazon Nova Pro decides to invoke the query_knowledge_base tool; the tool assumes bedrock_kb_access_role via STS; the assumed session calls RetrieveAndGenerate with Claude Haiku 4.5, which translates the question into a structured query against Redshift Serverless; the generated answer and citations return through the chosen orchestration path. Sample questions for the TPC-H dataset — including "Show the 100 highest-value orders marked 1-URGENT from October 1 through December 31, 1997" — illustrate why bounding row-level queries with an explicit row count, date range, and sort order is a stated recommended practice: unbounded generated SQL can exceed result-handling limits.
AWS recommends applying Amazon Bedrock Guardrails to evaluate both user questions and generated answers for harmful content, denied topics, and sensitive information, noting explicitly that Guardrails complement rather than replace least-privilege access controls, source data governance, and human review for consequential decisions. This aligns with the broader pattern of layered agent control without a shared contract becoming the norm in production agent deployments.
The cross-account RetrieveAndGenerate pattern will become a standard building block as agent builders push into multi-tenant and multi-account AWS deployments. AWS's explicit guidance to start with native Retrieve or a direct RetrieveAndGenerate call before reaching for a full agent — and to choose the harness only when the managed loop genuinely fits — reflects how AWS positions AgentCore: not as a default orchestration wrapper, but as a tool selected when model-controlled decision-making over tools is actually required.