AIP-C01 · Question #86
A hotel company wants to enhance a legacy Java-based property management system (PMS) by adding AI capabilities. The company wants to use Amazon Bedrock Knowledge Bases to provide staff with room…
The correct answer is C. Implement one Amazon Bedrock knowledge base for each hotel in a multi-account structure. Use. Creating one Amazon Bedrock Knowledge Base per hotel in a dedicated AWS account per hotel delivers the strongest isolation model. AWS account boundaries are the hardest access control boundary in AWS, ensuring that hotel A's staff can never access hotel B's knowledge base even…
Question
A hotel company wants to enhance a legacy Java-based property management system (PMS) by adding AI capabilities. The company wants to use Amazon Bedrock Knowledge Bases to provide staff with room availability information and hotel-specific details. The solution must maintain separate access controls for each hotel that the company manages. The solution must provide room availability information in near real time and must maintain consistent performance during peak usage periods. Which solution will meet these requirements?
Options
- ADeploy a single Amazon Bedrock knowledge base that contains combined data for all hotels.
- BCreate an Amazon EventBridge rule for each hotel that is invoked by changes to the PMS
- CImplement one Amazon Bedrock knowledge base for each hotel in a multi-account structure. Use
- DBuild a centralized Amazon Bedrock Agents solution that uses multiple knowledge bases.
How the community answered
(31 responses)- A16% (5)
- B6% (2)
- C45% (14)
- D32% (10)
Explanation
Creating one Amazon Bedrock Knowledge Base per hotel in a dedicated AWS account per hotel delivers the strongest isolation model. AWS account boundaries are the hardest access control boundary in AWS, ensuring that hotel A's staff can never access hotel B's knowledge base even through misconfigured IAM policies. Each knowledge base can sync from a data source close to the hotel's PMS, enabling near-real-time room availability updates. Option A (single combined knowledge base) cannot enforce per-hotel access controls without complex IAM and metadata filtering. Option B (EventBridge rules per hotel) addresses data ingestion triggers but does not establish separate access control boundaries between hotels. Option D (centralized Bedrock Agents with multiple knowledge bases in one account) makes per-hotel access separation harder to enforce and increases blast radius if one hotel's data is compromised.
Topics
Community Discussion
No community discussion yet for this question.