aws-sdk-bedrockagentruntime 1.78.0 → 1.79.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b6eca6aaea09bb1001fceb3e78d10fc5ec188d5dc756bf79e659d2116fe52024
-  data.tar.gz: 428157d1f5df7d5a3b404ecba7c8060c73bbc04c3ee56aec394b1a1143887611
+  metadata.gz: 4eb4959009f8c6687e35f5cbd2afe31cfa973fd33d82d858aad099fef3363f34
+  data.tar.gz: e64a01355716635a665d82034a31e1580f3827905d1dbd4e4e970695b02d541e
 SHA512:
-  metadata.gz: 732fa016b9afccb993707ddf3699bfe1bbe3915f4c3655c7921c3704cdb9dc1ffed4546bfa6f92dc7eadb979773dfd5194714407bd86018666db4aa38be39562
-  data.tar.gz: 6d75cc224981bc60dd881e7abdc17af98bc0f0cff980336f118c3d9ab2997389c667a17854363f934ac0af823bb80628701e0a9aa0a8998abbc32b24eb2dd218
+  metadata.gz: 993b27eb8ff62be0b637ebb43faba605a7912cf4b7ae7f74d8ac9a304d18cd15a52b954dc87644b0d06ca3e63bac98568f95f3b496198bba8196be5ea4ce00dc
+  data.tar.gz: 785e6a6416805fcbe9ba0fa389e9f7f9ec2effc286c1ed64caca5320226524d873e0b5904374331fa889229b9ee7574e11cc85766609a21a99c7151487bbadba

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 Unreleased Changes
 ------------------
 
+1.79.0 (2026-08-14)
+------------------
+
+* Feature - Adds CheckIngestedDocumentAcl and GetIngestedDocumentAcl APIs to Amazon Bedrock Knowledge Bases. Customers can verify user access to documents based on ingested ACLs and retrieve full ACL details including allow and deny entries, enabling validation of ACL ingestion without test retrievals.
+
 1.78.0 (2026-07-09)
 ------------------
 

data/VERSION

@@ -1 +1 @@
-1.78.0
+1.79.0

data/lib/aws-sdk-bedrockagentruntime/client.rb

@@ -948,6 +948,55 @@ module Aws::BedrockAgentRuntime
       req.send_request(options, &block)
     end
 
+    # Checks whether a user has access to a specific document by verifying
+    # against the ingested access control list (ACL) in a knowledge base.
+    # Use this operation to validate that document-level access control is
+    # working as expected after ingestion. To use this operation, you must
+    # have the `bedrock:CheckIngestedDocumentAcl` permission.
+    #
+    # @option params [required, String] :data_source_id
+    #   The unique identifier of the data source that contains the document.
+    #
+    # @option params [required, String] :document_id
+    #   The unique identifier of the document to check access for.
+    #
+    # @option params [required, String] :knowledge_base_id
+    #   The unique identifier of the knowledge base that contains the
+    #   document.
+    #
+    # @option params [required, Types::UserContext] :user_context
+    #   The context object containing identity information for access control
+    #   filtering, including user ID and optional group memberships used to
+    #   evaluate the document access control list (ACL).
+    #
+    # @return [Types::CheckIngestedDocumentAclResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::CheckIngestedDocumentAclResponse#has_access #has_access} => Boolean
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.check_ingested_document_acl({
+    #     data_source_id: "DataSourceId", # required
+    #     document_id: "DocumentId", # required
+    #     knowledge_base_id: "KnowledgeBaseIdentifier", # required
+    #     user_context: { # required
+    #       user_id: "String", # required
+    #     },
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.has_access #=> Boolean
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/CheckIngestedDocumentAcl AWS API Documentation
+    #
+    # @overload check_ingested_document_acl(params = {})
+    # @param [Hash] params ({})
+    def check_ingested_document_acl(params = {}, options = {})
+      req = build_request(:check_ingested_document_acl, params)
+      req.send_request(options)
+    end
+
     # Creates a new invocation within a session. An invocation groups the
     # related invocation steps that store the content from a conversation.
     # For more information about sessions, see [Store and retrieve
@@ -1345,10 +1394,9 @@ module Aws::BedrockAgentRuntime
     #   file. `EXTRACTED` returns parsed text as JSON. Defaults to `RAW`.
     #
     # @option params [Types::UserContext] :user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that results only include
+    #   documents the user is authorized to access.
     #
     # @return [Types::GetDocumentContentResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -1493,6 +1541,65 @@ module Aws::BedrockAgentRuntime
       req.send_request(options)
     end
 
