Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
71 commits
Select commit Hold shift + click to select a range
37fd526
Adding support for OpenSearch Managed Clusters
SMonaghan Aug 27, 2025
ad79c9a
Fixing acceptance test
SMonaghan Aug 28, 2025
1ab2c90
Fixing documentation
SMonaghan Aug 28, 2025
5bf2306
Fixing CHANGELOG
SMonaghan Aug 28, 2025
786b4b8
Fixing formatting
SMonaghan Aug 28, 2025
dbc03cd
Fixing terrafmt issues in test
SMonaghan Aug 28, 2025
81e5629
Merge branch 'hashicorp:main' into f-knowledge-bases-managed-cluser-s…
SMonaghan Aug 28, 2025
bee6072
Fixing documentation
SMonaghan Aug 28, 2025
920f607
feat: Add Kendra support to aws_bedrockagent_knowledge_base
yourzinc Sep 20, 2025
4b277f6
docs: Add Kendra knowledge base documentation
yourzinc Sep 20, 2025
14d7f05
docs: Add Kendra knowledge base documentation
yourzinc Sep 20, 2025
8c81e05
Add changelog
yourzinc Sep 20, 2025
24a7bb7
Fix test formatting
yourzinc Sep 20, 2025
45881e2
Fix function name capitalization
yourzinc Sep 20, 2025
ed1641a
Updating tests
SMonaghan Oct 5, 2025
4dff1cd
Merge branch 'hashicorp:main' into f-knowledge-bases-managed-cluser-s…
SMonaghan Oct 5, 2025
69dc558
Merge commit '45881e275350b2defa3e0db5d38ef7ca25b5a42e' into f-aws_be…
ewbankkit Dec 5, 2025
1e7438e
Merge commit '4dff1cd314d9c068cb5ae1632403f5f1d584c220' into f-aws_be…
ewbankkit Dec 5, 2025
810d299
Tweak #44388's CHANGELOG entries.
ewbankkit Dec 5, 2025
fd7e448
r/aws_bedrockagent_knowledge_base: Document 'kendra_knowledge_base_co…
ewbankkit Dec 5, 2025
266cabe
r/aws_bedrockagent_knowledge_base: Alphabetize attributes.
ewbankkit Dec 5, 2025
81b9e2a
r/aws_bedrockagent_knowledge_base: Tidy up.
ewbankkit Dec 5, 2025
64241a6
Tweak #44060's CHANGELOG entries.
ewbankkit Dec 5, 2025
83fa8ac
Tidy up 'testAccKnowledgeBase_Kendra_basic'.
ewbankkit Dec 5, 2025
9a688c6
Acceptance test output:
ewbankkit Dec 5, 2025
9243159
'TestAccBedrockAgentKnowledgeBase_OpenSearchManagedCluster_basic' -> …
ewbankkit Dec 5, 2025
1376906
Acceptance test output:
ewbankkit Dec 5, 2025
fdee938
Fix markdown-lint 'MD012/no-multiple-blanks Multiple consecutive blan…
ewbankkit Dec 5, 2025
9243ed7
Fix terrafmt errors.
ewbankkit Dec 5, 2025
f943238
Fix providerlint 'AT004: provider declaration should be omitted'.
ewbankkit Dec 5, 2025
bffb9f8
Implement s3_vectors_configuration block
tabito-hara Dec 6, 2025
876fefc
Add an acceptance test for s3_vectors_configuration
tabito-hara Dec 6, 2025
e8df94b
Update the documentation to add description s3_vectors_configuration
tabito-hara Dec 6, 2025
64f13dd
add changelog
tabito-hara Dec 6, 2025
3fe6175
Tidy up 'testAccKnowledgeBase_OpenSearchManagedCluster_basic'.
ewbankkit Dec 8, 2025
a6cde67
Fix terrafmt errors.
ewbankkit Dec 8, 2025
983c75d
Fix terrafmt errors.
