Building RAG for production has always punished teams that underestimate the ops surface area. There’s a vector store to provision, a connector to write for every enterprise data source, hybrid search to configure, a re-ranker to bolt on, ACLs to enforce at query time, and a CloudWatch dashboard to build from scratch. AWS just absorbed all of that into a single managed service inside AgentCore. If you’re on the AgentCore stack, you can now connect S3, Confluence, SharePoint, Google Drive, OneDrive, or a web crawler to a fully managed retrieval pipeline in three API calls — and never touch a vector database directly again.
What “Managed” Actually Absorbs
Amazon Bedrock Managed Knowledge Base reached general availability in June 2026. It’s not a vector database with a friendlier API. AWS is absorbing the entire RAG pipeline: auto-provisioned vector storage that scales without intervention, Smart Parsing that selects the right ingestion strategy per content type automatically, hybrid search that’s always on with no tuning, document re-ranking built in, and access controls enforced at query time directly against authoritative sources — not a stale cached copy.
The six native connectors cover the data sources that show up in every enterprise RAG project: Amazon S3, SharePoint, Confluence, Google Drive, OneDrive, and a web crawler. Each handles data ingestion with automatic syncing. Add a data source, start an ingestion job, and subsequent syncs only process new or modified documents. The service handles text, PDFs up to 500MB, audio up to 2GB, and video up to 10GB.
Each of those capabilities was previously a separate decision, a separate cost center, and a separate failure mode. The consolidation is the feature.
Agentic Retrieval: Multi-Hop Without the Code
Standard RAG is one-shot: query in, chunks out. That fails on complex questions like “Compare our Q2 pricing to the latest competitive analysis” — because it requires pulling from multiple sources and reasoning across them. AgentCore’s Agentic Retrieval handles this with a four-stage loop that runs up to five iterations: it decomposes the query into sub-queries, executes them in parallel across knowledge bases, evaluates whether the retrieved content is sufficient, and returns deduplicated chunks with streaming trace events showing each planning step.
The trace events are worth noting. When an agent returns a wrong answer, the traces show exactly where the multi-hop retrieval went sideways. That’s debugging infrastructure most teams build themselves — or don’t build at all, and then wonder why their agent occasionally hallucinates.
Here’s the three-call setup to get a knowledge base running:
import boto3
bedrock_agent = boto3.client('bedrock-agent', region_name='us-west-2')
# Create the knowledge base
kb_response = bedrock_agent.create_knowledge_base(
name='my-managed-kb',
roleArn='arn:aws:iam::123456789012:role/BedrockKBRole',
knowledgeBaseConfiguration={
'type': 'MANAGED',
'managedKnowledgeBaseConfiguration': {'embeddingModelType': 'MANAGED'}
}
)
# Add an S3 data source
bedrock_agent.create_data_source(
knowledgeBaseId=kb_id,
name='my-s3-docs',
dataSourceConfiguration={
'type': 'S3',
's3Configuration': {
'bucketArn': 'arn:aws:s3:::bucket-name',
'inclusionPrefixes': ['documents/']
}
}
)
# Start ingestion
bedrock_agent.start_ingestion_job(
knowledgeBaseId=kb_id,
dataSourceId=data_source_id
)And for multi-hop agentic retrieval using AgentCore’s Agentic Retriever:
bedrock_runtime = boto3.client('bedrock-agent-runtime', region_name='us-west-2')
response = bedrock_runtime.agentic_retrieve_stream(
messages=[{
'role': 'user',
'content': [{'text': 'Compare Product A and Product B pricing'}]
}],
retrievers=[{
'knowledgeBaseRetriever': {
'knowledgeBaseId': kb_id,
'maxResults': 10
}
}],
agenticRetrieveConfiguration={
'foundationModel': {
'modelArn': 'arn:aws:bedrock:us-west-2::foundation-model/anthropic.claude-sonnet-4-20250514'
},
'maxAgentIteration': 5
}
)The MCP Angle Matters More Than You Think
The knowledge base registers as a native target type on AgentCore Gateway and becomes an MCP tool. Agents built with LangGraph, CrewAI, LlamaIndex, or LangChain that connect through the Gateway auto-discover it without custom integration code or hardcoded knowledge base IDs. Permissions are auto-generated.
This is the architectural bet AWS is making: retrieval should be a first-class agentic tool, not an application layer you write and maintain. If you accept that framing — and the MCP-native discovery is the mechanism that makes it real — then a managed RAG service inside AgentCore is the right abstraction level for most production deployments.
New in July 2026: ActiveSessionCount
AgentCore runtime and built-in tools now publish ActiveSessionCount to the AWS/Bedrock-AgentCore CloudWatch namespace, once per minute. Filter by AgentCore.Runtime, AgentCore.CodeInterpreter, or AgentCore.Browser to scope by workload type. Set alarms for unexpected spikes, track session quota consumption, and understand actual capacity utilization. Previously, teams had to instrument this themselves or fly blind on concurrent session counts.
DIY RAG vs. Managed: The Decision
| Capability | DIY RAG | AgentCore Managed KB |
|---|---|---|
| Vector store | Manual (Pinecone, OpenSearch) | Managed, auto-scaled |
| Connectors | Build yourself | 6 native connectors |
| Hybrid search | Manual configuration | Always on, no tuning |
| Re-ranking | Separate service | Built-in |
| ACL enforcement | Custom logic | Native, query-time |
| Observability | Build yourself | CloudWatch auto-published |
| AgentCore/MCP | Custom integration | Auto-discovery |
New projects on AgentCore should default to Managed Knowledge Base. The ops overhead of owning a RAG stack is real, and the table above understates it — each “build yourself” line represents days of engineering time and ongoing maintenance.
Teams with existing production RAG pipelines on Pinecone, OpenSearch, or similar: AWS says migration requires only pointing to new knowledge base IDs. That’s credible for simple pipelines. For complex custom connectors or specialized chunking strategies, plan migration on the next major version cycle rather than urgently. The lock-in concern is real, but so is the relief from the ops surface area.
The full details are in the AgentCore release notes. The enterprise search for agents post on the AWS Machine Learning Blog walks through a complete setup end-to-end.
