feat(bedrockagent): add Managed Knowledge Base support (type=MANAGED)

[DanyStinson]

PR Plan: Add Managed Knowledge Base support to aws_bedrock_knowledge_base

Overview

Add support for type = "MANAGED" to the existing aws_bedrock_knowledge_base resource in the hashicorp/terraform-provider-aws provider.

API Shape (from AWS SDK)

type ManagedKnowledgeBaseConfiguration struct {
    EmbeddingModelArn                 *string
    EmbeddingModelConfiguration       *EmbeddingModelConfiguration
    EmbeddingModelType                EmbeddingModelType  // "CUSTOM" | "MANAGED"
    ServerSideEncryptionConfiguration *ServerSideEncryptionConfiguration
}

type ServerSideEncryptionConfiguration struct {
    KmsKeyArn *string
}

EmbeddingModelConfiguration already exists in the provider (used by vector_knowledge_base_configuration).

Changes Required

1. Schema (knowledge_base.go — Schema function)

Add managed_knowledge_base_configuration block inside knowledge_base_configuration:

"managed_knowledge_base_configuration": schema.ListNestedBlock{
    CustomType: fwtypes.NewListNestedObjectTypeOf[managedKnowledgeBaseConfigurationModel](ctx),
    Validators: []validator.List{
        listvalidator.SizeAtMost(1),
    },
    PlanModifiers: []planmodifier.List{
        listplanmodifier.RequiresReplace(),
    },
    NestedObject: schema.NestedBlockObject{
        Attributes: map[string]schema.Attribute{
            "embedding_model_arn": schema.StringAttribute{
                CustomType: fwtypes.ARNType,
                Optional:   true,
                PlanModifiers: []planmodifier.String{
                    stringplanmodifier.RequiresReplace(),
                },
            },
            "embedding_model_type": schema.StringAttribute{
                CustomType: fwtypes.StringEnumType[awstypes.EmbeddingModelType](),
                Optional:   true,
                Computed:   true,
                PlanModifiers: []planmodifier.String{
                    stringplanmodifier.RequiresReplace(),
                    stringplanmodifier.UseStateForUnknown(),
                },
            },
        },
        Blocks: map[string]schema.Block{
            "embedding_model_configuration": // reuse existing block definition
            "server_side_encryption_configuration": schema.ListNestedBlock{
                CustomType: fwtypes.NewListNestedObjectTypeOf[managedKBServerSideEncryptionConfigurationModel](ctx),
                Validators: []validator.List{
                    listvalidator.SizeAtMost(1),
                },
                PlanModifiers: []planmodifier.List{
                    listplanmodifier.RequiresReplace(),
                },
                NestedObject: schema.NestedBlockObject{
                    Attributes: map[string]schema.Attribute{
                        names.AttrKMSKeyARN: schema.StringAttribute{
                            CustomType: fwtypes.ARNType,
                            Optional:   true,
                            PlanModifiers: []planmodifier.String{
                                stringplanmodifier.RequiresReplace(),
                            },
                        },
                    },
                },
            },
        },
    },
},

2. Update ExactlyOneOf validator

Add managed_knowledge_base_configuration to the ExactlyOneOf list alongside kendra/sql/vector:

listvalidator.ExactlyOneOf(
    path.MatchRelative().AtParent().AtName("kendra_knowledge_base_configuration"),
    path.MatchRelative().AtParent().AtName("managed_knowledge_base_configuration"),
    path.MatchRelative().AtParent().AtName("sql_knowledge_base_configuration"),
    path.MatchRelative().AtParent().AtName("vector_knowledge_base_configuration"),
),

3. Make storage_configuration optional for MANAGED type

The storage_configuration block currently has no Required validator (it's already optional in the schema). The validation happens at the API level — if you send MANAGED type with no storage_configuration, the API accepts it. No schema change needed here; just ensure no custom validators reject it.

4. Model structs

type managedKnowledgeBaseConfigurationModel struct {
    EmbeddingModelARN                 fwtypes.ARN                                                                          `tfsdk:"embedding_model_arn"`
    EmbeddingModelConfiguration       fwtypes.ListNestedObjectValueOf[embeddingModelConfigurationModel]                     `tfsdk:"embedding_model_configuration"`
    EmbeddingModelType                fwtypes.StringEnum[awstypes.EmbeddingModelType]                                       `tfsdk:"embedding_model_type"`
    ServerSideEncryptionConfiguration fwtypes.ListNestedObjectValueOf[managedKBServerSideEncryptionConfigurationModel]      `tfsdk:"server_side_encryption_configuration"`
}

type managedKBServerSideEncryptionConfigurationModel struct {
    KMSKeyARN fwtypes.ARN `tfsdk:"kms_key_arn"`
}

