Join Amazon Bedrock brokers to cross-account information bases

Organizations want seamless entry to their structured knowledge repositories to energy clever AI brokers. Nevertheless, when these sources span a number of AWS accounts integration challenges can come up. This submit explores a sensible answer for connecting Amazon Bedrock brokers to information bases in Amazon Redshift clusters residing in several AWS accounts.

The problem

Organizations that construct AI brokers utilizing Amazon Bedrock can preserve their structured knowledge in Amazon Redshift clusters. When these knowledge repositories exist in separate AWS accounts from their AI brokers, they face a major limitation: Amazon Bedrock Information Bases doesn’t natively help cross-account Redshift integration.

This creates a problem for enterprises with multi-account architectures who need to:

• Leverage current structured knowledge in Redshift for his or her AI brokers.
• Keep separation of issues throughout completely different AWS accounts.
• Keep away from duplicating knowledge throughout accounts.
• Guarantee correct safety and entry controls.

Answer overview

Our answer allows cross-account information base integration by means of a safe, serverless structure that maintains safe entry controls whereas permitting AI brokers to question structured knowledge. The strategy makes use of AWS Lambda as an middleman to facilitate safe cross-account knowledge entry.

The motion circulation as proven above:

1. Customers enter their pure language query in Amazon Bedrock Brokers which is configured within the agent account.
2. Amazon Bedrock Brokers invokes a Lambda operate by means of motion teams which offers entry to the Amazon Bedrock information base configured within the agent-kb account above.
3. Motion group Lambda operate operating in agent account assumes an IAM function created in agent-kb account above to connect with the information base within the agent-kb account.
4. Amazon Bedrock Information Base within the agent-kb account makes use of an IAM function created in the identical account to entry Amazon Redshift knowledge warehouse and question knowledge within the knowledge warehouse.

The answer follows these key parts:

1. Amazon Bedrock agent within the agent account that handles person interactions.
2. Amazon Redshift serverless workgroup in VPC and personal subnet within the agent-kb account containing structured knowledge.
3. Amazon Bedrock Information base utilizing the Amazon Redshift serverless workgroup as structured knowledge supply.
4. Lambda operate within the agent account.
5. Motion group configuration to attach the agent within the agent account to the Lambda operate.
6. IAM roles and insurance policies that allow safe cross-account entry.

Conditions

This answer requires you to have the next:

1. Two AWS accounts. Create an AWS account should you wouldn’t have one. Particular permissions required for each account which will likely be arrange in subsequent steps.
2. Set up the AWS CLI (2.24.22 – present model)
3. Arrange authentication utilizing IAM person credentials for the AWS CLI for every account
4. Be sure to have jq put in, jq is light-weight command-line JSON processor. For instance, in Mac you need to use the command brew set up jq (jq-1.7.1-apple – present model) to put in it.
5. Navigate to the Amazon Bedrock console and ensure you allow entry to the meta.llama3-1-70b-instruct-v1:0 mannequin for the agent-kb account and entry for us.amazon.nova-pro-v1:0 mannequin within the agent account within the us-west-2, US West (Oregon) AWS Area.

Assumption

Let’s name the AWS account profile, agent profile that has the Amazon Bedrock agent. Equally, the AWS account profile be referred to as agent-kb that has the Amazon Bedrock information base with Amazon Redshift Serverless and the structured knowledge supply. We are going to use the us-west-2 US West (Oregon) AWS Area however be happy to decide on one other AWS Area as needed (the stipulations will likely be relevant to the AWS Area you select to deploy this answer in). We are going to use the meta.llama3-1-70b-instruct-v1:0 mannequin for the agent-kb. That is an obtainable on-demand mannequin in us-west-2. You might be free to decide on different fashions with cross-Area inference however that might imply altering the roles and polices accordingly and allow mannequin entry in all Areas they’re obtainable in. Primarily based on our mannequin alternative for this answer the AWS Area have to be us-west-2. For the agent we will likely be utilizing an Amazon Bedrock agent optimized mannequin like us.amazon.nova-pro-v1:0.