+    # Retrieves the ingested access control list (ACL) for a specific
+    # document in a knowledge base. Use this operation to inspect the allow
+    # and deny lists that were ingested for a document to troubleshoot
+    # access control issues. To use this operation, you must have the
+    # `bedrock:GetIngestedDocumentAcl` permission.
+    #
+    # @option params [required, String] :data_source_id
+    #   The unique identifier of the data source that contains the document.
+    #
+    # @option params [required, String] :document_id
+    #   The unique identifier of the document to retrieve the ingested access
+    #   control list (ACL) for.
+    #
+    # @option params [required, String] :knowledge_base_id
+    #   The unique identifier of the knowledge base that contains the
+    #   document.
+    #
+    # @return [Types::GetIngestedDocumentAclResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
+    #
+    #   * {Types::GetIngestedDocumentAclResponse#document_acl #document_acl} => Types::DocumentAcl
+    #
+    # @example Request syntax with placeholder values
+    #
+    #   resp = client.get_ingested_document_acl({
+    #     data_source_id: "DataSourceId", # required
+    #     document_id: "DocumentId", # required
+    #     knowledge_base_id: "KnowledgeBaseIdentifier", # required
+    #   })
+    #
+    # @example Response structure
+    #
+    #   resp.document_acl.allow_list.conditions #=> Array
+    #   resp.document_acl.allow_list.conditions[0].condition_operator #=> String, one of "AND", "OR"
+    #   resp.document_acl.allow_list.conditions[0].groups #=> Array
+    #   resp.document_acl.allow_list.conditions[0].groups[0].id #=> String
+    #   resp.document_acl.allow_list.conditions[0].groups[0].type #=> String, one of "KNOWLEDGE_BASE", "DATA_SOURCE"
+    #   resp.document_acl.allow_list.conditions[0].users #=> Array
+    #   resp.document_acl.allow_list.conditions[0].users[0].id #=> String
+    #   resp.document_acl.allow_list.conditions[0].users[0].type #=> String, one of "KNOWLEDGE_BASE", "DATA_SOURCE"
+    #   resp.document_acl.allow_list.member_relation #=> String, one of "AND", "OR"
+    #   resp.document_acl.deny_list.conditions #=> Array
+    #   resp.document_acl.deny_list.conditions[0].condition_operator #=> String, one of "AND", "OR"
+    #   resp.document_acl.deny_list.conditions[0].groups #=> Array
+    #   resp.document_acl.deny_list.conditions[0].groups[0].id #=> String
+    #   resp.document_acl.deny_list.conditions[0].groups[0].type #=> String, one of "KNOWLEDGE_BASE", "DATA_SOURCE"
+    #   resp.document_acl.deny_list.conditions[0].users #=> Array
+    #   resp.document_acl.deny_list.conditions[0].users[0].id #=> String
+    #   resp.document_acl.deny_list.conditions[0].users[0].type #=> String, one of "KNOWLEDGE_BASE", "DATA_SOURCE"
+    #   resp.document_acl.deny_list.member_relation #=> String, one of "AND", "OR"
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/GetIngestedDocumentAcl AWS API Documentation
+    #
+    # @overload get_ingested_document_acl(params = {})
+    # @param [Hash] params ({})
+    def get_ingested_document_acl(params = {}, options = {})
+      req = build_request(:get_ingested_document_acl, params)
+      req.send_request(options)
+    end
+
     # Retrieves the details of a specific invocation step within an
     # invocation in a session. For more information about sessions, see
     # [Store and retrieve conversation history and context with Amazon
@@ -1595,7 +1702,16 @@ module Aws::BedrockAgentRuntime
       req.send_request(options)
     end
 