ewbankkit Dec 8, 2025
e0425f3
Revert "Update the documentation to add description s3_vectors_config…
ewbankkit Dec 8, 2025
9a2e423
Revert "Add an acceptance test for s3_vectors_configuration"
ewbankkit Dec 8, 2025
79407e6
Revert "Implement s3_vectors_configuration block"
ewbankkit Dec 8, 2025
42c640f
Merge commit '79407e6c33a3576480ba6f5e1b25664768e5a4e1' into f-aws_be…
ewbankkit Dec 8, 2025
bedb43b
Tweak CHANGELOG entry.
ewbankkit Dec 8, 2025
4691f65
r/aws_bedrockagent_knowledge_base: Additions from #45468.
ewbankkit Dec 8, 2025
7412b6f
Acceptance test output:
ewbankkit Dec 8, 2025
b428e48
Fix markdown-lint 'MD012/no-multiple-blanks Multiple consecutive blan…
ewbankkit Dec 8, 2025
41ac93e
r/aws_bedrockagent_knowledge_base: Add `storage_configuration.mongo_d…
ewbankkit Dec 8, 2025
949118c
Run 'make fix-constants PKG=bedrockagent'.
ewbankkit Dec 8, 2025
650036d
testAccKnowledgeBase_disappears: Use S3 Vectors instead of RDS.
ewbankkit Dec 8, 2025
e6ec5fb
testAccKnowledgeBase_tags: Use S3 Vectors instead of RDS.
ewbankkit Dec 8, 2025
8f28c18
Acceptance test output:
ewbankkit Dec 8, 2025
21cd201
'acctest.ConfigBedrockAgentKnowledgeBaseRDSBase' -> 'acctest.ConfigBe…
ewbankkit Dec 8, 2025
4a0246b
'testAccKnowledgeBase_RDS_basic' -> 'testAccKnowledgeBase_RDS_update'.
ewbankkit Dec 8, 2025
d354671
Acceptance test output:
ewbankkit Dec 8, 2025
a57f3b3
r/aws_bedrockagent_knowledge_base: Add `knowledge_base_configuration.…
ewbankkit Dec 9, 2025
436fd16
Acceptance test output:
ewbankkit Dec 9, 2025
8872beb
r/aws_bedrockagent_knowledge_base: Document 'sql_knowledge_base_confi…
ewbankkit Dec 10, 2025
542db60
Add 'testAccKnowledgeBase_StructuredDataStore_redshiftProvisioned'.
ewbankkit Dec 10, 2025
6f18ff5
Acceptance test output:
ewbankkit Dec 10, 2025
dcf8782
Example aws_bedrockagent_knowledge_base structured data store.
ewbankkit Dec 10, 2025
e3e31cd
Add 'testAccKnowledgeBase_StructuredDataStore_redshiftServerless'.
ewbankkit Dec 10, 2025
d5f272a
Acceptance test output:
ewbankkit Dec 10, 2025
83c1e4a
r/aws_bedrockagent_knowledge_base: Add `storage_configuration.neptune…
ewbankkit Dec 10, 2025
62a5106
Add 'testAccKnowledgeBase_NeptuneAnalytics_basic'.
ewbankkit Dec 11, 2025
36946b8
Acceptance test output:
ewbankkit Dec 11, 2025
6af99df
r/aws_bedrockagent_knowledge_base: Simplify update acceptance test.
ewbankkit Dec 11, 2025
ddc3704
Tidy up 'testAccKnowledgeBase_OpenSearchServerless_supplementalDataSt…
ewbankkit Dec 11, 2025
9f82d79
Replace 'testAccKnowledgeBase_OpenSearchServerless_supplementalDataSt…
ewbankkit Dec 11, 2025
d5a617f
r/aws_bedrockagent_agent_knowledge_base_association.test: Simplify ac…
ewbankkit Dec 11, 2025
ebeffc7
r/aws_bedrockagent_data_source: Simplify acceptance tests by using S3…
ewbankkit Dec 11, 2025
b96add5
Modernize 'testAccKnowledgeBase_OpenSearchServerless_basic'.
