AWS Details Reference Architecture for Multi-Tenant Document Chat on Amazon Bedrock Knowledge Bases

AWS has published a reference architecture for building multi-tenant agentic document chat applications on Amazon Bedrock Managed Knowledge Base, addressing a common enterprise pattern: users upload documents and immediately ask grounded questions against them, with strict isolation between tenants.

The architecture, detailed in an AWS Machine Learning blog post, targets a specific engineering problem. Building document chat with a conversational interface is straightforward, but the retrieval system behind it is not. Each tenant's documents must stay isolated from every other tenant's, and that isolation must be enforced from a verified identity rather than a value supplied by the client. Agentic retrieval — where a system decomposes a question into sub-queries and runs multiple retrieval hops — compounds this problem, since every hop must carry the tenant filter or isolation breaks.

What Amazon Bedrock Managed Knowledge Base handles

According to AWS, the managed service takes over ingestion, storage, embedding, and ranking, eliminating the need for teams to provision or monitor a vector and full-text search infrastructure. It includes built-in agentic retrieval using iterative planning and multi-hop retrievals, and it enforces access permissions on every retrieval hop. Direct ingestion through a custom connector allows documents to become retrievable within seconds, AWS states.

Architecture components

The reference solution combines several AWS services:

• Amazon Bedrock Managed Knowledge Base — crawls, parses, stores, and retrieves multimodal content including text, vectors, metadata, and structured files like CSV and Excel
• Amazon API Gateway and AWS Lambda — expose upload, status, and chat endpoints
• Amazon Cognito — authenticates users and supplies the verified identity used for per-user isolation
• Amazon SQS — decouples uploads from ingestion, absorbing bursts and routing repeated failures to a dead-letter queue
• Amazon DynamoDB — tracks per-document indexing status
• Amazon S3 — stages files exceeding the inline size limit and hosts the frontend behind CloudFront

How the workflow operates

When a user uploads a document, Amazon API Gateway validates the JSON Web Token (JWT) from Amazon Cognito, and the application derives user identity server-side rather than trusting a client-supplied value. Files up to 6 MB are sent inline in the API request; larger files, up to 50 MB for text, are staged to S3 and referenced by URI. A worker Lambda function tags each document with a user_id metadata attribute from the caller's Cognito sub value, then calls the IngestKnowledgeBaseDocuments API, which chunks, embeds, and indexes the document asynchronously. Document status moves through received, processing, and ready states, tracked in DynamoDB and polled by the frontend.

For retrieval, the application calls the AgenticRetrieveStream API with an explicit equals filter on user_id, built server-side from the verified JWT. The knowledge base returns matching passages, a foundation model generates a cited response, and the application streams it back to the user.

AWS notes that direct ingestion via the custom connector, rather than the S3 connector, is deliberate: the S3 connector is designed for scheduled bulk syncs that could overwrite or remove documents a user just added. Direct ingestion through IngestKnowledgeBaseDocuments persists documents until explicitly deleted and lets developers assign their own document IDs. The knowledge base retains a copy of each original file, retrievable via the GetDocumentContent API, removing the need for a separate document store.

AWS provides an accompanying code repository so developers can deploy the solution directly.

What this means

This is a product/architecture guide, not a new model release. The value for engineering teams is the removal of undifferentiated infrastructure work — vector indexing, multi-hop retrieval orchestration, and tenant isolation enforcement — that would otherwise need to be built and secured in-house. The critical design detail is that isolation is enforced via server-derived identity from a validated JWT on every retrieval hop, closing a common security gap in agentic RAG systems where client-supplied tenant IDs could be spoofed. Teams building multi-tenant SaaS products with document chat features on AWS now have a documented, reusable pattern rather than needing to design tenant isolation for agentic retrieval from scratch.