Question

A SaaS company is building a customer support assistant using Amazon Bedrock Knowledge Bases. Each of their 400 enterprise tenants has its own set of support documents that must never be visible to other tenants. The engineering team wants a single, cost-efficient architecture that avoids provisioning hundreds of separate vector indexes while still guaranteeing strict tenant isolation at query time. Which approach best meets these requirements?

Accepted Answer

Create one Bedrock Knowledge Base with a shared vector index, attach a tenant_id metadata attribute to each ingested document, and apply a metadata filter on tenant_id in every Retrieve request.

Answer

Provision a separate Bedrock Knowledge Base and dedicated OpenSearch Serverless collection for each tenant to physically isolate their data.

Answer

Store all tenant documents in one shared index without metadata and rely on a post-retrieval LLM prompt instruction telling the model to only use the current tenant's data.

Answer

Create one Knowledge Base and encrypt each tenant's documents with a different KMS key so only the correct tenant can decrypt retrieved chunks.