ewbankkit Dec 11, 2025
8bd381b
Merge branch 'main' into f-aws_bedrockagent_knowledge_base-enhancements
ewbankkit Dec 11, 2025
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/37220.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:enhancement
resource/aws_bedrockagent_knowledge_base: Add `storage_configuration.mongo_db_atlas_configuration` argument
```
3 changes: 3 additions & 0 deletions .changelog/44060.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:enhancement
resource/aws_bedrockagent_knowledge_base: Add `storage_configuration.opensearch_managed_cluster_configuration` argument
```
7 changes: 7 additions & 0 deletions .changelog/44388.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
```release-note:enhancement
resource/aws_bedrockagent_knowledge_base: Add `knowledge_base_configuration.kendra_knowledge_base_configuration` argument
```

```release-note:enhancement
resource/aws_bedrockagent_knowledge_base: Make `knowledge_base_configuration.vector_knowledge_base_configuration` and ``storage_configuration` optional
```
7 changes: 7 additions & 0 deletions .changelog/45465.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
```release-note:enhancement
resource/aws_bedrockagent_knowledge_base: Add `knowledge_base_configuration.sql_knowledge_base_configuration` and `storage_configuration.neptune_analytics_configuration` arguments
```

```release-note:bug
resource/aws_bedrockagent_knowledge_base: Mark `knowledge_base_configuration.vector_knowledge_base_configuration.embedding_model_configuration` and `knowledge_base_configuration.vector_knowledge_base_configuration.supplemental_data_storage_configuration` as `ForceNew`
```
3 changes: 3 additions & 0 deletions .changelog/45468.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:enhancement
resource/aws_bedrockagent_knowledge_base: Add `storage_configuration.s3_vectors_configuration` block
```
1 change: 1 addition & 0 deletions docs/acc-test-environment-variables.md
Original file line number Diff line number Diff line change
Expand Up @@ -110,6 +110,7 @@ Environment variables (beyond standard AWS Go SDK ones) used by acceptance testi
| `TF_AWS_CONTROLTOWER_CONTROL_OU_NAME` | Organizational unit name to be targeted by the Control Tower control. |
| `TF_AWS_CONTROLTOWER_BASELINE_ENABLE_BASELINE_ARN` | Enable baseline ARN. |
| `TF_AWS_DATAEXCHANGE_DATA_SET_ID` | ID of DataExchange Data Set to use for testing. |
| `TF_AWS_KENDRA_INDEX_ARN` | ARN of Kendra Index to use for testing. |
| `TF_AWS_LICENSE_MANAGER_GRANT_HOME_REGION` | Region where a License Manager license is imported. |
| `TF_AWS_LICENSE_MANAGER_GRANT_LICENSE_ARN` | ARN for a License Manager license imported into the current account. |
| `TF_AWS_LICENSE_MANAGER_GRANT_PRINCIPAL` | ARN of a principal to share the License Manager license with. Either a root user, Organization, or Organizational Unit. |
Expand Down
260 changes: 45 additions & 215 deletions internal/acctest/configs.go
Original file line number Diff line number Diff line change
Expand Up @@ -728,240 +728,70 @@ resource "aws_subnet" "test" {
)
}

func ConfigBedrockAgentKnowledgeBaseRDSBase(rName, model string) string {
return ConfigCompose(
ConfigVPCWithSubnetsEnableDNSHostnames(rName, 2), //nolint:mnd // 2 subnets required
fmt.Sprintf(`
data "aws_partition" "current" {}
func ConfigBedrockAgentKnowledgeBaseS3VectorsBase(rName string) string {
return fmt.Sprintf(`
data "aws_region" "current" {}
data "aws_partition" "current" {}

resource "aws_iam_role" "test" {
name = %[1]q
path = "/service-role/"
assume_role_policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "bedrock.amazonaws.com"
},
"Effect": "Allow"
}]
}
POLICY
}