-    # <note> </note>
+    # <note markdown="1"> Amazon Bedrock Agents (now Amazon Bedrock Agents
+    # Classic) is no longer
+    # open to new customers. For capabilities similar to Bedrock Agents
+    # Classic, explore Amazon Bedrock AgentCore. Existing customers can
+    # continue to use the service as normal. For more information, see
+    # [Amazon Bedrock Agents Classic availability change][1].
+    #
+    #  </note>
+    #
+    #  <note> </note>
     #
     #  Sends a prompt for the agent to process and respond to. Note the
     # following fields for the request:
@@ -1607,7 +1723,7 @@ module Aws::BedrockAgentRuntime
     #   enablement helps you follow the agent's reasoning process that led
     #   it to the information it processed, the actions it took, and the
     #   final result it yielded. For more information, see [Trace
-    #   enablement][1].
+    #   enablement][2].
     #
     # * End a conversation by setting `endSession` to `true`.
     #
@@ -1635,7 +1751,8 @@ module Aws::BedrockAgentRuntime
     #
     #
     #
-    # [1]: https://docs.aws.amazon.com/bedrock/latest/userguide/agents-test.html#trace-events
+    # [1]: https://docs.aws.amazon.com/bedrock/latest/userguide/agents-classic-maintenance-mode.html
+    # [2]: https://docs.aws.amazon.com/bedrock/latest/userguide/agents-test.html#trace-events
     #
     # @option params [required, String] :agent_alias_id
     #   The alias of the agent to use.
@@ -6684,10 +6801,9 @@ module Aws::BedrockAgentRuntime
     #   Contains the query to send the knowledge base.
     #
     # @option params [Types::UserContext] :user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that retrieval results only
+    #   include documents the user is authorized to access.
     #
     # @return [Types::RetrieveResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -7009,10 +7125,9 @@ module Aws::BedrockAgentRuntime
     #   explicitly set the `sessionId` yourself.
     #
     # @option params [Types::UserContext] :user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that retrieval results only
+    #   include documents the user is authorized to access.
     #
     # @return [Types::RetrieveAndGenerateResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -7428,10 +7543,9 @@ module Aws::BedrockAgentRuntime
     #   explicitly set the `sessionId` yourself.
     #
     # @option params [Types::UserContext] :user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that retrieval results only
+    #   include documents the user is authorized to access.
     #
     # @return [Types::RetrieveAndGenerateStreamResponse] Returns a {Seahorse::Client::Response response} object which responds to the following methods:
     #
@@ -8313,7 +8427,7 @@ module Aws::BedrockAgentRuntime
         tracer: tracer
       )
       context[:gem_name] = 'aws-sdk-bedrockagentruntime'
-      context[:gem_version] = '1.78.0'
+      context[:gem_version] = '1.79.0'
       Seahorse::Client::Request.new(handlers, context)
     end
 

data/lib/aws-sdk-bedrockagentruntime/client_api.rb

@@ -125,6 +125,8 @@ module Aws::BedrockAgentRuntime
     ByteContentFile = Shapes::StructureShape.new(name: 'ByteContentFile')
     Caller = Shapes::UnionShape.new(name: 'Caller')
     CallerChain = Shapes::ListShape.new(name: 'CallerChain')
+    CheckIngestedDocumentAclRequest = Shapes::StructureShape.new(name: 'CheckIngestedDocumentAclRequest')
+    CheckIngestedDocumentAclResponse = Shapes::StructureShape.new(name: 'CheckIngestedDocumentAclResponse')
     Citation = Shapes::StructureShape.new(name: 'Citation')
     CitationEvent = Shapes::StructureShape.new(name: 'CitationEvent')
     Citations = Shapes::ListShape.new(name: 'Citations')
@@ -162,6 +164,18 @@ module Aws::BedrockAgentRuntime
     DeleteSessionResponse = Shapes::StructureShape.new(name: 'DeleteSessionResponse')
     DependencyFailedException = Shapes::StructureShape.new(name: 'DependencyFailedException')
     Document = Shapes::DocumentShape.new(name: 'Document', document: true)
+    DocumentAcl = Shapes::StructureShape.new(name: 'DocumentAcl')
+    DocumentAclCondition = Shapes::StructureShape.new(name: 'DocumentAclCondition')
+    DocumentAclConditionGroupsList = Shapes::ListShape.new(name: 'DocumentAclConditionGroupsList')
+    DocumentAclConditionUsersList = Shapes::ListShape.new(name: 'DocumentAclConditionUsersList')
+    DocumentAclGroup = Shapes::StructureShape.new(name: 'DocumentAclGroup')
+    DocumentAclGroupIdString = Shapes::StringShape.new(name: 'DocumentAclGroupIdString')
+    DocumentAclMemberRelation = Shapes::StringShape.new(name: 'DocumentAclMemberRelation')
+    DocumentAclMembership = Shapes::StructureShape.new(name: 'DocumentAclMembership')
+    DocumentAclMembershipConditionsList = Shapes::ListShape.new(name: 'DocumentAclMembershipConditionsList')
+    DocumentAclMembershipType = Shapes::StringShape.new(name: 'DocumentAclMembershipType')
+    DocumentAclUser = Shapes::StructureShape.new(name: 'DocumentAclUser')
+    DocumentAclUserIdString = Shapes::StringShape.new(name: 'DocumentAclUserIdString')
     DocumentId = Shapes::StringShape.new(name: 'DocumentId')
     DocumentOutputFormat = Shapes::StringShape.new(name: 'DocumentOutputFormat')
     Double = Shapes::FloatShape.new(name: 'Double')
@@ -277,6 +291,8 @@ module Aws::BedrockAgentRuntime
     GetExecutionFlowSnapshotResponse = Shapes::StructureShape.new(name: 'GetExecutionFlowSnapshotResponse')
     GetFlowExecutionRequest = Shapes::StructureShape.new(name: 'GetFlowExecutionRequest')
     GetFlowExecutionResponse = Shapes::StructureShape.new(name: 'GetFlowExecutionResponse')
+    GetIngestedDocumentAclRequest = Shapes::StructureShape.new(name: 'GetIngestedDocumentAclRequest')
+    GetIngestedDocumentAclResponse = Shapes::StructureShape.new(name: 'GetIngestedDocumentAclResponse')
     GetInvocationStepRequest = Shapes::StructureShape.new(name: 'GetInvocationStepRequest')
     GetInvocationStepResponse = Shapes::StructureShape.new(name: 'GetInvocationStepResponse')
     GetSessionRequest = Shapes::StructureShape.new(name: 'GetSessionRequest')
@@ -1011,6 +1027,15 @@ module Aws::BedrockAgentRuntime
 