Implementation walkthrough

The next is a step-by-step implementation information. Ensure to carry out all steps in the identical AWS Area in each accounts.

These steps are to deploy and take a look at an end-to-end answer from scratch and in case you are already operating a few of these parts, it’s possible you’ll skip over these steps.

1. 1. Make an observation of the AWS account numbers within the agent and agent-kb account. Within the implementation steps we’ll refer them as follows:
      

      Profile	AWS account	Description
      agent	111122223333	Account for the Bedrock Agent
      agent-kb	999999999999	Account for the Bedrock Information base

      Word: These steps use instance profile names and account numbers, please substitute with actuals earlier than operating.

   2. Create the Amazon Redshift Serverless workgroup within the agent-kb account:
      1. Go online to the agent-kb account
      2. Comply with the workshop link to create the Amazon Redshift Serverless workgroup in non-public subnet
      3. Make an observation of the namespace, workgroup, and different particulars and observe the remainder of the hands-on workshop directions.
   3. Set up your data warehouse within the agent-kb account.
   4. Create your AI knowledge base within the agent-kb account. Make an observation of the information base ID.
   5. Train your AI Assistant within the agent-kb account.
   6. Test natural language queries within the agent-kb account. You’ll find the code in aws-samples git repository: sample-for-amazon-bedrock-agent-connect-cross-account-kb.
   7. Create needed roles and insurance policies in each the accounts. Run the script create_bedrock_agent_kb_roles_policies.sh with the next enter parameters.
      

      Enter parameter	Worth	Description
      –agent-kb-profile	agent-kb	The agent knowledgebase profile that you simply arrange with the AWS CLI with aws_access_key_id, aws_secret_access_key as talked about within the stipulations.
      –lambda-role	lambda_bedrock_kb_query_role	That is the IAM function the agent account Bedrock agent motion group lambda will assume to connect with the Redshift cross account
      –kb-access-role	bedrock_kb_access_role	That is the IAM function the agent-kb account which the lambda_bedrock_kb_query_role in agent account assumes to connect with the Redshift cross account
      –kb-access-policy	bedrock_kb_access_policy	IAM coverage hooked up to the IAM function bedrock_kb_access_role
      –lambda-policy	lambda_bedrock_kb_query_policy	IAM coverage hooked up to the IAM function lambda_bedrock_kb_query_role
      –knowledge-base-id	XXXXXXXXXX	Exchange with the precise information base ID created in Step 4
      –agent-account	111122223333	Exchange with the 12-digit AWS account quantity the place the Bedrock agent is operating. (agent account)
      –agent-kb-account	999999999999	Exchange with the 12-digit AWS account quantity the place the Bedrock information base is operating. (agent-kb acccount)

   8. Obtain the script (create_bedrock_agent_kb_roles_policies.sh) from the aws-samples GitHub repository.
   9. Open Terminal in Mac or comparable bash shell for different platforms.
   10. Find and alter the listing to the downloaded location, present executable permissions:

       cd /my/location
       chmod +x create_bedrock_agent_kb_roles_policies.sh

   11. In case you are nonetheless not clear on the script utilization or inputs, then you’ll be able to run the script with the –assist possibility and the script will show the utilization:
       ./create_bedrock_agent_kb_roles_policies.sh –assist
   12. Run the script with the fitting enter parameters as described within the earlier desk.

       ./create_bedrock_agent_kb_roles_policies.sh --agent-profile agent  
         --agent-kb-profile agent-kb  
         --lambda-role lambda_bedrock_kb_query_role  
         --kb-access-role bedrock_kb_access_role  
         --kb-access-policy bedrock_kb_access_policy  
         --lambda-policy lambda_bedrock_kb_query_policy  
         --knowledge-base-id XXXXXXXXXX  
         --agent-account 111122223333  
         --agent-kb-account 999999999999

       

   13. The script on profitable execution exhibits the abstract of the IAM, roles and insurance policies created in each accounts.
       
   14. Go online to each the agent and agent-kb account to confirm the IAM roles and insurance policies are created.
       • • • For the agent account: Make an observation of the ARN of the lambda_bedrock_kb_query_role as that would be the worth of CloudFormation stack parameter AgentLambdaExecutionRoleArn within the subsequent step.
             
