c3.6 Keep the vector store on private connectivity

The vector store holds your data — keep it private

Retrieval reads from the vector store (commonly Amazon OpenSearch Serverless). That store contains the embeddings — and often the text chunks — of your source documents. If its endpoint is reachable from the public internet, the retrieval layer becomes an exposed copy of your knowledge base. OpenSearch Serverless controls this with network policies: rules that declare whether a collection's data-plane endpoint is public or private.

Make the collection private and bind it to your VPCEs

A network policy with AccessType: private restricts the collection to specified OpenSearch Serverless–managed VPC endpoints (and to AWS services granted private access):

[
  {
    "Description": "Private access to the RAG collection",
    "Rules": [
      {
        "ResourceType": "collection",
        "Resource": ["collection/my-rag-collection"]
      }
    ],
    "AllowFromPublic": false,
    "SourceVPCEs": ["vpce-0abc123456789def0"]
  }
]

With AllowFromPublic: false, only traffic arriving through the listed VPC endpoint(s) reaches the collection's data plane.

Let Bedrock reach it privately

A Bedrock knowledge base needs to query the collection. OpenSearch Serverless supports AWS service private access, so you can authorize the Bedrock service to reach a private collection without exposing it publicly — configured on the network policy alongside your VPCEs. This keeps the whole retrieval path (Bedrock → collection) off the public internet.

Layer the other policy types

Network policy is one of three OpenSearch Serverless policy types — pair it with:

• an encryption policy using your CMK (see the KB encryption control), and
• a data access policy granting only the knowledge base service role read/write on the index (see the KB service-role control).

Network keeps it private; encryption protects it at rest; data access decides who can read/write.

Naming note: replace the collection name and VPC endpoint id. Create the VPC endpoint in the subnets your workloads use, and verify AllowFromPublic is false for any collection holding sensitive embeddings.