     CallerChain.member = Shapes::ShapeRef.new(shape: Caller)
 
+    CheckIngestedDocumentAclRequest.add_member(:data_source_id, Shapes::ShapeRef.new(shape: DataSourceId, required: true, location: "uri", location_name: "dataSourceId"))
+    CheckIngestedDocumentAclRequest.add_member(:document_id, Shapes::ShapeRef.new(shape: DocumentId, required: true, location_name: "documentId"))
+    CheckIngestedDocumentAclRequest.add_member(:knowledge_base_id, Shapes::ShapeRef.new(shape: KnowledgeBaseIdentifier, required: true, location: "uri", location_name: "knowledgeBaseId"))
+    CheckIngestedDocumentAclRequest.add_member(:user_context, Shapes::ShapeRef.new(shape: UserContext, required: true, location_name: "userContext"))
+    CheckIngestedDocumentAclRequest.struct_class = Types::CheckIngestedDocumentAclRequest
+
+    CheckIngestedDocumentAclResponse.add_member(:has_access, Shapes::ShapeRef.new(shape: Boolean, required: true, location_name: "hasAccess"))
+    CheckIngestedDocumentAclResponse.struct_class = Types::CheckIngestedDocumentAclResponse
+
     Citation.add_member(:generated_response_part, Shapes::ShapeRef.new(shape: GeneratedResponsePart, location_name: "generatedResponsePart"))
     Citation.add_member(:retrieved_references, Shapes::ShapeRef.new(shape: RetrievedReferences, location_name: "retrievedReferences"))
     Citation.struct_class = Types::Citation
@@ -1130,6 +1155,33 @@ module Aws::BedrockAgentRuntime
     DependencyFailedException.add_member(:resource_name, Shapes::ShapeRef.new(shape: NonBlankString, location_name: "resourceName"))
     DependencyFailedException.struct_class = Types::DependencyFailedException
 
+    DocumentAcl.add_member(:allow_list, Shapes::ShapeRef.new(shape: DocumentAclMembership, location_name: "allowList"))
+    DocumentAcl.add_member(:deny_list, Shapes::ShapeRef.new(shape: DocumentAclMembership, location_name: "denyList"))
+    DocumentAcl.struct_class = Types::DocumentAcl
+
+    DocumentAclCondition.add_member(:condition_operator, Shapes::ShapeRef.new(shape: DocumentAclMemberRelation, location_name: "conditionOperator"))
+    DocumentAclCondition.add_member(:groups, Shapes::ShapeRef.new(shape: DocumentAclConditionGroupsList, location_name: "groups"))
+    DocumentAclCondition.add_member(:users, Shapes::ShapeRef.new(shape: DocumentAclConditionUsersList, location_name: "users"))
+    DocumentAclCondition.struct_class = Types::DocumentAclCondition
+
+    DocumentAclConditionGroupsList.member = Shapes::ShapeRef.new(shape: DocumentAclGroup)
+
+    DocumentAclConditionUsersList.member = Shapes::ShapeRef.new(shape: DocumentAclUser)
+
+    DocumentAclGroup.add_member(:id, Shapes::ShapeRef.new(shape: DocumentAclGroupIdString, required: true, location_name: "id"))
+    DocumentAclGroup.add_member(:type, Shapes::ShapeRef.new(shape: DocumentAclMembershipType, required: true, location_name: "type"))
+    DocumentAclGroup.struct_class = Types::DocumentAclGroup
+
+    DocumentAclMembership.add_member(:conditions, Shapes::ShapeRef.new(shape: DocumentAclMembershipConditionsList, location_name: "conditions"))
+    DocumentAclMembership.add_member(:member_relation, Shapes::ShapeRef.new(shape: DocumentAclMemberRelation, location_name: "memberRelation"))
+    DocumentAclMembership.struct_class = Types::DocumentAclMembership
+
+    DocumentAclMembershipConditionsList.member = Shapes::ShapeRef.new(shape: DocumentAclCondition)
+
+    DocumentAclUser.add_member(:id, Shapes::ShapeRef.new(shape: DocumentAclUserIdString, required: true, location_name: "id"))
+    DocumentAclUser.add_member(:type, Shapes::ShapeRef.new(shape: DocumentAclMembershipType, required: true, location_name: "type"))
+    DocumentAclUser.struct_class = Types::DocumentAclUser
+
     EndSessionRequest.add_member(:session_identifier, Shapes::ShapeRef.new(shape: SessionIdentifier, required: true, location: "uri", location_name: "sessionIdentifier"))
     EndSessionRequest.struct_class = Types::EndSessionRequest
 
