AWS Security ChangesHomeSearch

AWS bedrock documentation change

Service: bedrock · 2026-05-13 · Documentation low

File: bedrock/latest/userguide/knowledge-base-setup.md

Summary

Added requirements for custom metadata field definitions and HNSW index configuration to prevent query failures

Security assessment

Focuses on search functionality improvements and error prevention. No security implications are mentioned.

Diff

diff --git a/bedrock/latest/userguide/knowledge-base-setup.md b/bedrock/latest/userguide/knowledge-base-setup.md
index 989a294ab..3e0d56999 100644
--- a//bedrock/latest/userguide/knowledge-base-setup.md
+++ b//bedrock/latest/userguide/knowledge-base-setup.md
@@ -195,0 +196,15 @@ Amazon Bedrock stores metadata related to your knowledge base in this field. | S
+###### Custom metadata fields for filtering
+
+If you plan to use [metadata filtering](./kb-test-config.html) with custom metadata fields, you must define those fields with a `keyword` type or as a `text` type with a `keyword` subfield. For example:
+    
+        "my_custom_field": {
+        "type": "text",
+        "fields": {
+            "keyword": {
+                "type": "keyword"
+            }
+        }
+    }
+
+Without this structure, filtering queries on custom metadata fields will fail with a "Rewrite first" error.
+
@@ -335,0 +351,9 @@ For improving hybrid search accuracy and latency with English content, consider
+###### Note
+
+If you use metadata filtering with your knowledge base, we recommend enabling HNSW iterative index scans (requires pgvector 0.8.0 or later). Without iterative scans, selective metadata filters can return fewer results than expected because filtering is applied after the HNSW index scan. Iterative scans automatically scan more of the index until enough filtered results are found.
+    
+        ALTER DATABASE your_database SET hnsw.iterative_scan = 'relaxed_order';
+    ALTER DATABASE your_database SET hnsw.max_scan_tuples = 20000;
+
+These settings persist at the database level but only take effect for new sessions. If you are using the RDS Data API, allow a few minutes for connection pool sessions to recycle before the settings take effect.
+