           • For the agent-kb account: Make an observation of the ARN of the bedrock_kb_access_role as that would be the worth of CloudFormation stack parameter TargetRoleArn within the subsequent step.
             
   15. Run the AWS CloudFormation script to create a Bedrock agent:
       1. 1. 1. 1. Obtain the CloudFormation script: cloudformation_bedrock_agent_kb_query_cross_account.yaml from the aws-samples GitHub repository.
                2. Go online to the agent account and navigate to the CloudFormation console, and confirm you might be within the us-west-2 (Oregon) Area, select Create stack and select With new sources (normal).
                   
                3. Within the Specify template part select Add a template file after which Select file and choose the file from (1). Then, select Subsequent.
                4. Enter the next stack particulars and select Subsequent.
                   

                   Parameter	Worth	Description
                   Stack identify	bedrock-agent-connect-kb-cross-account-agent	You possibly can select any identify
                   AgentFoundationModelId	us.amazon.nova-pro-v1:0	Don’t change
                   AgentLambdaExecutionRoleArn	arn:aws:iam:: 111122223333:function/lambda_bedrock_kb_query_role	Exchange with you agent account quantity
                   BedrockAgentDescription	Agent to question stock knowledge from Redshift Serverless database	Hold this as default
                   BedrockAgentInstructions	You might be an assistant that helps customers question stock knowledge from our Redshift Serverless database utilizing the motion group.	Don’t change
                   BedrockAgentName	bedrock_kb_query_cross_account	Hold this as default
                   KBFoundationModelId	meta.llama3-1-70b-instruct-v1:0	Don’t change
                   KnowledgeBaseId	XXXXXXXXXX	Information base id from Step 4
                   TargetRoleArn	arn:aws:iam::999999999999:function/bedrock_kb_access_role	Exchange with you agent-kb account quantity

                   

                5. Full the acknowledgement and select Subsequent.
                6. Scroll down by means of the web page and select Submit.
                7. You will note the CloudFormation stack is getting created as proven by the standing CREATE_IN_PROGRESS.
                8. It should take a couple of minutes, and you will note the standing change to CREATE_COMPLETE indicating creation of all sources. Select the Outputs tab to make a remark of the sources that had been created.
                   In abstract, the CloudFormation script does the next within the agent account.
                   1. 1. • Creates a Bedrock agent
                         • Creates an motion group
                         • Additionally creates a Lambda operate which is invoked by the Bedrock motion group
                         • Defines the OpenAPI schema
                         • Creates needed roles and permissions for the Bedrock agent
                         • Lastly, it prepares the Bedrock agent in order that it is able to take a look at.
   16. Test for mannequin entry in Oregon (us-west-2)
       1. 1. 1. 1. Confirm Nova Professional (us.amazon.nova-pro-v1:0) mannequin entry within the agent account. Navigate to the Amazon Bedrock console and select Mannequin entry beneath Configure and study. Seek for Mannequin identify : Nova Professional to confirm entry. If not, then allow mannequin entry.
                   
                2. Confirm entry to the meta.llama3-1-70b-instruct-v1:0 mannequin within the agent-kb account. This could already be enabled as we arrange the information base earlier.
   17. Run the agent. Go online to agent account. Navigate to Amazon Bedrock console and select Brokers beneath Construct.
   18. Select the identify of the agent and select Check. You possibly can take a look at the next questions as talked about the workshop’s Stage 4: Test Natural Language Queries web page. For instance:
       1. 1. 1. 1. Who’re the highest 5 prospects in Saudi Arabia?
                2. Who’re the highest components provider in america by quantity?
                3. What’s the complete income by area for the 12 months 1998?
                4. Which merchandise have the best revenue margins?
                5. Present me orders with the best precedence from the final quarter of 1997.

