AWS Adds a Coding-Agent Skill for Migrating Bedrock Managed Knowledge Bases

Summary:AWS has added a knowledge-base migration guide to the `amazon-bedrock` skill in Agent Toolkit for AWS. Coding agents can inspect an existing customer-managed Bedrock knowledge base through read-only calls, map its configuration, and produce either a live provisioning plan or a migrated CloudFormation, CDK, or Terraform template. Resource creation remains behind explicit approval, while ingestion, retrieval validation, and traffic cutover stay with the application team. The guide also documents

---

What AWS Added

AWS has added a knowledge-base migration guide to the amazon-bedrock skill in Agent Toolkit for AWS. A coding agent can inspect an existing customer-managed Bedrock knowledge base through read-only APIs, map its configuration, and produce either a live provisioning plan or a migrated CloudFormation, CDK, or Terraform template.

The workflow is intentionally staged. Resource creation is optional and requires explicit approval. Ingestion, retrieval validation, and application cutover remain the team's responsibility. This avoids treating a migration as a simple knowledge-base ID substitution, since managed retrieval can differ in search behavior, chunking, filtering, permissions, and scoring.

What Changes with Managed Knowledge Bases

In a customer-managed knowledge base, teams operate the vector store, indexing configuration, embedding model, chunking behavior, and capacity. A Managed Knowledge Base moves ingestion, storage, indexing, and retrieval into the AWS-managed layer while preserving customer control over content and the consuming application.

The managed service adds:

• always-on hybrid search combining keyword and semantic matching;
• a managed embedding model, reranker, and multimodal parser;
• native connectors for Amazon S3, Microsoft SharePoint, and Atlassian Confluence;
• ACL-aware retrieval and source-side permission checks;
• agentic retrieval for multi-part questions and multiple knowledge bases;
• AgentCore Gateway exposure for MCP-compatible clients;
• resource-based policies for cross-account access.

The trade-off is reduced infrastructure control. Teams give up some direct control over the index, embeddings, parsing, and retrieval stack in exchange for lower operational burden and higher default quotas.

How the Coding-Agent Workflow Works

The skill supports three paths:

1. Explore reads documentation and optionally inspects a knowledge base with read-only calls. It creates no resources.
2. Live knowledge base reads the existing configuration, produces a plan, and optionally creates a parallel managed knowledge base after the user approves the exact provisioning script.
3. Infrastructure as Code reads CloudFormation, CDK-synthesized templates, or Terraform configuration and writes a migrated file in the same format. It deploys nothing.

Configuration mappings are classified as 1:1, Adjusted, or Blocked. A blocked setting has no managed equivalent, so the agent excludes that knowledge base from the build and explains why instead of generating an invalid migration.

Live provisioning requires a SHA-256 digest of the approved plan. If the plan changes after preview, the digest no longer matches and the execution command refuses to proceed. This is a useful guard against plan drift, although it does not replace code and IAM-policy review.

Retrieval Semantics and Compatibility Risks

Both knowledge-base types use the Retrieve operation, but their request shapes differ. Customer-managed calls use vectorSearchConfiguration; managed calls require managedSearchConfiguration. Passing the former to a managed knowledge base produces a validation error.

Managed retrieval always uses hybrid search, so overrideSearchType is unavailable. Metadata filters also lose support for startsWith and stringContains. Any application logic that depends on those operators must be rewritten.

Chunking cannot be validated from configuration names alone. A managed parser and default chunking strategy can change context boundaries even when the source mapping appears equivalent. The migration guide therefore requires comparisons using the team's own documents.

Similarity scores from the two systems are not directly comparable. Managed scores also depend on rerankingModelType, including whether the managed reranker is enabled. Quality validation should focus on Top-1 agreement, result overlap, zero-result rates, permission behavior, context relevance, and answer coverage rather than applying one shared score threshold.

Security Boundaries for Agentic Migration

Discovery, planning, and the IaC path require read-only credentials. The live-build path should use a separate scoped profile whose policy explicitly denies changes to the original knowledge base. The workflow also avoids requesting administrator or full-access permissions.

The skill instructs agents to treat retrieved content as untrusted data, ignore instructions embedded in that content, modify only resources they created, and reference secrets through ARNs. After execution, operators should inspect CloudTrail events, the generated IAM policy, the provisioning script, and resource diffs.

These controls reduce the risk of accidental production deletion, but they do not eliminate it. Least-privilege IAM, independent approval, and change management remain required. CloudTrail management-event retention of 90 days also should not be confused with a complete audit trail for data-plane operations.

Cost, Quotas, and Trade-offs

Managed Knowledge Base is metered on stored content and retrieval requests. The cited standard retrieval price is $1 per 1,000 requests. Agentic Retrieval adds $4 per 1,000 queries for multi-shot retrieval, reranking, and answer generation.

This pricing can be attractive for enterprise question-answering, policy, and support workloads with variable utilization. It can be less attractive for teams that need custom vector stores, parsing, indexing, or retrieval pipelines and already have efficient infrastructure. AWS's optional cost analysis uses CloudWatch metrics, S3 object sizes, and Cost Explorer, but the estimate should still be checked against replayed production traffic.

The managed default quotas are substantially higher: 10,000 knowledge bases per account and Region, 200 data sources per knowledge base, 50 concurrent ingestion jobs, and a 10,000-character query input limit. These quotas enable finer organizational isolation but increase the need for lifecycle and governance policies.

Deployment Guidance

Start with Explore mode and inventory the existing parser, chunking, embedding, metadata-filter, and ACL settings. Build a representative evaluation set from production documents and run both systems side by side.

For Terraform, run terraform init -backend=false and terraform validate, then inspect whether the diff preserves rollback resources. For a live build, stop at the plan, review the script, IAM policy, service role, and plan digest, and authorize creation separately.

Before cutover, retain access to the original knowledge base and test authorized users, unauthorized users, empty-filter cases, and multi-part questions. A possible acceptance criterion is Top-1 agreement on at least 90% of queries with an acceptable managed zero-result rate, but both thresholds must be calibrated to the actual workload.

Applicability

The skill is most useful for teams already running Amazon Bedrock who accept managed retrieval semantics and want to reduce migration and infrastructure toil. It is not a cross-cloud migration product, and it does not automatically resolve data cleansing, user-identity integration, or answer quality. For highly customized retrieval systems, parallel validation and gradual retirement of the legacy stack remain safer than immediate replacement.

---

Source: AWS Machine Learning Blog (2026-11-12)

— END —

Tags: #AWS Follow #Amazon Bedrock Follow #coding agents Follow #RAG migration Follow #managed knowledge base Follow