@@ -1530,6 +1582,14 @@ module Aws::BedrockAgentRuntime
     GetFlowExecutionResponse.add_member(:status, Shapes::ShapeRef.new(shape: FlowExecutionStatus, required: true, location_name: "status"))
     GetFlowExecutionResponse.struct_class = Types::GetFlowExecutionResponse
 
+    GetIngestedDocumentAclRequest.add_member(:data_source_id, Shapes::ShapeRef.new(shape: DataSourceId, required: true, location: "uri", location_name: "dataSourceId"))
+    GetIngestedDocumentAclRequest.add_member(:document_id, Shapes::ShapeRef.new(shape: DocumentId, required: true, location_name: "documentId"))
+    GetIngestedDocumentAclRequest.add_member(:knowledge_base_id, Shapes::ShapeRef.new(shape: KnowledgeBaseIdentifier, required: true, location: "uri", location_name: "knowledgeBaseId"))
+    GetIngestedDocumentAclRequest.struct_class = Types::GetIngestedDocumentAclRequest
+
+    GetIngestedDocumentAclResponse.add_member(:document_acl, Shapes::ShapeRef.new(shape: DocumentAcl, required: true, location_name: "documentAcl"))
+    GetIngestedDocumentAclResponse.struct_class = Types::GetIngestedDocumentAclResponse
+
     GetInvocationStepRequest.add_member(:invocation_identifier, Shapes::ShapeRef.new(shape: InvocationIdentifier, required: true, location_name: "invocationIdentifier"))
     GetInvocationStepRequest.add_member(:invocation_step_id, Shapes::ShapeRef.new(shape: Uuid, required: true, location: "uri", location_name: "invocationStepId"))
     GetInvocationStepRequest.add_member(:session_identifier, Shapes::ShapeRef.new(shape: SessionIdentifier, required: true, location: "uri", location_name: "sessionIdentifier"))
@@ -2844,6 +2904,19 @@ module Aws::BedrockAgentRuntime
         o.errors << Shapes::ShapeRef.new(shape: ServiceQuotaExceededException)
       end)
 
+      api.add_operation(:check_ingested_document_acl, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "CheckIngestedDocumentAcl"
+        o.http_method = "POST"
+        o.http_request_uri = "/knowledgebases/{knowledgeBaseId}/datasources/{dataSourceId}/check-ingested-document-acl"
+        o.input = Shapes::ShapeRef.new(shape: CheckIngestedDocumentAclRequest)
+        o.output = Shapes::ShapeRef.new(shape: CheckIngestedDocumentAclResponse)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+        o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
+        o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+      end)
+
       api.add_operation(:create_invocation, Seahorse::Model::Operation.new.tap do |o|
         o.name = "CreateInvocation"
         o.http_method = "PUT"
@@ -2997,6 +3070,19 @@ module Aws::BedrockAgentRuntime
         o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
       end)
 
+      api.add_operation(:get_ingested_document_acl, Seahorse::Model::Operation.new.tap do |o|
+        o.name = "GetIngestedDocumentAcl"
+        o.http_method = "POST"
+        o.http_request_uri = "/knowledgebases/{knowledgeBaseId}/datasources/{dataSourceId}/get-ingested-document-acl"
+        o.input = Shapes::ShapeRef.new(shape: GetIngestedDocumentAclRequest)
+        o.output = Shapes::ShapeRef.new(shape: GetIngestedDocumentAclResponse)
+        o.errors << Shapes::ShapeRef.new(shape: ResourceNotFoundException)
+        o.errors << Shapes::ShapeRef.new(shape: ValidationException)
+        o.errors << Shapes::ShapeRef.new(shape: InternalServerException)
+        o.errors << Shapes::ShapeRef.new(shape: ThrottlingException)
+        o.errors << Shapes::ShapeRef.new(shape: AccessDeniedException)
+      end)
+
       api.add_operation(:get_invocation_step, Seahorse::Model::Operation.new.tap do |o|
         o.name = "GetInvocationStep"
         o.http_method = "POST"

data/lib/aws-sdk-bedrockagentruntime/types.rb

@@ -1469,6 +1469,50 @@ module Aws::BedrockAgentRuntime
       class Unknown < Caller; end
     end
 
