Engineering teams connecting enterprise files to Amazon Bedrock retrieval-augmented generation workloads face an immediate trade-off between setup speed and access security. Under three updates announced by AWS on September 4, 2026, the service added a native ServiceNow connector, user-managed three-legged OAuth (3LO) setup for third-party tools, and built-in recurring sync schedules. However, AWS documentation specifies that neither the new ServiceNow connector nor the simplified 3LO workflows enforce document-level access control lists (ACLs).

For architectures where granular permissions matter, this design alters data boundaries. Content crawled through the ServiceNow connector inherits the scope of a single dedicated service account, meaning any user permitted to query the knowledge base can retrieve the content crawled through that account. Similarly, content indexed via the new user-managed 3LO path for Microsoft SharePoint, Microsoft OneDrive, and Atlassian Confluence Cloud does not retain per-user source permissions.

When document-level enforcement is mandatory, AWS documents alternative authentication mechanisms: Microsoft Entra application authentication for SharePoint and OneDrive, and Basic authentication for Confluence Cloud. Teams must also account for connector limits, as OneDrive integrations exclude OneNote notebooks and Confluence support is restricted to Confluence Cloud rather than Server or Data Center releases.

The updates simplify document ingestion and add native sync scheduling:

  • ServiceNow ingestion: Uses OAuth 2.0 Client Credentials (2LO) to index service catalog items, knowledge articles, and attachments, running incremental syncs thereafter.
  • Console-managed OAuth (`3LO`): Allows administrators to authenticate directly with SharePoint, OneDrive, or Confluence Cloud from the console. Bedrock saves credentials in AWS Secrets Manager, requiring IAM permissions for the user principal to run the flow and create the secret, plus execution-role permissions to refresh tokens.
  • Native schedule automation: Replaces custom scheduling scripts with configurable daily, weekly, or monthly crawl intervals that track additions, modifications, and deletions.