# See https://docs.aws.amazon.com/bedrock/latest/userguide/kb-permissions.html.
resource "aws_iam_role_policy" "test" {
name = %[1]q
role = aws_iam_role.test.name
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"bedrock:ListFoundationModels",
"bedrock:ListCustomModels"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"bedrock:InvokeModel"
],
"Resource": [
"arn:${data.aws_partition.current.partition}:bedrock:${data.aws_region.current.region}::foundation-model/%[2]s"
]
data "aws_iam_policy_document" "assume_role_bedrock" {
statement {
effect = "Allow"
principals {
type = "Service"
identifiers = ["bedrock.amazonaws.com"]
}
]
}
POLICY
}

resource "aws_iam_role_policy_attachment" "rds_data_full_access" {
role = aws_iam_role.test.name
policy_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_partition.current.partition}:policy/AmazonRDSDataFullAccess"
}

resource "aws_iam_role_policy_attachment" "secrets_manager_read_write" {
role = aws_iam_role.test.name
policy_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_partition.current.partition}:policy/SecretsManagerReadWrite"
}

data "aws_rds_orderable_db_instance" "test" {
engine = "aurora-postgresql"
engine_latest_version = true
preferred_instance_classes = ["db.serverless"]
}

resource "aws_rds_cluster" "test" {
cluster_identifier = %[1]q
master_username = "test"
manage_master_user_password = true
database_name = "test"
skip_final_snapshot = true
engine = data.aws_rds_orderable_db_instance.test.engine
engine_version = data.aws_rds_orderable_db_instance.test.engine_version
enable_http_endpoint = true
vpc_security_group_ids = [aws_security_group.test.id]
db_subnet_group_name = aws_db_subnet_group.test.name

serverlessv2_scaling_configuration {
max_capacity = 1.0
min_capacity = 0.5
actions = ["sts:AssumeRole"]
}
}

resource "aws_rds_cluster_instance" "test" {
cluster_identifier = aws_rds_cluster.test.id
instance_class = "db.serverless"
engine = aws_rds_cluster.test.engine
engine_version = aws_rds_cluster.test.engine_version
publicly_accessible = true
}

resource "aws_db_subnet_group" "test" {
name = %[1]q
subnet_ids = aws_subnet.test[*].id
}

resource "aws_internet_gateway" "test" {
vpc_id = aws_vpc.test.id

tags = {
Name = %[1]q
data "aws_iam_policy_document" "bedrock" {
statement {
effect = "Allow"
actions = ["bedrock:InvokeModel"]
resources = ["*"]
}
}

resource "aws_default_route_table" "test" {
default_route_table_id = aws_vpc.test.default_route_table_id

route {
cidr_block = "0.0.0.0/0"
gateway_id = aws_internet_gateway.test.id
statement {
effect = "Allow"
actions = ["s3:ListBucket", "s3:GetObject"]
resources = ["*"]
}

tags = {
Name = %[1]q
statement {
effect = "Allow"
actions = [
"s3vectors:GetIndex",
"s3vectors:QueryVectors",
"s3vectors:PutVectors",
"s3vectors:GetVectors",
"s3vectors:DeleteVectors"
]
resources = ["*"]
}
}

resource "aws_security_group" "test" {
name = %[1]q
vpc_id = aws_vpc.test.id

ingress {
from_port = 5432
to_port = 5432
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}

egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}

tags = {
Name = %[1]q
}
resource "aws_iam_role" "test" {
assume_role_policy = data.aws_iam_policy_document.assume_role_bedrock.json
name = %[1]q
}

data "aws_secretsmanager_secret_version" "test" {
secret_id = aws_rds_cluster.test.master_user_secret[0].secret_arn
version_stage = "AWSCURRENT"
depends_on = [aws_rds_cluster.test]
}

resource "null_resource" "db_setup" {
depends_on = [aws_rds_cluster_instance.test, aws_rds_cluster.test, data.aws_secretsmanager_secret_version.test]