+    # @!attribute [rw] data_source_id
+    #   The unique identifier of the data source that contains the document.
+    #   @return [String]
+    #
+    # @!attribute [rw] document_id
+    #   The unique identifier of the document to check access for.
+    #   @return [String]
+    #
+    # @!attribute [rw] knowledge_base_id
+    #   The unique identifier of the knowledge base that contains the
+    #   document.
+    #   @return [String]
+    #
+    # @!attribute [rw] user_context
+    #   The context object containing identity information for access
+    #   control filtering, including user ID and optional group memberships
+    #   used to evaluate the document access control list (ACL).
+    #   @return [Types::UserContext]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/CheckIngestedDocumentAclRequest AWS API Documentation
+    #
+    class CheckIngestedDocumentAclRequest < Struct.new(
+      :data_source_id,
+      :document_id,
+      :knowledge_base_id,
+      :user_context)
+      SENSITIVE = [:user_context]
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] has_access
+    #   Specifies whether the user has access to the document based on the
+    #   ingested access control list (ACL). Returns `true` if the user is
+    #   allowed access, and `false` otherwise.
+    #   @return [Boolean]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/CheckIngestedDocumentAclResponse AWS API Documentation
+    #
+    class CheckIngestedDocumentAclResponse < Struct.new(
+      :has_access)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # An object containing a segment of the generated response that is based
     # on a source in the knowledge base, alongside information about the
     # source.
@@ -2037,6 +2081,114 @@ module Aws::BedrockAgentRuntime
       include Aws::Structure
     end
 
+    # The access control list for a document, containing allow and deny
+    # membership lists. Each list specifies conditions that determine which
+    # users and groups are granted or denied access.
+    #
+    # @!attribute [rw] allow_list
+    #   The list of principals allowed access to the document.
+    #   @return [Types::DocumentAclMembership]
+    #
+    # @!attribute [rw] deny_list
+    #   The list of principals denied access to the document.
+    #   @return [Types::DocumentAclMembership]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/DocumentAcl AWS API Documentation
+    #
+    class DocumentAcl < Struct.new(
+      :allow_list,
+      :deny_list)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # A condition within a document access control list (ACL) membership,
+    # specifying users and groups that are evaluated together.
+    #
+    # @!attribute [rw] condition_operator
+    #   The logical operator for combining users and groups within this
+    #   condition. Valid values: `AND` – Both a user match and a group match
+    #   are required. `OR` – Either a user match or a group match is
+    #   sufficient.
+    #   @return [String]
+    #
+    # @!attribute [rw] groups
+    #   The list of group entries in this condition.
+    #   @return [Array<Types::DocumentAclGroup>]
+    #
+    # @!attribute [rw] users
+    #   The list of user entries in this condition.
+    #   @return [Array<Types::DocumentAclUser>]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/DocumentAclCondition AWS API Documentation
+    #
+    class DocumentAclCondition < Struct.new(
+      :condition_operator,
+      :groups,
+      :users)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # A group entry within a document access control list (ACL) condition.
+    #
+    # @!attribute [rw] id
+    #   The identifier of the group.
+    #   @return [String]
+    #
+    # @!attribute [rw] type
+    #   The membership type indicating the scope of the group entry.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/DocumentAclGroup AWS API Documentation
+    #
+    class DocumentAclGroup < Struct.new(
+      :id,
+      :type)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # The membership entry for a document access control list (ACL),
+    # containing conditions and their logical relation.
+    #
+    # @!attribute [rw] conditions
+    #   The list of conditions that determine membership.
+    #   @return [Array<Types::DocumentAclCondition>]
+    #
+    # @!attribute [rw] member_relation
+    #   The logical relation between conditions. Valid values: `AND` – All
+    #   conditions must match. `OR` – At least one condition must match.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/DocumentAclMembership AWS API Documentation
+    #
+    class DocumentAclMembership < Struct.new(
+      :conditions,
+      :member_relation)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # A user entry within a document access control list (ACL) condition.
+    #
+    # @!attribute [rw] id
+    #   The identifier of the user.
+    #   @return [String]
+    #
+    # @!attribute [rw] type
+    #   The membership type indicating the scope of the user entry.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/DocumentAclUser AWS API Documentation
+    #
+    class DocumentAclUser < Struct.new(
+      :id,
+      :type)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
     # @!attribute [rw] session_identifier
     #   The unique identifier for the session to end. You can specify either
     #   the session's `sessionId` or its Amazon Resource Name (ARN).
@@ -3710,10 +3862,9 @@ module Aws::BedrockAgentRuntime
     #   @return [String]
     #
     # @!attribute [rw] user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that results only include
+    #   documents the user is authorized to access.
     #   @return [Types::UserContext]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/GetDocumentContentRequest AWS API Documentation
@@ -3900,6 +4051,43 @@ module Aws::BedrockAgentRuntime
       include Aws::Structure
     end
 
