Create a service role for managed Amazon Bedrock Knowledge Bases

To use a custom role for a managed knowledge base instead of the one Amazon Bedrock automatically creates, create an IAM role and attach the following permissions by following the steps at Creating a role to delegate permissions to an AWS service. Include only the necessary permissions for your own security.

Trust relationship

The following policy allows Amazon Bedrock to assume this role and create and manage knowledge bases. You can restrict the scope of the permission by using one or more global condition context keys. For more information, see AWS global condition context keys. Set the aws:SourceAccount value to your account ID. Use the ArnEquals or ArnLike condition to restrict the scope to specific knowledge bases.

Permissions to access Amazon Bedrock models

Attach the following policy to provide permissions for the role to use Amazon Bedrock models to embed your source data.

If you use the TwelveLabs Marengo Embed 3.0 embedding model, the knowledge base invokes the model both synchronously and asynchronously, so the role needs permissions for both. Attach the following statements, replacing ${Region} and ${AccountId} with the AWS Region and account ID for your knowledge base, and ${InferenceProfileId} with the ID of the inference profile that you use. The foundation-model ARN uses * for the Region instead of a specific Region. This is required because a cross-region inference profile can route the model invocation to the underlying foundation model in any of its member AWS Regions.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "BedrockInvokeModelStatement",
            "Effect": "Allow",
            "Action": [
                "bedrock:InvokeModel"
            ],
            "Resource": [
                "arn:aws:bedrock:*::foundation-model/twelvelabs.marengo-embed-3-0-v1:0",
                "arn:aws:bedrock:${Region}:${AccountId}:inference-profile/${InferenceProfileId}",
                "arn:aws:bedrock:${Region}:${AccountId}:async-invoke/*"
            ]
        },
        {
            "Sid": "BedrockGetAsyncInvokeStatement",
            "Effect": "Allow",
            "Action": [
                "bedrock:GetAsyncInvoke"
            ],
            "Resource": [
                "arn:aws:bedrock:${Region}:${AccountId}:async-invoke/*"
            ]
        }
    ]
}

Permissions for your multimodal storage destination

The multimodal storage destination is the Amazon S3 bucket that is used for processing and ingesting multimodal content into your knowledge base. Amazon Bedrock Knowledge Bases creates an aws/ prefix folder within your bucket for easy access.

Attach the following policy to provide permissions for the role to read, write, and delete this content. Replace amzn-s3-demo-bucket with the name of your multimodal storage bucket.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "S3MultimodalStorageListStatement",
            "Effect": "Allow",
            "Action": [
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket"
            ]
        },
        {
            "Sid": "S3MultimodalStorageObjectStatement",
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": [
                "arn:aws:s3:::amzn-s3-demo-bucket/*"
            ]
        }
    ]
}

Permissions to access your data sources

Select from the following data sources to attach the necessary permissions for the role.

Permissions to access your Amazon S3 data source

If your data source is Amazon S3, attach the following policy to provide permissions for the role to access the S3 bucket that you will connect to as your data source.

If you encrypted the data source with a AWS KMS key, attach permissions to decrypt the key to the role by following the steps at Permissions to decrypt your AWS KMS key for your data sources in Amazon S3.

Permissions to access your Confluence data source

Attach the following policy to provide permissions for the role to access Confluence.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "secretsmanager:GetSecretValue"
        ],
        "Resource": [
            "arn:aws:secretsmanager:${Region}:${AccountId}:secret:${SecretId}"
        ]
    }]
}

Permissions to access your Microsoft SharePoint data source

Attach the following policy to provide permissions for the role to access Microsoft SharePoint.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "secretsmanager:GetSecretValue"
        ],
        "Resource": [
            "arn:aws:secretsmanager:${Region}:${AccountId}:secret:${SecretId}"
        ]
    }]
}

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "s3:GetObject"
        ],
        "Resource": [
            "arn:aws:s3:::${CertificateBucketName}/${CertificateKeyPath}"
        ]
    }]
}

Permissions to access your Web Crawler data source

Attach the following policy to provide permissions for the role to access websites through the Web Crawler. If your website requires authentication, include permissions to access the AWS Secrets Manager secret that stores your credentials.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "secretsmanager:GetSecretValue"
        ],
        "Resource": [
            "arn:aws:secretsmanager:${Region}:${AccountId}:secret:${SecretId}"
        ]
    }]
}

Permissions to access your Microsoft OneDrive data source

Attach the following policy to provide permissions for the role to access Microsoft OneDrive.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "secretsmanager:GetSecretValue"
        ],
        "Resource": [
            "arn:aws:secretsmanager:${Region}:${AccountId}:secret:${SecretId}"
        ]
    }]
}

Permissions to access your Google Drive data source

Attach the following policy to provide permissions for the role to access Google Drive.

{
    "Version": "2012-10-17",
    "Statement": [{
        "Effect": "Allow",
        "Action": [
            "secretsmanager:GetSecretValue"
        ],
        "Resource": [
            "arn:aws:secretsmanager:${Region}:${AccountId}:secret:${SecretId}"
        ]
    }]
}