AWS Bedrock Knowledge Base

RAG and document sync with AWS Bedrock Knowledge Bases

Overview

The AWS Bedrock Knowledge Base tools let you query an existing AWS Bedrock Knowledge Base — either retrieving raw documents or generating a RAG answer — and sync new PDF documents into its S3 data source.

Key Features

• AWS_BEDROCK_KNOWLEDGE_BASE

  • Query an AWS Bedrock Knowledge Base with a natural language query.
  • Two modes (set via the mode config): retrieve returns raw retrieval results (content, source location, score, metadata), while retrieveAndGenerate (default) returns an LLM-generated response with source citations.
  • numberOfResults controls how many documents are retrieved (1–100, default 5).
  • In retrieve mode, the output also reports guardrailAction (INTERVENED or NONE) when guardrails are configured.

• AWS_BEDROCK_KNOWLEDGE_BASE_PDF_SYNC

  • Upload a PDF to the S3 data source of an existing Bedrock Knowledge Base and start an ingestion job.
  • pdf input accepts a base64 string, a data URL (data:application/pdf;base64,...), or a public HTTPS URL.
  • Deduplicates by content: the object key is derived from the SHA-256 hash of the PDF, and if the same content already exists in S3, the upload and ingestion are skipped (skipped: true).
  • Optionally waits for the ingestion job to finish (waitForIngestion, default true) with a configurable timeout (ingestionTimeoutSeconds, 30–1800, default 300) and polling interval (ingestionPollIntervalSeconds, 1–60, default 5).
  • Output includes the S3 bucket and objectKey, the contentHash, and the ingestionJobId / ingestionStatus.

Authentication

Both tools authenticate with AWS access keys, configured per step:

• accessKeyId: An AWS_ACCESS_KEY_ID value, or the name of the Flow secret that contains it.
• secretAccessKey: An AWS_SECRET_ACCESS_KEY value, or the name of the Flow secret that contains it.

Each builder should register their own AWS credential secrets. In addition to credentials, the config requires:

• region: AWS region of the Bedrock Knowledge Base.
• knowledgeBaseId: The Bedrock Knowledge Base ID.
• dataSourceId (PDF sync only): The target S3 data source ID of the knowledge base.
• s3KeyPrefix (PDF sync only, optional): Additional folder appended after the data source prefix. The uploaded object path becomes {S3_bucket_name}{dataSourcePrefix}{s3KeyPrefix}/... — omit any leading / and never include the bucket name itself.

Note: Treat AWS credentials as sensitive information and never commit them to public repositories.

Usage Examples

Example: RAG Answer from a Knowledge Base

- id: ask_kb
  tool: AWS_BEDROCK_KNOWLEDGE_BASE
  config:
    - name: region
      value: us-east-1
    - name: knowledgeBaseId
      value: "YOUR_KB_ID"
    - name: mode
      value: retrieveAndGenerate
    - name: accessKeyId
      value: "{{secrets.AWS_ACCESS_KEY_ID}}"
    - name: secretAccessKey
      value: "{{secrets.AWS_SECRET_ACCESS_KEY}}"
  input:
    - name: query
      value: "What is our refund policy for annual contracts?"
    - name: numberOfResults
      value: 5

Example: Sync a PDF and Query It

- id: sync_pdf
  tool: AWS_BEDROCK_KNOWLEDGE_BASE_PDF_SYNC
  config:
    - name: region
      value: us-east-1
    - name: knowledgeBaseId
      value: "YOUR_KB_ID"
    - name: dataSourceId
      value: "YOUR_DATA_SOURCE_ID"
    - name: accessKeyId
      value: "{{secrets.AWS_ACCESS_KEY_ID}}"
    - name: secretAccessKey
      value: "{{secrets.AWS_SECRET_ACCESS_KEY}}"
  input:
    - name: pdf
      value: "https://example.com/reports/q3-report.pdf"
    - name: filename
      value: "q3-report.pdf"
    - name: waitForIngestion
      value: true

- id: query_kb
  tool: AWS_BEDROCK_KNOWLEDGE_BASE
  config:
    - name: region
      value: us-east-1
    - name: knowledgeBaseId
      value: "YOUR_KB_ID"
    - name: mode
      value: retrieve
    - name: accessKeyId
      value: "{{secrets.AWS_ACCESS_KEY_ID}}"
    - name: secretAccessKey
      value: "{{secrets.AWS_SECRET_ACCESS_KEY}}"
  input:
    - name: query
      value: "Key revenue drivers in the Q3 report"
    - name: numberOfResults
      value: 10

Notes

• PDF size limit: PDFs larger than 100 MB are rejected.
• PDF validation: The file must start with a %PDF header; other file types are rejected.
• HTTPS only: Insecure http:// URLs are rejected for the pdf input — use HTTPS.
• Deduplication: The uploaded object is named {sha256}.pdf. If an object with the same content hash already exists, the tool skips both upload and ingestion and returns skipped: true.
• Filename: filename is used for logging only; it is sanitized (special characters replaced) and truncated to 100 characters. Defaults to document.pdf.
• Ingestion wait: When waitForIngestion is true, the step fails if the ingestion job ends with FAILED, STOPPING, or STOPPED, or if it does not complete within ingestionTimeoutSeconds.
• numberOfResults for querying is capped at 100.