+    # @!attribute [rw] data_source_id
+    #   The unique identifier of the data source that contains the document.
+    #   @return [String]
+    #
+    # @!attribute [rw] document_id
+    #   The unique identifier of the document to retrieve the ingested
+    #   access control list (ACL) for.
+    #   @return [String]
+    #
+    # @!attribute [rw] knowledge_base_id
+    #   The unique identifier of the knowledge base that contains the
+    #   document.
+    #   @return [String]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/GetIngestedDocumentAclRequest AWS API Documentation
+    #
+    class GetIngestedDocumentAclRequest < Struct.new(
+      :data_source_id,
+      :document_id,
+      :knowledge_base_id)
+      SENSITIVE = []
+      include Aws::Structure
+    end
+
+    # @!attribute [rw] document_acl
+    #   The ingested document access control list (ACL) containing allow and
+    #   deny membership information.
+    #   @return [Types::DocumentAcl]
+    #
+    # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/GetIngestedDocumentAclResponse AWS API Documentation
+    #
+    class GetIngestedDocumentAclResponse < Struct.new(
+      :document_acl)
+      SENSITIVE = [:document_acl]
+      include Aws::Structure
+    end
+
     # @!attribute [rw] invocation_identifier
     #   The unique identifier for the invocation in UUID format.
     #   @return [String]
@@ -6183,22 +6371,8 @@ module Aws::BedrockAgentRuntime
     # store configuration.
     #
     # @!attribute [rw] filter
-    #   Specifies the filters to use on the metadata attributes in the
-    #   knowledge base data sources before returning results. For more
-    #   information, see [Query configurations][1]. See the examples below
-    #   to see how to use these filters.
-    #
-    #   This data type is used in the following API operations:
-    #
-    #   * [Retrieve request][2] – in the `filter` field
-    #
-    #   * [RetrieveAndGenerate request][3] – in the `filter` field
-    #
-    #
-    #
-    #   [1]: https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-config.html
-    #   [2]: https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_Retrieve.html#API_agent-runtime_Retrieve_RequestSyntax
-    #   [3]: https://docs.aws.amazon.com/bedrock/latest/APIReference/API_agent-runtime_RetrieveAndGenerate.html#API_agent-runtime_RetrieveAndGenerate_RequestSyntax
+    #   Filters the metadata of the retrieved results so that Amazon Bedrock
+    #   returns only results that match the filter.
     #   @return [Types::RetrievalFilter]
     #
     # @!attribute [rw] number_of_results
@@ -8846,10 +9020,9 @@ module Aws::BedrockAgentRuntime
     #   @return [String]
     #
     # @!attribute [rw] user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that retrieval results only
+    #   include documents the user is authorized to access.
     #   @return [Types::UserContext]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/RetrieveAndGenerateRequest AWS API Documentation
@@ -8950,10 +9123,9 @@ module Aws::BedrockAgentRuntime
     #   @return [String]
     #
     # @!attribute [rw] user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that retrieval results only
+    #   include documents the user is authorized to access.
     #   @return [Types::UserContext]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/RetrieveAndGenerateStreamRequest AWS API Documentation
@@ -9013,10 +9185,9 @@ module Aws::BedrockAgentRuntime
     #   @return [Types::KnowledgeBaseQuery]
     #
     # @!attribute [rw] user_context
-    #   Contains information about the user making the request. Use this to
-    #   pass user identity information for access control filtering, so that
-    #   retrieval results only include documents the user is authorized to
-    #   access.
+    #   Contains information about the user making the request. This is used
+    #   for access control filtering to ensure that retrieval results only
+    #   include documents the user is authorized to access.
     #   @return [Types::UserContext]
     #
     # @see http://docs.aws.amazon.com/goto/WebAPI/bedrock-agent-runtime-2023-07-26/RetrieveRequest AWS API Documentation

data/lib/aws-sdk-bedrockagentruntime.rb

@@ -56,7 +56,7 @@ module Aws::BedrockAgentRuntime
   autoload :Endpoints, 'aws-sdk-bedrockagentruntime/endpoints'
   autoload :EventStreams, 'aws-sdk-bedrockagentruntime/event_streams'
 
-  GEM_VERSION = '1.78.0'
+  GEM_VERSION = '1.79.0'
 
 end
 

data/sig/client.rbs

@@ -144,6 +144,21 @@ module Aws
                                    ) ?{ (*untyped) -> void } -> _AgenticRetrieveStreamResponseSuccess
                                  | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) ?{ (*untyped) -> void } -> _AgenticRetrieveStreamResponseSuccess
 
+      interface _CheckIngestedDocumentAclResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::CheckIngestedDocumentAclResponse]
+        def has_access: () -> bool
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/BedrockAgentRuntime/Client.html#check_ingested_document_acl-instance_method
+      def check_ingested_document_acl: (
+                                         data_source_id: ::String,
+                                         document_id: ::String,
+                                         knowledge_base_id: ::String,
+                                         user_context: {
+                                           user_id: ::String
+                                         }
+                                       ) -> _CheckIngestedDocumentAclResponseSuccess
+                                     | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _CheckIngestedDocumentAclResponseSuccess
+
       interface _CreateInvocationResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::CreateInvocationResponse]
         def created_at: () -> ::Time
@@ -298,6 +313,18 @@ module Aws
                               ) -> _GetFlowExecutionResponseSuccess
                             | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetFlowExecutionResponseSuccess
 
+      interface _GetIngestedDocumentAclResponseSuccess
+        include ::Seahorse::Client::_ResponseSuccess[Types::GetIngestedDocumentAclResponse]
+        def document_acl: () -> Types::DocumentAcl
+      end
+      # https://docs.aws.amazon.com/sdk-for-ruby/v3/api/Aws/BedrockAgentRuntime/Client.html#get_ingested_document_acl-instance_method
+      def get_ingested_document_acl: (
+                                       data_source_id: ::String,
+                                       document_id: ::String,
+                                       knowledge_base_id: ::String
+                                     ) -> _GetIngestedDocumentAclResponseSuccess
+                                   | (Hash[Symbol, untyped] params, ?Hash[Symbol, untyped] options) -> _GetIngestedDocumentAclResponseSuccess
+
       interface _GetInvocationStepResponseSuccess
         include ::Seahorse::Client::_ResponseSuccess[Types::GetInvocationStepResponse]
         def invocation_step: () -> Types::InvocationStep

data/sig/types.rbs

@@ -421,6 +421,19 @@ module Aws::BedrockAgentRuntime
       end
     end
 
+    class CheckIngestedDocumentAclRequest
+      attr_accessor data_source_id: ::String
+      attr_accessor document_id: ::String
+      attr_accessor knowledge_base_id: ::String
+      attr_accessor user_context: Types::UserContext
+      SENSITIVE: [:user_context]
+    end
+
+    class CheckIngestedDocumentAclResponse
+      attr_accessor has_access: bool
+      SENSITIVE: []
+    end
+
     class Citation
       attr_accessor generated_response_part: Types::GeneratedResponsePart
       attr_accessor retrieved_references: ::Array[Types::RetrievedReference]
@@ -579,6 +592,37 @@ module Aws::BedrockAgentRuntime
       SENSITIVE: []
     end
 
+    class DocumentAcl
+      attr_accessor allow_list: Types::DocumentAclMembership
+      attr_accessor deny_list: Types::DocumentAclMembership
+      SENSITIVE: []
+    end
+
+    class DocumentAclCondition
+      attr_accessor condition_operator: ("AND" | "OR")
+      attr_accessor groups: ::Array[Types::DocumentAclGroup]
+      attr_accessor users: ::Array[Types::DocumentAclUser]
+      SENSITIVE: []
+    end
+
+    class DocumentAclGroup
+      attr_accessor id: ::String
+      attr_accessor type: ("KNOWLEDGE_BASE" | "DATA_SOURCE")
+      SENSITIVE: []
+    end
+
+    class DocumentAclMembership
+      attr_accessor conditions: ::Array[Types::DocumentAclCondition]
+      attr_accessor member_relation: ("AND" | "OR")
+      SENSITIVE: []
+    end
+
+    class DocumentAclUser
+      attr_accessor id: ::String
+      attr_accessor type: ("KNOWLEDGE_BASE" | "DATA_SOURCE")
+      SENSITIVE: []
+    end
+
     class EndSessionRequest
       attr_accessor session_identifier: ::String
       SENSITIVE: []
@@ -1096,6 +1140,18 @@ module Aws::BedrockAgentRuntime
       SENSITIVE: []
     end
 
+    class GetIngestedDocumentAclRequest
+      attr_accessor data_source_id: ::String
+      attr_accessor document_id: ::String
+      attr_accessor knowledge_base_id: ::String
+      SENSITIVE: []
+    end
+
+    class GetIngestedDocumentAclResponse
+      attr_accessor document_acl: Types::DocumentAcl
+      SENSITIVE: [:document_acl]
+    end
+
     class GetInvocationStepRequest
       attr_accessor invocation_identifier: ::String
       attr_accessor invocation_step_id: ::String

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: aws-sdk-bedrockagentruntime
 version: !ruby/object:Gem::Version
-  version: 1.78.0
+  version: 1.79.0
 platform: ruby
 authors:
 - Amazon Web Services