> ## Documentation Index
> Fetch the complete documentation index at: https://docs.jinba.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS Bedrock Knowledge Base

> RAG and document sync with AWS Bedrock Knowledge Bases

## Overview

The AWS Bedrock Knowledge Base tools let you query an existing AWS Bedrock Knowledge Base — either retrieving raw documents or generating a RAG answer — and sync new PDF documents into its S3 data source.

## Key Features

* `AWS_BEDROCK_KNOWLEDGE_BASE`
  * Query an AWS Bedrock Knowledge Base with a natural language `query`.
  * Two modes (set via the `mode` config): `retrieve` returns raw retrieval results (content, source location, score, metadata), while `retrieveAndGenerate` (default) returns an LLM-generated response with source citations.
  * `numberOfResults` controls how many documents are retrieved (1–100, default 5).
  * In `retrieve` mode, the output also reports `guardrailAction` (`INTERVENED` or `NONE`) when guardrails are configured.

* `AWS_BEDROCK_KNOWLEDGE_BASE_PDF_SYNC`
  * Upload a PDF to the S3 data source of an existing Bedrock Knowledge Base and start an ingestion job.
  * `pdf` input accepts a base64 string, a data URL (`data:application/pdf;base64,...`), or a public HTTPS URL.
  * Deduplicates by content: the object key is derived from the SHA-256 hash of the PDF, and if the same content already exists in S3, the upload and ingestion are skipped (`skipped: true`).
  * Optionally waits for the ingestion job to finish (`waitForIngestion`, default `true`) with a configurable timeout (`ingestionTimeoutSeconds`, 30–1800, default 300) and polling interval (`ingestionPollIntervalSeconds`, 1–60, default 5).
  * Output includes the S3 `bucket` and `objectKey`, the `contentHash`, and the `ingestionJobId` / `ingestionStatus`.

## Authentication

Both tools authenticate with AWS access keys, configured per step:

* **accessKeyId**: An `AWS_ACCESS_KEY_ID` value, or the name of the Flow secret that contains it.
* **secretAccessKey**: An `AWS_SECRET_ACCESS_KEY` value, or the name of the Flow secret that contains it.

Each builder should register their own AWS credential secrets. In addition to credentials, the config requires:

* **region**: AWS region of the Bedrock Knowledge Base.
* **knowledgeBaseId**: The Bedrock Knowledge Base ID.
* **dataSourceId** (PDF sync only): The target S3 data source ID of the knowledge base.
* **s3KeyPrefix** (PDF sync only, optional): Additional folder appended after the data source prefix. The uploaded object path becomes `{S3_bucket_name}{dataSourcePrefix}{s3KeyPrefix}/...` — omit any leading `/` and never include the bucket name itself.

**Note**: Treat AWS credentials as sensitive information and never commit them to public repositories.

## Usage Examples

### Example: RAG Answer from a Knowledge Base

```yaml theme={null}
- id: ask_kb
  tool: AWS_BEDROCK_KNOWLEDGE_BASE
  config:
    - name: region
      value: us-east-1
    - name: knowledgeBaseId
      value: "YOUR_KB_ID"
    - name: mode
      value: retrieveAndGenerate
    - name: accessKeyId
      value: "{{secrets.AWS_ACCESS_KEY_ID}}"
    - name: secretAccessKey
      value: "{{secrets.AWS_SECRET_ACCESS_KEY}}"
  input:
    - name: query
      value: "What is our refund policy for annual contracts?"
    - name: numberOfResults
      value: 5
```

### Example: Sync a PDF and Query It

```yaml theme={null}
- id: sync_pdf
  tool: AWS_BEDROCK_KNOWLEDGE_BASE_PDF_SYNC
  config:
    - name: region
      value: us-east-1
    - name: knowledgeBaseId
      value: "YOUR_KB_ID"
    - name: dataSourceId
      value: "YOUR_DATA_SOURCE_ID"
    - name: accessKeyId
      value: "{{secrets.AWS_ACCESS_KEY_ID}}"
    - name: secretAccessKey
      value: "{{secrets.AWS_SECRET_ACCESS_KEY}}"
  input:
    - name: pdf
      value: "https://example.com/reports/q3-report.pdf"
    - name: filename
      value: "q3-report.pdf"
    - name: waitForIngestion
      value: true

- id: query_kb
  tool: AWS_BEDROCK_KNOWLEDGE_BASE
  config:
    - name: region
      value: us-east-1
    - name: knowledgeBaseId
      value: "YOUR_KB_ID"
    - name: mode
      value: retrieve
    - name: accessKeyId
      value: "{{secrets.AWS_ACCESS_KEY_ID}}"
    - name: secretAccessKey
      value: "{{secrets.AWS_SECRET_ACCESS_KEY}}"
  input:
    - name: query
      value: "Key revenue drivers in the Q3 report"
    - name: numberOfResults
      value: 10
```

## Notes

* **PDF size limit**: PDFs larger than 100 MB are rejected.
* **PDF validation**: The file must start with a `%PDF` header; other file types are rejected.
* **HTTPS only**: Insecure `http://` URLs are rejected for the `pdf` input — use HTTPS.
* **Deduplication**: The uploaded object is named `{sha256}.pdf`. If an object with the same content hash already exists, the tool skips both upload and ingestion and returns `skipped: true`.
* **Filename**: `filename` is used for logging only; it is sanitized (special characters replaced) and truncated to 100 characters. Defaults to `document.pdf`.
* **Ingestion wait**: When `waitForIngestion` is `true`, the step fails if the ingestion job ends with `FAILED`, `STOPPING`, or `STOPPED`, or if it does not complete within `ingestionTimeoutSeconds`.
* **numberOfResults** for querying is capped at 100.