Secure multi-tenant RAG with Amazon Bedrock and Verified Permissions
Engineers faced a challenge in controlling access to corporate documents in a shared generative AI application. To solve this, they used Amazon Bedrock's Knowledge Base, which enables retrieval, and Amazon Verified Permissions for dynamic access control. This setup allows a single RAG (Retrieval Augmented Generation) application to serve multiple departments while maintaining document isolation between groups. The solution uses a two-layer authorization pattern, with Amazon Verified Permissions managing granular, intra-tenant access control through Cedar policies, and Amazon Bedrock's metadata filtering ensuring documents are isolated at retrieval time. This setup reduces costs and operational overhead, making it ideal for organizations that need to control access to documents across departments, teams, or roles within a single organization.