Amazon Bedrock Managed Knowledge Base simplifies the development of multi-tenant agentic chat applications by handling infrastructure and retrieval logic. The service supports document uploads and enables users to ask grounded questions against their own data without building custom retrieval systems. This reduces the operational burden for developers, allowing them to focus on application-specific features such as authentication and user experience. The solution ensures that each user's data remains isolated from others, maintaining security and compliance across multiple tenants. Amazon Bedrock also provides built-in agentic retrieval capabilities that support complex queries through iterative planning and multi-hop retrieval. The system ensures that access permissions are respected at every retrieval step, maintaining data integrity and confidentiality. Users can upload documents directly through a custom connector, and the service processes and indexes them asynchronously. This enables real-time access to information without requiring manual intervention or additional infrastructure management. The architecture includes components such as Amazon Cognito for authentication, Amazon API Gateway for endpoint management, and Amazon SQS for decoupling uploads from ingestion processes. The solution also tracks document indexing status using Amazon DynamoDB, allowing users to monitor progress without refreshing the page. The system supports files up to 6 MB inline and larger files staged in Amazon S3, with direct access to the original documents through the GetDocumentContent API. The solution provides a repository for deployment, enabling developers to implement the architecture in their own accounts. The workflow includes steps such as user authentication, document ingestion, asynchronous indexing, and question retrieval, all managed through the Bedrock service. The architecture ensures that user data remains isolated and that the retrieval process is both efficient and secure. The service eliminates the need for teams to build and maintain their own retrieval infrastructure, streamlining the development of multi-tenant agentic chat applications. The solution is designed to handle large-scale deployments while maintaining performance and security standards. The integration of multiple AWS services ensures that the system operates efficiently, with minimal overhead for developers. The architecture supports asynchronous indexing and real-time updates, enhancing the user experience without compromising data integrity.

The solution is intended for enterprises looking to deploy secure, scalable document chat applications that respect data isolation and access controls. The system's ability to handle complex queries through multi-hop retrieval ensures that users receive accurate and contextually relevant responses. The use of verified identities from Amazon Cognito ensures that data isolation is enforced at the source, preventing unauthorized access to user documents. The service's design allows developers to focus on application-specific logic while leveraging the managed capabilities of Amazon Bedrock. The architecture supports both text and multimodal content, including structured formats like CSV and Excel files, ensuring versatility in document handling. The system's ability to process and index large files efficiently supports enterprise-level data management requirements. The solution provides a scalable and secure framework for building document chat applications that meet the needs of multi-tenant environments. The integration of AWS services ensures that the system operates efficiently, with minimal overhead for developers. The architecture supports asynchronous indexing and real-time updates, enhancing the user experience without compromising data integrity. The solution is intended for enterprises looking to deploy secure, scalable document chat applications that respect data isolation and access controls. The system's ability to handle complex queries through multi-hop retrieval ensures that users receive accurate and contextually relevant responses. The use of verified identities from Amazon Cognito ensures that data isolation is enforced at the source, preventing unauthorized access to user documents. The service's design allows developers to focus on application-specific logic while leveraging the managed capabilities of Amazon Bedrock. The architecture supports both text and multimodal content, including structured formats like CSV and Excel files, ensuring versatility in document handling. The system's ability to process and index large files efficiently supports enterprise-level data management requirements. The solution provides a scalable and secure framework for building document chat applications that meet the needs of multi-tenant environments. The integration of AWS services ensures that the system operates efficiently, with minimal overhead for developers.

The architecture supports asynchronous indexing and real-time updates, enhancing the user experience without compromising data integrity. The solution is intended for enterprises looking to deploy secure, scalable document chat applications that respect data isolation and access controls. The system's ability to handle complex queries through multi, the application calls the agentic retrieval API on Amazon Bedrock Knowledge Bases. The API runs an agentic workflow that decides how to respond to the question. For a simple lookup, it issues a single retrieval. For a complex or multi-part question, it decomposes the question into sub-queries and runs several retrievals before producing a response (multi-hop retrieval). In both cases the response is grounded in the retrieved passages and includes citations. What makes this architecture straightforward to operate is that the knowledge base owns the components that do the retrieval and generation: the planning step that decides what to look up, the vector index, the ranker, and the model that produces the final response. Your application is responsible only for the parts that are specific to your product, such as the upload experience, the chat UI, authentication, per-user isolation, and any custom business logic. The solution consists of the following key components: Amazon Bedrock Managed Knowledge Base: Crawls, parses, stores, and retrieves multimodal content. It provisions and manages retrieval infrastructure for text, vectors, metadata, and structured content such as CSV and Excel files, including managed parsing, embedding, and indexing. A custom connector data source ingests user uploads directly. Amazon API Gateway and AWS Lambda: Expose the upload, status, and chat endpoints and run the application logic. Amazon Cognito: Authenticates users and provides the verified identity that the application uses to isolate each user’s documents. Amazon Simple Queue Service (Amazon SQS): Decouples uploads from ingestion, absorbs upload bursts, and routes messages that repeatedly fail to a dead-letter queue. This keeps the upload endpoint responsive regardless of ingestion backpressure. Amazon DynamoDB: Tracks the indexing status of each document so the application can show users when a document is ready.

Amazon Simple Storage Service (Amazon S3): Stages files that are larger than the inline limit and hosts the single-page application behind Amazon CloudFront. The following diagram illustrates the architecture of the solution. Figure 1: Architecture of the multi-tenant document chat solution The workflow consists of the following steps, numbered to match the diagram: A user signs in through Amazon Cognito and uploads a document to the application. Every request carries the user’s JSON Web Token (JWT), which Amazon API Gateway validates. The application derives the user’s identity on the server rather than trusting a value sent by the client. The application extracts the user’s identity from the validated JWT and includes it in the SQS message along with the document (or its S3 reference). It immediately returns a response to the user, so the browser is not blocked while ingestion runs in the background. Files up to 6 MB are sent inline in the API request. Larger files are first uploaded to Amazon S3, and the SQS message carries the S3 URI so Amazon Bedrock can read the file directly from S3. A worker Lambda function reads the message from the queue and tags the document with a user_id metadata attribute set to the caller’s Amazon Cognito sub. The authenticated upload handler placed that value on the message. The worker then calls the IngestKnowledgeBaseDocuments API, and Amazon Bedrock chunks, embeds, and indexes the document asynchronously. The knowledge base keeps a copy of each original file that you can retrieve with the GetDocumentContent API. As a result, you don’t operate a separate document store, and users can open the source behind a response. The application chooses one of two ingestion paths based on file size. Files up to the 6 MB inline limit are sent as bytes in the API call itself, which covers most text documents, contracts, and reports. Larger files, up to 50 MB for text, are staged to Amazon S3 and ingested by reference through their S3