Bedrock Builder

Note: This documentation is also available in a rendered format here.

Deploys a secure Bedrock Agent with Knowledge Bases, Action Groups, Vector Stores, Lambda functions, and Guardrails for building AI-powered conversational workflows. Common scenarios include building Q&A chatbots over internal documents, automating business workflows with AI agents, or adding retrieval-augmented generation to your applications.

Deployed Resources

This module deploys and integrates the following resources:

• Bedrock Agent — Amazon Bedrock Agent(s) for automating workflows using Foundation Models. Includes Agent Alias for versioned access.
• Agent Execution Role — IAM role with Bedrock Execution Policy for accessing Knowledge Bases, Foundation Models, and Guardrails.
• Agent KMS Key — Encrypts Agent resources. Auto-generated if not provided in config.
• Lambda Functions (Optional) — Functions for Agent Action Groups and Knowledge Base custom transformations. May be VPC-bound with configurable security groups.
• Lambda Layers (Optional) — Shared code layers for Lambda functions.
• Action Group(s) — Agent Action Groups linking Lambda functions or API schemas to the Agent. Supports existing Lambda ARNs or generated-function: references.
• Knowledge Base(s) (Optional) — Bedrock Knowledge Bases with S3 and SharePoint data sources, multiple parsing strategies (default, BDA, Foundation Model, custom), and chunking configurations.
• Vector Store(s) (Optional) — OpenSearch Serverless collections or Aurora Serverless clusters for Knowledge Base vector storage.
• Bedrock Guardrail (Optional) — Content filters, contextual grounding, PII entity detection, and regex-based sensitive information filtering.

Related Modules

• Bedrock Settings — Configure Bedrock model invocation audit logging before deploying agents
• Bedrock AgentCore Runtime — Deploy custom agent runtimes as an alternative to managed Bedrock Agents
• DataOps Lambda — Deploy Lambda functions independently that can be referenced as Action Group handlers via ARN
• Roles — Create IAM roles for agent execution or Lambda function access

Security/Compliance Details

This module is designed in alignment with MDAA security/compliance principles and CDK nag rulesets. Additional review is recommended prior to production deployment, ensuring organization-specific compliance requirements are met.

• Encryption at Rest:
  • Agent resources encrypted with customer-managed KMS keys (auto-generated if not provided)
  • OpenSearch Serverless collections use encryption-at-rest security policies
  • Aurora Serverless clusters encrypted with KMS
• Encryption in Transit:
  • All Bedrock API communications use TLS
  • OpenSearch and Aurora connections encrypted in transit
• Least Privilege:
  • Agent execution role scoped to specific Knowledge Bases, Foundation Models, and Guardrails
  • Lambda execution roles scoped to required services only
  • OpenSearch Serverless uses data access policies for fine-grained control
• Network Isolation:
  • Lambda functions and Aurora clusters can be VPC-bound with configurable security groups
  • OpenSearch Serverless collections support VPC endpoints
  • No public connectivity to VPC-bound resources
• Content Safety:
  • Guardrails provide content filters and contextual grounding checks
  • PII entity detection and regex-based sensitive information filtering

AWS Service Endpoints

The following VPC endpoints may be required for VPC-bound resources (Lambda functions, Aurora Serverless, OpenSearch Serverless) if public AWS service endpoint connectivity is unavailable (e.g., private subnets without NAT gateway, firewalled environments, or PrivateLink-only architectures):

| AWS Service | Endpoint Service Name | Type | | --------------------- | ---------------------------------------- | --------- | | Bedrock Runtime | com.amazonaws.{region}.bedrock-runtime | Interface | | Bedrock Agent | com.amazonaws.{region}.bedrock-agent | Interface | | Lambda | com.amazonaws.{region}.lambda | Interface | | KMS | com.amazonaws.{region}.kms | Interface | | CloudWatch Logs | com.amazonaws.{region}.logs | Interface | | STS | com.amazonaws.{region}.sts | Interface | | S3 | com.amazonaws.{region}.s3 | Gateway | | OpenSearch Serverless | com.amazonaws.{region}.aoss | Interface | | RDS | com.amazonaws.{region}.rds | Interface |

Additional VPC endpoints may be required depending on the AWS services accessed by your custom Lambda function code.

Configuration

MDAA Config

Add the following snippet to your mdaa.yaml under the modules: section of a domain/env in order to use this module:

bedrock-builder: # Module Name can be customized
  module_path: '@aws-mdaa/bedrock-builder' # Must match module NPM package name
  module_configs:
    - ./bedrock-builder.yaml # Filename/path can be customized

Module Config Samples and Variants

Copy the contents of the relevant sample config below into the ./bedrock-builder.yaml file referenced in the MDAA config snippet above.

Minimal Configuration

Deploys a single Bedrock Agent with a foundation model. Start here for a quick proof-of-concept agent before adding knowledge bases, action groups, or guardrails.

sample-config-minimal.yaml

# Contents available via above link
--8<-- "target/docs/packages/apps/ai/bedrock-builder-app/sample_configs/sample-config-minimal.yaml"

Comprehensive Configuration

Deploys Bedrock agents with action groups, knowledge bases backed by Aurora and OpenSearch vector stores, Lambda functions, guardrails with content and sensitive information filters, and S3/SharePoint data sources with multiple parsing and chunking strategies. Use this as a reference when you need full control over agent orchestration, RAG pipelines, and content safety policies.

sample-config-comprehensive.yaml

# Contents available via above link
--8<-- "target/docs/packages/apps/ai/bedrock-builder-app/sample_configs/sample-config-comprehensive.yaml"

Config Schema Docs