Set up your query engine and permissions for creating a knowledge base with structured data store

(If you authenticate with IAM and a user wasn't already created for your database) Run the following command, which uses CREATE USER to create a database user and allow it to authenticate through IAM, replacing ${service-role} with the name of the custom Amazon Bedrock Knowledge Bases service role you created:

CREATE USER "IAMR:${service-role}" WITH PASSWORD DISABLE;

Grant an identity permissions to retrieve information from your database by running the GRANT command.

For finer-grained control on the tables that can be accessed, you can replace ALL TABLES specific table names with the following notation: ${schemaName}${tableName}. For more information about this notation, see the Query objects section at Cross-database queries.

If you created a new schema in the Redshift database, run the following command to grant an identity permissions against the new schema.

GRANT USAGE ON SCHEMA ${schemaName} TO "IAMR:${serviceRole}";

Run the following command, which uses CREATE USER to create a database user and allow it to authenticate through IAM, replacing ${service-role} with the name of the custom Amazon Bedrock Knowledge Bases service role you created:

CREATE USER "IAMR:${service-role}" WITH PASSWORD DISABLE;

Grant the service role permissions to retrieve information from your database by running the following GRANT command:

GRANT USAGE ON DATABASE awsdatacatalog TO "IAMR:${serviceRole}";

To allow access to your AWS Glue Data Catalog databases, attach the following permissions to the service role:

Grant permissions to your service role through AWS Lake Formation (to learn more about Lake Formation and its relationship with Amazon Redshift, see Data sources for Redshift) by doing the following:

1. Sign in to the AWS Management Console, and open the Lake Formation console at https://console.aws.amazon.com/lakeformation/.

2. Select Data permissions from the left navigation pane.

3. Grant permissions to the service role you're using for Amazon Bedrock Knowledge Bases.

4. Grant Describe and Select permissions for your databases and tables.

Depending on the data source you use in AWS Glue Data Catalog, you might need to add permissions to access that data source (for more information, see AWS Glue dependency on other AWS services). For example, if your data source is in an Amazon S3 location, you'll need to add the following statement to the policy above.

{
    "Sid": "Statement1",
    "Effect": "Allow",
    "Action": [
        "s3:ListBucket",
        "s3:GetObject"
    ],
    "Resource": [
        "arn:aws:s3:::${BucketName}",
        "arn:aws:s3:::${BucketName}/*"
    ]
}

(Optional) If you use AWS KMS to encrypt the data in Amazon S3 or AWS Glue Data Catalog, then you need to add permissions to the role to decrypt the data on the KMS key.

{
    "Action": [
        "kms:Decrypt"
    ],
    "Resource": [
        "arn:aws:kms:${Region}:${Account}:key/{KmsId}",
        "arn:aws:kms:${Region}:${Account}:key/{KmsId}"
    ],
    "Effect": "Allow"
}