       

   19. Select Present hint to research the agent traces.

Some really useful greatest practices:

1. 1. • Phrase your query to be extra particular
      • Use terminology that matches your desk descriptions
      • Attempt questions much like your curated examples
      • Confirm your query pertains to knowledge that exists within the TPCH dataset
      • Use Amazon Bedrock Guardrails so as to add configurable safeguards to questions and responses.

Clear up sources

It’s endorsed that you simply clear up any sources you do not want anymore to keep away from any pointless expenses:

1. 1. 1. Navigate to the CloudFormation console for the agent and agent-kb account, seek for the stack and and select Delete.
      2. S3 buckets should be deleted individually.
         
      3. For deleting the roles and insurance policies created in each accounts, obtain the script delete-bedrock-agent-kb-roles-policies.sh from the aws-samples GitHub repository.
         1. Open Terminal in Mac or comparable bash shell on different platforms.
         2. Find and alter the listing to the downloaded location, present executable permissions:

         cd /my/location
         			chmod +x delete-bedrock-agent-kb-roles-policies.sh

      4. In case you are nonetheless not clear on the script utilization or inputs, then you’ll be able to run the script with the –assist possibility then the script will show the utilization:
         ./ delete-bedrock-agent-kb-roles-policies.sh –assist
      5. Run the script: delete-bedrock-agent-kb-roles-policies.sh with the identical values for a similar enter parameters as in Step7 when operating the create_bedrock_agent_kb_roles_policies.sh script. Word: Enter the proper account numbers for agent-account and agent-kb-account earlier than operating.

         ./delete-bedrock-agent-kb-roles-policies.sh --agent-profile agent  
           	--agent-kb-profile agent-kb  
         	  --lambda-role lambda_bedrock_kb_query_role  
         	  --kb-access-role bedrock_kb_access_role  
         	  --kb-access-policy bedrock_kb_access_policy  
         	  --lambda-policy lambda_bedrock_kb_query_policy  
         	  --agent-account 111122223333  
         	  --agent-kb-account 999999999999

         The script will ask for a affirmation, say sure and press enter.

         

Abstract

This answer demonstrates how the Amazon Bedrock agent within the agent account can question the Amazon Bedrock information base within the agent-kb account.

Conclusion

This answer makes use of Amazon Bedrock Information Bases for structured knowledge to create a extra built-in strategy to cross-account knowledge entry. The information base in agent-kb account connects on to Amazon Redshift Serverless in a personal VPC. The Amazon Bedrock agent within the agent account invokes an AWS Lambda operate as a part of its motion group to make a cross-account connection to retrieve response from the structured information base.

This structure provides a number of benefits:

1. 1. • Makes use of Amazon Bedrock Information Bases capabilities for structured knowledge
      • Gives a extra seamless integration between the agent and the info supply
      • Maintains correct safety boundaries between accounts
      • Reduces the complexity of direct database entry codes

As Amazon Bedrock continues to evolve, you’ll be able to reap the benefits of future enhancements to information base performance whereas sustaining your multi-account structure.

In regards to the Authors

Kunal Ghosh is an knowledgeable in AWS applied sciences. He enthusiastic about constructing environment friendly and efficient options on AWS, particularly involving generative AI, analytics, knowledge science, and machine studying. In addition to household time, he likes studying, swimming, biking, and watching films, and he’s a foodie.

Arghya Banerjee is a Sr. Options Architect at AWS within the San Francisco Bay Space, centered on serving to prospects undertake and use the AWS Cloud. He’s centered on large knowledge, knowledge lakes, streaming and batch analytics companies, and generative AI applied sciences.

Indranil Banerjee is a Sr. Options Architect at AWS within the San Francisco Bay Space, centered on serving to prospects within the hi-tech and semi-conductor sectors remedy complicated enterprise issues utilizing the AWS Cloud. His particular pursuits are within the areas of legacy modernization and migration, constructing analytics platforms and serving to prospects undertake innovative applied sciences similar to generative AI.

Vinayak Datar is Sr. Options Supervisor primarily based in Bay Space, serving to enterprise prospects speed up their AWS Cloud journey. He’s specializing in serving to prospects to transform concepts from ideas to working prototypes to manufacturing utilizing AWS generative AI companies.