> **Experimental**
>
> `@aws-cdk/aws-bedrock-alpha` is an [**experimental**](/stability) (alpha) package: its API may change in any release, without a major version bump.
# KnowledgeBaseGrants

Collection of grant methods for a IKnowledgeBaseRef.

- Stability: [Experimental](/cdk/api/stability.html)
- Source: Generated code
- Type last changed: v2.274.0-alpha.0 · 21 Oct 2026

## Example

```ts
// The code below shows an example of how to instantiate this type.
// The values are placeholders you should change.
import * as bedrock_alpha from '@aws-cdk/aws-bedrock-alpha';
import { aws_bedrock as interfaces_bedrock } from 'aws-cdk-lib/interfaces';

declare const knowledgeBaseRef: interfaces_bedrock.IKnowledgeBaseRef;
const knowledgeBaseGrants = bedrock_alpha.KnowledgeBaseGrants.fromKnowledgeBase(knowledgeBaseRef);
```

## Methods

- `actions(grantee: IGrantable, actions: string[], options?: PermissionsOptions): Grant` — Grant the given identity custom permissions.

- `fromKnowledgeBase(resource: IKnowledgeBaseRef): KnowledgeBaseGrants // chainable` (static) — Creates grants for KnowledgeBaseGrants.

- `getDocumentContent(grantee: IGrantable): Grant` — Grant permissions to retrieve the original or extracted content of documents ingested into this knowledge base.

  `bedrock:GetDocumentContent` requires `bedrock:Retrieve` on the same knowledge base, so both are granted.

  This will grant the following permissions on the knowledge base:

    - bedrock:Retrieve
    - bedrock:GetDocumentContent

- `retrieve(grantee: IGrantable): Grant` — Grant permissions to query this knowledge base and retrieve relevant chunks.

  This will grant the following permissions on the knowledge base:

    - bedrock:Retrieve

- `retrieveAndGenerate(grantee: IGrantable): Grant` — Grant permissions to query a knowledge base and generate a response with a foundation model.

  `bedrock:RetrieveAndGenerate` does not support resource-level permissions, so it is granted on all resources (`*`). Access to a specific knowledge base is controlled by `bedrock:Retrieve`, so also call `retrieve()` on this knowledge base, and grant `bedrock:InvokeModel` on the generation model with `BedrockFoundationModel.grantInvoke()`.

  This will grant the following permissions:

    - bedrock:RetrieveAndGenerate