2026/08/14 - Agents for Amazon Bedrock Runtime - 2 new api methods
Changes Adds CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs to Amazon Bedrock Knowledge Bases. Customers can verify user access to documents based on ingested ACLs and retrieve full ACL details including allow and deny entries, enabling validation of ACL ingestion without test retrievals.
Retrieves the ingested access control list (ACL) for a specific document in a knowledge base. Use this operation to inspect the allow and deny lists that were ingested for a document to troubleshoot access control issues. To use this operation, you must have the bedrock:GetIngestedDocumentAcl permission.
See also: AWS API Documentation
Request Syntax
client.get_ingested_document_acl(
dataSourceId='string',
documentId='string',
knowledgeBaseId='string'
)
string
[REQUIRED]
The unique identifier of the data source that contains the document.
string
[REQUIRED]
The unique identifier of the document to retrieve the ingested access control list (ACL) for.
string
[REQUIRED]
The unique identifier of the knowledge base that contains the document.
dict
Response Syntax
{
'documentAcl': {
'allowList': {
'conditions': [
{
'conditionOperator': 'AND'|'OR',
'groups': [
{
'id': 'string',
'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
},
],
'users': [
{
'id': 'string',
'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
},
]
},
],
'memberRelation': 'AND'|'OR'
},
'denyList': {
'conditions': [
{
'conditionOperator': 'AND'|'OR',
'groups': [
{
'id': 'string',
'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
},
],
'users': [
{
'id': 'string',
'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
},
]
},
],
'memberRelation': 'AND'|'OR'
}
}
}
Response Structure
(dict) --
documentAcl (dict) --
The ingested document access control list (ACL) containing allow and deny membership information.
allowList (dict) --
The list of principals allowed access to the document.
conditions (list) --
The list of conditions that determine membership.
(dict) --
A condition within a document access control list (ACL) membership, specifying users and groups that are evaluated together.
conditionOperator (string) --
The logical operator for combining users and groups within this condition. Valid values: AND – Both a user match and a group match are required. OR – Either a user match or a group match is sufficient.
groups (list) --
The list of group entries in this condition.
(dict) --
A group entry within a document access control list (ACL) condition.
id (string) --
The identifier of the group.
type (string) --
The membership type indicating the scope of the group entry.
users (list) --
The list of user entries in this condition.
(dict) --
A user entry within a document access control list (ACL) condition.
id (string) --
The identifier of the user.
type (string) --
The membership type indicating the scope of the user entry.
memberRelation (string) --
The logical relation between conditions. Valid values: AND – All conditions must match. OR – At least one condition must match.
denyList (dict) --
The list of principals denied access to the document.
conditions (list) --
The list of conditions that determine membership.
(dict) --
A condition within a document access control list (ACL) membership, specifying users and groups that are evaluated together.
conditionOperator (string) --
The logical operator for combining users and groups within this condition. Valid values: AND – Both a user match and a group match are required. OR – Either a user match or a group match is sufficient.
groups (list) --
The list of group entries in this condition.
(dict) --
A group entry within a document access control list (ACL) condition.
id (string) --
The identifier of the group.
type (string) --
The membership type indicating the scope of the group entry.
users (list) --
The list of user entries in this condition.
(dict) --
A user entry within a document access control list (ACL) condition.
id (string) --
The identifier of the user.
type (string) --
The membership type indicating the scope of the user entry.
memberRelation (string) --
The logical relation between conditions. Valid values: AND – All conditions must match. OR – At least one condition must match.
Checks whether a user has access to a specific document by verifying against the ingested access control list (ACL) in a knowledge base. Use this operation to validate that document-level access control is working as expected after ingestion. To use this operation, you must have the bedrock:CheckIngestedDocumentAcl permission.
See also: AWS API Documentation
Request Syntax
client.check_ingested_document_acl(
dataSourceId='string',
documentId='string',
knowledgeBaseId='string',
userContext={
'userId': 'string'
}
)
string
[REQUIRED]
The unique identifier of the data source that contains the document.
string
[REQUIRED]
The unique identifier of the document to check access for.
string
[REQUIRED]
The unique identifier of the knowledge base that contains the document.
dict
[REQUIRED]
The context object containing identity information for access control filtering, including user ID and optional group memberships used to evaluate the document access control list (ACL).
userId (string) -- [REQUIRED]
The identifier of the user making the retrieval request.
dict
Response Syntax
{
'hasAccess': True|False
}
Response Structure
(dict) --
hasAccess (boolean) --
Specifies whether the user has access to the document based on the ingested access control list (ACL). Returns true if the user is allowed access, and false otherwise.