Connect Amazon Bedrock AgentCore to cross

Organizations often deploy agents using Amazon Bedrock AgentCore, a platform to build, connect, and optimize agents at scale, with any framework or model. These agents may access governed knowledge bases hosted in separate AWS accounts. This cross-account separation helps maintain clear workload boundaries but can introduce integration challenges.

This post explains how AgentCore agents in one account can generate answers from a knowledge base (using Amazon Bedrock Knowledge Bases, the fully managed Retrieval Augmented Generation capability) backed by Amazon Redshift Serverless in another account without copying source data.

This post covers the architecture, security boundary, request flow, and selection criteria for two generally available Amazon Bedrock AgentCore orchestration models. The linked GitHub sample provides the deployment procedures and implementation details for both variants:

Organizations that build AI agents using Amazon Bedrock can maintain structured data in Amazon Redshift Serverless. These data repositories can reside in separate AWS accounts from their AI agents. Amazon Bedrock Knowledge Bases resource policies support Retrieve and GetDocumentContent for cross-account operations. The supported resource policy actions do not include RetrieveAndGenerate. Because this solution needs the generated answer returned by RetrieveAndGenerate, the tool assumes a narrowly scoped AWS Identity and Access Management (IAM) role in the Knowledge Base account before calling the API.

This creates a challenge for enterprises with multi-account architectures who want to:

The solution implements the cross-account query pattern in two ways. Variant 1 deploys a Strands agent to AgentCore runtime. Variant 2 uses a declarative AgentCore harness. Both implementations use the same data access boundary. The model-controlled tool assumes the Knowledge Base access role with AWS Security Token Service (AWS STS), calls RetrieveAndGenerate, and returns the generated answer and citations to the orchestration layer. The variants differ in who owns the agent loop and how the tool is hosted. Figure 1 compares the two orchestration paths and their shared cross-account data access boundary.

Figure 1: Side-by-side AgentCore implementation paths

The request follows this sequence:

Figure 2 shows the request path for the code-based Strands agent.

Figure 2: Code-based Strands agent architecture

Figure 3 shows the corresponding managed path for the declarative AgentCore harness.

Figure 3: Declarative AgentCore harness architecture

Choose the simplest sufficient pattern

Before selecting an agent implementation, decide whether the workload needs an agent at all. This keeps the design proportional to the required behavior.

The cross-account requirement does not favor one variant. Choose according to how much of the orchestration loop your team needs to customize and operate.

The decision is custom control versus managed orchestration.

Before you begin, confirm that you have the following prerequisites:

The examples use the following local profile aliases and placeholder account IDs:

The examples use the US West (Oregon) Region (us-west-2). Profile names are local aliases, so replace them with your configured profile names and discover account IDs instead of hardcoding them.

This post focuses on architecture and decision guidance. Deployment procedures are maintained in the public GitHub sample. Use the Implementation walkthrough to prepare the structured Knowledge Base, cross-account IAM roles, and AgentCore memory, a capability of Amazon Bedrock AgentCore. Then follow Running the agent for the code-based Strands variant or Variant 2 – Declarative harness for the managed agent loop. The sample also includes the Streamlit end-to-end client for the Local, AgentCore, and Harness UI modes.

Use the same question, Knowledge Base ID, model, retrieval count, and fresh session when comparing variants. The prompt contract tells both agents to pass the user’s question to the tool exactly as written, but RetrieveAndGenerate remains generative. For row-level questions, specify a row count, date range, and sort order. Unbounded generated SQL can exceed result-handling limits. Validate business facts against the direct tool response and the underlying structured data.

In the Streamlit client, select the invocation mode before comparing results. For AgentCore or Harness mode, confirm that the corresponding deployed resource Amazon Resource Name (ARN) is populated. Start a new conversation for each independent factual comparison.

Figure 4: Select Local, AgentCore, or Harness in the Streamlit sidebar

Figure 5 shows a successful bounded query in Harness mode.

Figure 5: Harness mode with the deployed ARN and a successful bounded query

Sample questions for the TPC-H dataset include:

Apply these practices when deploying and validating either variant:

Follow the sample’s cleanup section for the current commands and required order. When both variants are deployed, complete harness cleanup first so that its AWS Lambda execution-role trust grant is removed from the shared Knowledge Base access role. Then remove the code-based runtime and shared IAM resources. The scripts do not delete the project-managed AgentCore memory, Knowledge Base, or Redshift Serverless resources. Delete those separately when they are no longer needed.

This post describes how AgentCore agents can return generated answers from a structured Amazon Bedrock knowledge base across AWS account boundaries. Both implementations use a least-privilege role in the data account. The architectural choice is who owns the agent loop and how the tool is hosted. Start with native Retrieve or a direct RetrieveAndGenerate call when those patterns satisfy the workload. When model-controlled tools or conversational orchestration are required, choose the code-based Strands variant for custom loop behavior and direct control. Choose the AgentCore harness when its managed loop fits and your team prefers a configuration-first operating model. Both are valid, generally available paths. Here is the Amazon Bedrock AgentCore Documentation where you can get started with Amazon Bedrock AgentCore with code samples.