AWS CDK Reference

Appearance

v2.274.0

Experimental

@aws-cdk/aws-bedrock-alpha is an experimental (alpha) package: its API may change in any release, without a major version bump.

KnowledgeBaseGrants Facade Added in v2.274.0-alpha.0 ​

Collection of grant methods for a IKnowledgeBaseRef.

Stability
Experimental
Source
Generated code
Type last changed
v2.274.0-alpha.0 · 21 Oct 2026

Example ​

ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as bedrock_alpha from '@aws-cdk/aws-bedrock-alpha';
import { aws_bedrock as interfaces_bedrock } from 'aws-cdk-lib/interfaces';

declare const knowledgeBaseRef: interfaces_bedrock.IKnowledgeBaseRef;
const knowledgeBaseGrants = bedrock_alpha.KnowledgeBaseGrants.fromKnowledgeBase(knowledgeBaseRef);

Methods ​

actions(grantee: IGrantable, actions: string[], options?: PermissionsOptions): Grantdef actions(self, grantee: IGrantable, actions: typing.List[str], options: typing.Optional[PermissionsOptions] = None) -> Grantpublic Grant actions(IGrantable grantee, List<String> actions, PermissionsOptions options)public Grant Actions(IGrantable grantee, string[] actions, PermissionsOptions? options = null)func Actions(Grantee IGrantable, Actions *[]*string, Options PermissionsOptions) Grant#
Grant the given identity custom permissions.
fromKnowledgeBase(resource: IKnowledgeBaseRef): KnowledgeBaseGrants // chainable@staticmethod def from_knowledge_base(resource: IKnowledgeBaseRef) -> KnowledgeBaseGrantspublic static KnowledgeBaseGrants fromKnowledgeBase(IKnowledgeBaseRef resource)public static KnowledgeBaseGrants FromKnowledgeBase(IKnowledgeBaseRef resource)func FromKnowledgeBase(Resource IKnowledgeBaseRef) KnowledgeBaseGrantsstatic#
Creates grants for KnowledgeBaseGrants.
getDocumentContent(grantee: IGrantable): Grantdef get_document_content(self, grantee: IGrantable) -> Grantpublic Grant getDocumentContent(IGrantable grantee)public Grant GetDocumentContent(IGrantable grantee)func GetDocumentContent(Grantee IGrantable) Grant#
Grant permissions to retrieve the original or extracted content of documents ingested into this knowledge base.

bedrock:GetDocumentContent requires bedrock:Retrieve on the same knowledge base, so both are granted.

This will grant the following permissions on the knowledge base:

  • bedrock:Retrieve
  • bedrock:GetDocumentContent
retrieve(grantee: IGrantable): Grantdef retrieve(self, grantee: IGrantable) -> Grantpublic Grant retrieve(IGrantable grantee)public Grant Retrieve(IGrantable grantee)func Retrieve(Grantee IGrantable) Grant#
Grant permissions to query this knowledge base and retrieve relevant chunks.

This will grant the following permissions on the knowledge base:

  • bedrock:Retrieve
retrieveAndGenerate(grantee: IGrantable): Grantdef retrieve_and_generate(self, grantee: IGrantable) -> Grantpublic Grant retrieveAndGenerate(IGrantable grantee)public Grant RetrieveAndGenerate(IGrantable grantee)func RetrieveAndGenerate(Grantee IGrantable) Grant#
Grant permissions to query a knowledge base and generate a response with a foundation model.
notes

bedrock:RetrieveAndGenerate does not support resource-level permissions, so it is granted on all resources (*). Access to a specific knowledge base is controlled by bedrock:Retrieve, so also call retrieve() on this knowledge base, and grant bedrock:InvokeModel on the generation model with BedrockFoundationModel.grantInvoke().

This will grant the following permissions:

  • bedrock:RetrieveAndGenerate