# User-managed or service-account setup for a long-lived Bedrock Managed Knowledge Base?

> Use AWS’s production guidance as a starting point, then assess credential renewal, connection ownership, synchronization recovery, and retrieval permissions.

Canonical URL: https://www.devobs.io/articles/user-managed-or-service-account-setup-for-a-long-lived-bedrock-knowledge-base/
By: Jonah Reed
Published: 2026-10-25T03:39:01.916Z
Updated: 2026-10-25T03:39:01.916Z
Section: Comparisons

For a long-lived Amazon Bedrock Managed Knowledge Base, **start the production evaluation with service-account authentication—but choose on documented lifecycle behavior**. AWS positions its existing service-account authentication as the programmatic option for production workloads and highlights user-managed setup for faster onboarding and prototyping. That makes service-account setup a reasonable initial candidate, not a proven winner on reliability or unattended operation. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/09/amazon-bedrock-managed-knowledge-base-user-managed-setup-sharepoint-onedrive-confluence/)

## What user-managed setup changes

In an announcement posted September 4, 2026, AWS introduced user-managed setup for SharePoint, OneDrive, and Confluence data sources, labeling the approach **3LO**. Users sign in with existing third-party credentials, and Bedrock handles authentication. AWS says this can reduce data-source setup to a few minutes, specifically highlighting teams prototyping assistants grounded in those sources. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/09/amazon-bedrock-managed-knowledge-base-user-managed-setup-sharepoint-onedrive-confluence/)

AWS describes the previous setup as requiring third-party **2LO** credentials, which could be time-consuming to generate or inaccessible without administrative access. The new flow removes the need to obtain service-account credentials from administrators for that onboarding path. This is narrower than saying every provider-side permission or consent requirement disappears. AWS says user-managed setup complements, rather than replaces, service-account authentication. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/09/amazon-bedrock-managed-knowledge-base-user-managed-setup-sharepoint-onedrive-confluence/)

Do not confuse this authentication choice with the choice between **Managed** and **customer-managed** Knowledge Bases. AWS’s user guide says it manages ingestion, indexing, storage, and retrieval infrastructure for Managed Knowledge Bases. The customer-managed offering instead lets customers set up and manage their RAG pipeline and related infrastructure. [Amazon Bedrock User Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html)

## Long-lived operation needs lifecycle evidence

The production question is not simply which method connects fastest. It is whether your team can maintain and recover the connection when credentials, permissions, or responsible operators change.

The setup announcement does not specify credential lifetimes, automatic renewal behavior, ownership transfer, or synchronization behavior after account disablement. Nor does it establish that a knowledge base’s lifetime is tied to an interactive login session. These are unanswered operational questions—not demonstrated advantages or disadvantages of either method. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/09/amazon-bedrock-managed-knowledge-base-user-managed-setup-sharepoint-onedrive-confluence/)

Before approving either method for unattended use, obtain connector-specific documentation and validate the following in a non-production environment:

| Area | Question to resolve |
| --- | --- |
| Credential renewal | What expires, what renews automatically, and when is human reauthorization required? |
| Rotation and revocation | How are credentials rotated, and what happens when access or consent is revoked? |
| Ownership continuity | Who can maintain or replace the connection if the original operator leaves or loses access? |
| Permission changes | What happens to synchronization and indexed content when source access changes? |
| Failure recovery | How will operators detect authentication failures, restore access, and confirm synchronization has resumed? |

These are proposed acceptance criteria, not documented capabilities of either authentication method. Treat a successful initial connection as one checkpoint—not the entire production-readiness assessment.

## Connector authentication is not retrieval authorization

Keep two questions separate: **How does Bedrock connect to the source?** And **which documents may an application user retrieve?**

AWS’s user guide documents retrieval-time, document-level permission filtering using access control lists for Managed Knowledge Base connectors, except Web Crawler. That capability should be evaluated separately from the connector’s authentication method. [Amazon Bedrock User Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html)

For the selected connector and application, verify how query-time user identity is supplied, how source permissions are represented, and when permission changes affect retrieval. Include negative tests: a user who should not have access to a document should not receive it through the knowledge base. Test loss and restoration of access rather than inferring correct authorization from a successful source connection.

## Choose on operational fit

For a prototype, user-managed setup is a reasonable starting point when the immediate goal is connecting existing content quickly. For production, service-account authentication is the initial candidate suggested by AWS’s positioning. Neither statement establishes an exclusive use case or a lifecycle guarantee. [AWS announcement](https://aws.amazon.com/about-aws/whats-new/2026/09/amazon-bedrock-managed-knowledge-base-user-managed-setup-sharepoint-onedrive-confluence/)

Make the final choice against your requirements for renewal, ownership continuity, permission scope, and recovery. Do not rule out user-managed setup solely because it begins with a user login; do not approve service-account setup solely because its name sounds durable.

**The deciding evidence should be a documented authentication lifecycle and a validated recovery procedure—not the speed of the first connection.**

## Source references

- <https://aws.amazon.com/about-aws/whats-new/2026/09/amazon-bedrock-managed-knowledge-base-user-managed-setup-sharepoint-onedrive-confluence/>
- <https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-base.html>