# Now You Can Self-Diagnose Access Control Issues in Bedrock Knowledge Base!

Hey, it's me! I found a small but really handy update around access control for Amazon Bedrock Managed Knowledge Base, so let me walk you through it.

## What was announced?

According to AWS What's New, Amazon Bedrock Managed Knowledge Base now has two new APIs, `CheckIngestedDocumentAcl` and `GetIngestedDocumentAcl`, along with a matching console experience. For ACL-enabled data sources, these let you debug and audit document-level access control yourself, self-service style.

- `CheckIngestedDocumentAcl` — checks whether a specific user has access to a given document
- `GetIngestedDocumentAcl` — retrieves the full ACL attached to a document so you can audit its permissions

The console also gets a new Document Access Control section on the data source details page, where you can enter a document ID and a user's email to check access, or just a document ID to pull the document's full ACL.

## The story so far

With ACL-enabled data sources, users sometimes ran into a puzzling situation: a document they expected to see just wasn't showing up in retrieval results. It was hard to tell whether that was caused by an access control misconfiguration or something else entirely, and in many cases the only way to dig in was to open a support case with AWS.

## What changes

Administrators can now investigate document permissions themselves, without opening a support case. You can verify on the spot whether a given user should or shouldn't be able to see a document, or pull a document's full ACL to audit it for misconfigurations. That makes it much easier to manage access control at scale across enterprise knowledge bases, and troubleshooting should get noticeably faster.

## Dive Deep

Both new APIs are documented in the Amazon Bedrock API Reference.

- `CheckIngestedDocumentAcl` is built for per-user access checks
- `GetIngestedDocumentAcl` is built for retrieving and auditing a document's full ACL

The console mirrors this: in the Document Access Control section, entering a document ID plus a user's email runs an access check, while a document ID alone returns that document's complete ACL. Since it's available through both the API and the console, it works well for automated checks from CI or scripts as well as for a quick manual look in the console. The announcement doesn't mention specific supported regions or pricing.

## Wrap-up

- Amazon Bedrock Managed Knowledge Base gained two new APIs, `CheckIngestedDocumentAcl` and `GetIngestedDocumentAcl`
- `CheckIngestedDocumentAcl` checks user-to-document access, while `GetIngestedDocumentAcl` retrieves and audits a document's full ACL
- A new Document Access Control section was added to the data source details page in the console
- This update is great for administrators and operators running ACL-enabled knowledge bases who've been stuck troubleshooting permission issues through support cases!