c3.2 Use a least-privilege service role for the knowledge base

Why the knowledge base needs a scoped role

A Bedrock knowledge base assumes an IAM service role to do its job: call the embeddings model, read source documents from S3, and read/write the vector store (e.g. OpenSearch Serverless). That role touches your source data and your retrieval index, so it should be dedicated to this one knowledge base and scoped to exactly the model, buckets, and collection it uses — not a broad role shared across knowledge bases.

Trust only Bedrock, guarded against confused deputy

The trust policy lets the Bedrock service principal assume the role, constrained to your account and (ideally) the specific knowledge base ARN:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "bedrock.amazonaws.com" },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": { "aws:SourceAccount": "111122223333" },
        "ArnLike": {
          "aws:SourceArn": "arn:aws:bedrock:us-east-1:111122223333:knowledge-base/*"
        }
      }
    }
  ]
}

Grant only the three things the KB touches

Embeddings model, S3 sources, and the vector store — each scoped to specific resources:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "InvokeEmbeddingsModel",
      "Effect": "Allow",
      "Action": "bedrock:InvokeModel",
      "Resource": "arn:aws:bedrock:us-east-1::foundation-model/amazon.titan-embed-text-v2:0"
    },
    {
      "Sid": "ReadSourceDocuments",
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:ListBucket"],
      "Resource": [
        "arn:aws:s3:::my-kb-sources",
        "arn:aws:s3:::my-kb-sources/*"
      ]
    },
    {
      "Sid": "AccessVectorStore",
      "Effect": "Allow",
      "Action": "aoss:APIAccessAll",
      "Resource": "arn:aws:aoss:us-east-1:111122223333:collection/<collection-id>"
    }
  ]
}

Match the vector store's own policies

For OpenSearch Serverless, IAM is only half of it — the collection also has a data access policy that must grant this same role read/write on the index. Scope the embeddings statement to the single embeddings model ARN, and the S3 statement to only the source bucket(s) this knowledge base ingests, so the role cannot read unrelated data.

Naming note: replace the account id, Region, bucket, collection id, and embeddings model ARN. Use one role per knowledge base rather than a shared role.