Agents for Amazon Bedrock Runtime

2026/08/14 - Agents for Amazon Bedrock Runtime - 2 new api methods

Changes  Adds CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs to Amazon Bedrock Knowledge Bases. Customers can verify user access to documents based on ingested ACLs and retrieve full ACL details including allow and deny entries, enabling validation of ACL ingestion without test retrievals.

GetIngestedDocumentAcl (new) Link ¶

Retrieves the ingested access control list (ACL) for a specific document in a knowledge base. Use this operation to inspect the allow and deny lists that were ingested for a document to troubleshoot access control issues. To use this operation, you must have the bedrock:GetIngestedDocumentAcl permission.

See also: AWS API Documentation

Request Syntax

client.get_ingested_document_acl(
    dataSourceId='string',
    documentId='string',
    knowledgeBaseId='string'
)
type dataSourceId:

string

param dataSourceId:

[REQUIRED]

The unique identifier of the data source that contains the document.

type documentId:

string

param documentId:

[REQUIRED]

The unique identifier of the document to retrieve the ingested access control list (ACL) for.

type knowledgeBaseId:

string

param knowledgeBaseId:

[REQUIRED]

The unique identifier of the knowledge base that contains the document.

rtype:

dict

returns:

Response Syntax

{
    'documentAcl': {
        'allowList': {
            'conditions': [
                {
                    'conditionOperator': 'AND'|'OR',
                    'groups': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ],
                    'users': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ]
                },
            ],
            'memberRelation': 'AND'|'OR'
        },
        'denyList': {
            'conditions': [
                {
                    'conditionOperator': 'AND'|'OR',
                    'groups': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ],
                    'users': [
                        {
                            'id': 'string',
                            'type': 'KNOWLEDGE_BASE'|'DATA_SOURCE'
                        },
                    ]
                },
            ],
            'memberRelation': 'AND'|'OR'
        }
    }
}

Response Structure

  • (dict) --

    • documentAcl (dict) --

      The ingested document access control list (ACL) containing allow and deny membership information.

      • allowList (dict) --

        The list of principals allowed access to the document.

        • conditions (list) --

          The list of conditions that determine membership.

          • (dict) --

            A condition within a document access control list (ACL) membership, specifying users and groups that are evaluated together.

            • conditionOperator (string) --

              The logical operator for combining users and groups within this condition. Valid values: AND – Both a user match and a group match are required. OR – Either a user match or a group match is sufficient.

            • groups (list) --

              The list of group entries in this condition.

              • (dict) --

                A group entry within a document access control list (ACL) condition.

                • id (string) --

                  The identifier of the group.

                • type (string) --

                  The membership type indicating the scope of the group entry.

            • users (list) --

              The list of user entries in this condition.

              • (dict) --

                A user entry within a document access control list (ACL) condition.

                • id (string) --

                  The identifier of the user.

                • type (string) --

                  The membership type indicating the scope of the user entry.

        • memberRelation (string) --

          The logical relation between conditions. Valid values: AND – All conditions must match. OR – At least one condition must match.

      • denyList (dict) --

        The list of principals denied access to the document.

        • conditions (list) --

          The list of conditions that determine membership.

          • (dict) --

            A condition within a document access control list (ACL) membership, specifying users and groups that are evaluated together.

            • conditionOperator (string) --

              The logical operator for combining users and groups within this condition. Valid values: AND – Both a user match and a group match are required. OR – Either a user match or a group match is sufficient.

            • groups (list) --

              The list of group entries in this condition.

              • (dict) --

                A group entry within a document access control list (ACL) condition.

                • id (string) --

                  The identifier of the group.

                • type (string) --

                  The membership type indicating the scope of the group entry.

            • users (list) --

              The list of user entries in this condition.

              • (dict) --

                A user entry within a document access control list (ACL) condition.

                • id (string) --

                  The identifier of the user.

                • type (string) --

                  The membership type indicating the scope of the user entry.

        • memberRelation (string) --

          The logical relation between conditions. Valid values: AND – All conditions must match. OR – At least one condition must match.

CheckIngestedDocumentAcl (new) Link ¶

Checks whether a user has access to a specific document by verifying against the ingested access control list (ACL) in a knowledge base. Use this operation to validate that document-level access control is working as expected after ingestion. To use this operation, you must have the bedrock:CheckIngestedDocumentAcl permission.

See also: AWS API Documentation

Request Syntax

client.check_ingested_document_acl(
    dataSourceId='string',
    documentId='string',
    knowledgeBaseId='string',
    userContext={
        'userId': 'string'
    }
)
type dataSourceId:

string

param dataSourceId:

[REQUIRED]

The unique identifier of the data source that contains the document.

type documentId:

string

param documentId:

[REQUIRED]

The unique identifier of the document to check access for.

type knowledgeBaseId:

string

param knowledgeBaseId:

[REQUIRED]

The unique identifier of the knowledge base that contains the document.

type userContext:

dict

param userContext:

[REQUIRED]

The context object containing identity information for access control filtering, including user ID and optional group memberships used to evaluate the document access control list (ACL).

  • userId (string) -- [REQUIRED]

    The identifier of the user making the retrieval request.

rtype:

dict

returns:

Response Syntax

{
    'hasAccess': True|False
}

Response Structure

  • (dict) --

    • hasAccess (boolean) --

      Specifies whether the user has access to the document based on the ingested access control list (ACL). Returns true if the user is allowed access, and false otherwise.