5. Update knowledgeBaseConfigurationModel

type knowledgeBaseConfigurationModel struct {
    KendraKnowledgeBaseConfiguration  fwtypes.ListNestedObjectValueOf[kendraKnowledgeBaseConfigurationModel]  `tfsdk:"kendra_knowledge_base_configuration"`
    ManagedKnowledgeBaseConfiguration fwtypes.ListNestedObjectValueOf[managedKnowledgeBaseConfigurationModel] `tfsdk:"managed_knowledge_base_configuration"`
    SQLKnowledgeBaseConfiguration     fwtypes.ListNestedObjectValueOf[sqlKnowledgeBaseConfigurationModel]     `tfsdk:"sql_knowledge_base_configuration"`
    Type                              fwtypes.StringEnum[awstypes.KnowledgeBaseType]                          `tfsdk:"type"`
    VectorKnowledgeBaseConfiguration  fwtypes.ListNestedObjectValueOf[vectorKnowledgeBaseConfigurationModel]  `tfsdk:"vector_knowledge_base_configuration"`
}

6. No flatten/expand code needed

The provider uses fwflex.Flatten and fwflex.Expand (AutoFlex) which automatically maps between SDK types and Terraform model structs by name convention. Since our struct field names match the SDK field names, AutoFlex handles the serialization.

7. Acceptance test

func TestAccBedrockAgentKnowledgeBase_managed(t *testing.T) {
    ctx := acctest.Context(t)
    var kb awstypes.KnowledgeBase
    rName := sdkacctest.RandomWithPrefix(acctest.ResourcePrefix)
    resourceName := "aws_bedrock_knowledge_base.test"

    resource.ParallelTest(t, resource.TestCase{
        PreCheck: func() { acctest.PreCheck(ctx, t) },
        ProtoV5ProviderFactories: acctest.ProtoV5ProviderFactories,
        CheckDestroy: testAccCheckKnowledgeBaseDestroy(ctx),
        Steps: []resource.TestStep{
            {
                Config: testAccKnowledgeBaseConfig_managed(rName),
                Check: resource.ComposeAggregateTestCheckFunc(
                    testAccCheckKnowledgeBaseExists(ctx, resourceName, &kb),
                    resource.TestCheckResourceAttr(resourceName, "knowledge_base_configuration.0.type", "MANAGED"),
                    resource.TestCheckResourceAttr(resourceName, "knowledge_base_configuration.0.managed_knowledge_base_configuration.0.embedding_model_type", "MANAGED"),
                ),
            },
        },
    })
}

func testAccKnowledgeBaseConfig_managed(rName string) string {
    return fmt.Sprintf(`
resource "aws_iam_role" "test" {
  name = %[1]q
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "bedrock.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

resource "aws_bedrock_knowledge_base" "test" {
  name     = %[1]q
  role_arn = aws_iam_role.test.arn

  knowledge_base_configuration {
    type = "MANAGED"

    managed_knowledge_base_configuration {
      embedding_model_type = "MANAGED"
    }
  }
}
`, rName)
}

8. Documentation

Update website/docs/r/bedrock_knowledge_base.html.markdown to add a MANAGED example.

Files to modify

1. internal/service/bedrockagent/knowledge_base.go — schema + models
2. internal/service/bedrockagent/knowledge_base_test.go — acceptance test
3. website/docs/r/bedrock_knowledge_base.html.markdown — docs

SDK dependency

The current provider uses bedrockagent v1.57.0. Need to verify that ManagedKnowledgeBaseConfiguration and KnowledgeBaseTypeManaged exist in this version. If not, bump to the latest SDK version that includes them.

Expected user experience

resource "aws_bedrock_knowledge_base" "managed" {
  name     = "my-managed-kb"
  role_arn = aws_iam_role.kb.arn

  knowledge_base_configuration {
    type = "MANAGED"

    managed_knowledge_base_configuration {
      embedding_model_type = "MANAGED"
    }
  }

  # No storage_configuration needed — Bedrock manages it
}

With custom embedding:

resource "aws_bedrock_knowledge_base" "managed_custom" {
  name     = "my-managed-kb-multilingual"
  role_arn = aws_iam_role.kb.arn

  knowledge_base_configuration {
    type = "MANAGED"

    managed_knowledge_base_configuration {
      embedding_model_type = "CUSTOM"
      embedding_model_arn  = "arn:aws:bedrock:us-east-1::foundation-model/cohere.embed-multilingual-v3"

      embedding_model_configuration {
        bedrock_embedding_model_configuration {
          dimensions = 1024
        }
      }
    }
  }
}

[github-actions]

Community Guidelines

This comment is added to every new Pull Request to provide quick reference to how the Terraform AWS Provider is maintained. Please review the information below, and thank you for contributing to the community that keeps the provider thriving! 🚀

Voting for Prioritization

• Please vote on this Pull Request by adding a 👍 reaction to the original post to help the community and maintainers prioritize it.
• Please see our prioritization guide for additional information on how the maintainers handle prioritization.
• Please do not leave +1 or other comments that do not add relevant new information or questions; they generate extra noise for others following the Pull Request and do not help prioritize the request.

Pull Request Authors

• Review the contribution guide relating to the type of change you are making to ensure all of the necessary steps have been taken.
• Whether or not the branch has been rebased will not impact prioritization, but doing so is always a welcome surprise.

[github-actions]

✅ Thank you for correcting the previously detected issues! The maintainers appreciate your efforts to make the review process as smooth as possible.