User-managed or service-account setup for a long-lived Bedrock Managed Knowledge Base?

For a long-lived Amazon Bedrock Managed Knowledge Base, start the production evaluation with service-account authentication—but choose on documented lifecycle behavior. AWS positions its existing service-account authentication as the programmatic option for production workloads and highlights user-managed setup for faster onboarding and prototyping. That makes service-account setup a reasonable initial candidate, not a proven winner on reliability or unattended operation. AWS announcement

What user-managed setup changes

In an announcement posted September 4, 2026, AWS introduced user-managed setup for SharePoint, OneDrive, and Confluence data sources, labeling the approach 3LO. Users sign in with existing third-party credentials, and Bedrock handles authentication. AWS says this can reduce data-source setup to a few minutes, specifically highlighting teams prototyping assistants grounded in those sources. AWS announcement

AWS describes the previous setup as requiring third-party 2LO credentials, which could be time-consuming to generate or inaccessible without administrative access. The new flow removes the need to obtain service-account credentials from administrators for that onboarding path. This is narrower than saying every provider-side permission or consent requirement disappears. AWS says user-managed setup complements, rather than replaces, service-account authentication. AWS announcement

Do not confuse this authentication choice with the choice between Managed and customer-managed Knowledge Bases. AWS’s user guide says it manages ingestion, indexing, storage, and retrieval infrastructure for Managed Knowledge Bases. The customer-managed offering instead lets customers set up and manage their RAG pipeline and related infrastructure. Amazon Bedrock User Guide

Long-lived operation needs lifecycle evidence

The production question is not simply which method connects fastest. It is whether your team can maintain and recover the connection when credentials, permissions, or responsible operators change.

The setup announcement does not specify credential lifetimes, automatic renewal behavior, ownership transfer, or synchronization behavior after account disablement. Nor does it establish that a knowledge base’s lifetime is tied to an interactive login session. These are unanswered operational questions—not demonstrated advantages or disadvantages of either method. AWS announcement

Before approving either method for unattended use, obtain connector-specific documentation and validate the following in a non-production environment:

Area	Question to resolve
Credential renewal	What expires, what renews automatically, and when is human reauthorization required?
Rotation and revocation	How are credentials rotated, and what happens when access or consent is revoked?
Ownership continuity	Who can maintain or replace the connection if the original operator leaves or loses access?
Permission changes	What happens to synchronization and indexed content when source access changes?
Failure recovery	How will operators detect authentication failures, restore access, and confirm synchronization has resumed?

These are proposed acceptance criteria, not documented capabilities of either authentication method. Treat a successful initial connection as one checkpoint—not the entire production-readiness assessment.

Connector authentication is not retrieval authorization

Keep two questions separate: How does Bedrock connect to the source? And which documents may an application user retrieve?

AWS’s user guide documents retrieval-time, document-level permission filtering using access control lists for Managed Knowledge Base connectors, except Web Crawler. That capability should be evaluated separately from the connector’s authentication method. Amazon Bedrock User Guide

For the selected connector and application, verify how query-time user identity is supplied, how source permissions are represented, and when permission changes affect retrieval. Include negative tests: a user who should not have access to a document should not receive it through the knowledge base. Test loss and restoration of access rather than inferring correct authorization from a successful source connection.

Choose on operational fit

For a prototype, user-managed setup is a reasonable starting point when the immediate goal is connecting existing content quickly. For production, service-account authentication is the initial candidate suggested by AWS’s positioning. Neither statement establishes an exclusive use case or a lifecycle guarantee. AWS announcement

Make the final choice against your requirements for renewal, ownership continuity, permission scope, and recovery. Do not rule out user-managed setup solely because it begins with a user login; do not approve service-account setup solely because its name sounds durable.

The deciding evidence should be a documented authentication lifecycle and a validated recovery procedure—not the speed of the first connection.