Python: feat: add Amazon Bedrock Knowledge Base tool and context provider

python/packages/bedrock/AGENTS.md

@@ -8,6 +8,8 @@ Integration with AWS Bedrock for LLM inference.
 - **`BedrockChatOptions`** - Options TypedDict for Bedrock-specific parameters
 - **`BedrockGuardrailConfig`** - Configuration for Bedrock guardrails
 - **`BedrockSettings`** - Pydantic settings for Bedrock configuration
+- **`BedrockKnowledgeBaseTool`** - `FunctionTool` for retrieving from an Amazon Bedrock Knowledge Base (agentic retrieval with fallback to standard Retrieve)
+- **`BedrockKnowledgeBaseProvider`** - `ContextProvider` that injects Knowledge Base passages before each agent run
 
 ## Usage
 

python/packages/bedrock/BEDROCK_MANAGED_KB.md

@@ -0,0 +1,77 @@
+# Bedrock Managed Knowledge Base Support
+
+## Overview
+Adds an Agent Framework tool that queries Amazon Bedrock Knowledge Bases for managed retrieval within agent pipelines.
+
+## Usage
+```python
+from agent_framework import Agent
+from agent_framework_bedrock import BedrockKnowledgeBaseTool, BedrockChatClient, BedrockChatOptions
+
+tool = BedrockKnowledgeBaseTool(
+    knowledge_base_id="YOUR_KB_ID",
+    region_name="us-east-1",
+)
+
+# As a FunctionTool, pass directly to an Agent:
+agent = Agent(client=BedrockChatClient(model="..."), tools=[tool])
+
+# Or invoke directly for testing:
+import asyncio
+result = asyncio.run(tool.invoke(arguments={"query": "What are the compliance requirements?"}))
+print(result)  # List of Content items with retrieval results
+```
+
+## Configuration
+
+All configuration is via constructor parameters:
+
+| Parameter | Description | Default |
+|---|---|---|
+| `knowledge_base_id` | Bedrock Knowledge Base ID (required) | — |
+| `region_name` | AWS region for the KB | `us-east-1` |
+| `number_of_results` | Maximum retrieval results | `5` |
+| `use_agentic_retrieval` | Enable agentic multi-hop retrieval | `True` |
+| `client` | Pre-configured boto3 client (optional) | Auto-created |
+
+## Features
+- Managed search (no vector store needed)
+- **BedrockKnowledgeBaseTool**: Agentic retrieval with query decomposition + reranking, automatic fallback to standard Retrieve
+- **BedrockKnowledgeBaseProvider**: Standard managed retrieval injected as context before each agent run
+- Multi-source support (S3, Web, Confluence, SharePoint)
+- Compatible with Agent Framework FunctionTool and ContextProvider interfaces
+
+## SDK Requirements
+- boto3 >= 1.43.32
+
+## Required IAM Permissions
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "bedrock:Retrieve",
+        "bedrock:GetDocumentContent"
+      ],
+      "Resource": "arn:aws:bedrock:<region>:<account-id>:knowledge-base/<kb-id>"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "bedrock:AgenticRetrieveStream",
+        "bedrock:InvokeModelWithResponseStream"
+      ],
+      "Resource": "*"
+    }
+  ]
+}
+```
+
+> Note: `bedrock:AgenticRetrieveStream` and `bedrock:InvokeModelWithResponseStream` have no resource-level permission type, so they must be granted with `Resource: "*"`. Scoping `AgenticRetrieveStream` to a Knowledge Base ARN implicitly denies the call and silently forces a fallback to standard `Retrieve`, so the default tool never performs the advertised query decomposition. `bedrock:Retrieve` and `bedrock:GetDocumentContent` remain scoped to the Knowledge Base ARN — `GetDocumentContent` is required because agentic retrieval calls it during a `FullDocumentExpansion` step, and a policy without it fails partway through a query. This matches the [AWS agentic-retrieval permissions reference](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-agentic-retrieve.html). `AgenticRetrieveStream`/`GetDocumentContent`/`InvokeModelWithResponseStream` are only required when using `use_agentic_retrieval=True`.
+
+## References
+- [Build a Managed Knowledge Base](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-build-managed.html)
+- [Retrieve API](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-retrieve.html)
+- [Agentic Retrieval](https://docs.aws.amazon.com/bedrock/latest/userguide/kb-test-agentic.html)

python/packages/bedrock/README.md

@@ -17,3 +17,10 @@ See the [Bedrock sample](../../samples/02-agents/providers/amazon/bedrock_chat_c
 - Loads credentials from the `BEDROCK_*` environment variables
 - Instantiates `BedrockChatClient`
 - Sends a simple conversation turn and prints the response
+
+### Knowledge Base Examples
+
+For Amazon Bedrock managed Knowledge Base retrieval, see:
+
+- [`bedrock_kb_tool.py`](../../samples/02-agents/providers/amazon/bedrock_kb_tool.py) — `BedrockKnowledgeBaseTool` as a `FunctionTool` the agent calls on demand.
+- [`bedrock_kb_context_provider.py`](../../samples/02-agents/providers/amazon/bedrock_kb_context_provider.py) — `BedrockKnowledgeBaseProvider` as a `ContextProvider` that injects KB context automatically.

python/packages/bedrock/agent_framework_bedrock/__init__.py

@@ -4,6 +4,8 @@
 
 from ._chat_client import BedrockChatClient, BedrockChatOptions, BedrockGuardrailConfig, BedrockSettings
 from ._embedding_client import BedrockEmbeddingClient, BedrockEmbeddingOptions, BedrockEmbeddingSettings
+from ._knowledge_base import BedrockKnowledgeBaseTool
+from ._knowledge_base_provider import BedrockKnowledgeBaseProvider
 
 try:
     __version__ = importlib.metadata.version(__name__)
@@ -17,6 +19,8 @@
     "BedrockEmbeddingOptions",
     "BedrockEmbeddingSettings",
     "BedrockGuardrailConfig",
+    "BedrockKnowledgeBaseProvider",
+    "BedrockKnowledgeBaseTool",
     "BedrockSettings",
     "__version__",
 ]