provisioner "local-exec" {
command = <<EOT
sleep 60
export PGPASSWORD=$(aws secretsmanager get-secret-value --secret-id '${aws_rds_cluster.test.master_user_secret[0].secret_arn}' --version-stage AWSCURRENT --region ${data.aws_region.current.region} --query SecretString --output text | jq -r '."password"')
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE EXTENSION IF NOT EXISTS vector;"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE SCHEMA IF NOT EXISTS bedrock_integration;"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE SCHEMA IF NOT EXISTS bedrock_new;"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE ROLE bedrock_user WITH PASSWORD '$PGPASSWORD' LOGIN;"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "GRANT ALL ON SCHEMA bedrock_integration TO bedrock_user;"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE TABLE bedrock_integration.bedrock_kb (id uuid PRIMARY KEY, embedding vector(1536), chunks text, metadata json, custom_metadata jsonb);"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE INDEX ON bedrock_integration.bedrock_kb USING hnsw (embedding vector_cosine_ops);"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE INDEX ON bedrock_integration.bedrock_kb USING gin (to_tsvector('simple', chunks));"
psql -h ${aws_rds_cluster.test.endpoint} -U ${aws_rds_cluster.test.master_username} -d ${aws_rds_cluster.test.database_name} -c "CREATE INDEX ON bedrock_integration.bedrock_kb USING gin (custom_metadata);"
EOT
}
}
`, rName, model))
resource "aws_iam_role_policy" "test" {
role = aws_iam_role.test.name
policy = data.aws_iam_policy_document.bedrock.json
}

func ConfigBedrockAgentKnowledgeBaseRDSUpdateBase(rName, model string) string {
return ConfigCompose(
ConfigBedrockAgentKnowledgeBaseRDSBase(rName, model), //nolint:mnd
fmt.Sprintf(`
resource "aws_iam_role" "test_update" {
name = "%[1]s-update"
path = "/service-role/"
assume_role_policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [{
"Action": "sts:AssumeRole",
"Principal": {
"Service": "bedrock.amazonaws.com"
},
"Effect": "Allow"
}]
}
POLICY
}

# See https://docs.aws.amazon.com/bedrock/latest/userguide/kb-permissions.html.
resource "aws_iam_role_policy" "test_update" {
name = "%[1]s-update"
role = aws_iam_role.test_update.name
policy = <<POLICY
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"bedrock:ListFoundationModels",
"bedrock:ListCustomModels"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"bedrock:InvokeModel"
],
"Resource": [
"arn:${data.aws_partition.current.partition}:bedrock:${data.aws_region.current.region}::foundation-model/%[2]s"
]
}
]
}
POLICY
resource "aws_s3vectors_vector_bucket" "test" {
vector_bucket_name = %[1]q
force_destroy = true
}

resource "aws_iam_role_policy_attachment" "rds_data_full_access_update" {
role = aws_iam_role.test_update.name
policy_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_partition.current.partition}:policy/AmazonRDSDataFullAccess"
}
resource "aws_s3vectors_index" "test" {
index_name = %[1]q
vector_bucket_name = aws_s3vectors_vector_bucket.test.vector_bucket_name

resource "aws_iam_role_policy_attachment" "secrets_manager_read_write_update" {
role = aws_iam_role.test_update.name
policy_arn = "arn:${data.aws_partition.current.partition}:iam::${data.aws_partition.current.partition}:policy/SecretsManagerReadWrite"
data_type = "float32"
dimension = 256
distance_metric = "euclidean"
}
`, rName, model))
`, rName)
}

// ConfigRandomPassword returns the configuration for an ephemeral resource that
Expand Down
Loading
Loading