Quick verdict
This is not a beauty contest between “Bedrock” and “LangChain.” It is an ownership decision. Short version:
- Ship grounded answers fast, standard connectors, minimal ops: Bedrock Managed Knowledge Base — AWS owns ingestion, storage, indexing, and much of retrieval optimization.
- Need Bedrock orchestration but keep your vector DB / index schema: Customer-managed Knowledge Base (you provision OpenSearch Serverless, Aurora pgvector, Neptune Analytics, etc.).
- Exotic retrieval, multi-cloud vectors, heavy custom ranking, or non-Bedrock model routing: DIY / custom RAG — you own chunking, embeddings, store, retriever, and eval harness.
- AU/SG regulated default: start Managed KB in the customer account/Region if connectors fit; graduate to customer-managed or DIY when audit, ACL fidelity, or retrieval quality requires control you can defend.
Cipher’s first-hand rule: do not DIY RAG to feel senior. DIY when you have a measured failure mode Managed KB cannot fix (permissions model, hybrid search quality, multi-tenant isolation, or non-Bedrock runtime).
Last updated: July 2026. Feature names and pricing move — verify AWS Knowledge Bases docs and Bedrock pricing.
Three paths, not two
AWS documentation now distinguishes Managed Knowledge Bases from customer-managed Knowledge Bases. Custom RAG outside Bedrock is the third path teams still need.
| Managed KB | Customer-managed KB | Custom / DIY RAG | |
|---|---|---|---|
| Who owns the vector store? | AWS-managed datastore | You (OpenSearch, Aurora, Neptune, …) | You (any store, any cloud) |
| Ingestion / connectors | Native connectors (S3, SharePoint, Confluence, and more — check current list) | More DIY around how data reaches your store | Fully yours |
| Embeddings / rerank | Managed models often included; optional custom Bedrock models | You choose Bedrock embedding/rerank wiring | Any model/provider you integrate |
| Retrieval modes | Semantic / hybrid; agentic retrieval supported on managed path | Your search strategy on your store | Whatever you build (HyDE, graph, multi-index, …) |
| Ops burden | Lowest | Medium (you run the DB) | Highest |
| Best for | Standard enterprise docs → agents/apps on Bedrock | Existing vector infra + Bedrock API surface | Differentiated retrieval or multi-runtime stacks |
What Managed Knowledge Bases actually buy you
Managed KB collapses the usual RAG choreography: parse → chunk → embed → index → retrieve → (optional) rerank. AWS has also published managed multimodal parsing and agentic (multi-hop) retrieval modes. Pricing shape for managed offerings has included storage (e.g. published figures around $5/GB raw data/month for managed index storage) and retrieve API charges (e.g. standard retrieve around $1 per 1,000 calls, higher for agentic retrieve), with managed embedding/rerank sometimes at $0 when using service-managed models. Treat every figure as directional and re-check the rate card.
Choose Managed KB if your corpus lives in supported connectors, you want agents on Bedrock/AgentCore grounded quickly, and you do not have a compliance reason to operate the vector layer yourself.
Customer-managed KB: keep the store, keep Bedrock’s API
Customer-managed Knowledge Bases let you point Bedrock at a vector store you provision and tune. You regain index schema, capacity, and direct access to the data layer. You lose some of the “zero infrastructure” benefits and often some managed-only retrieval features (confirm current matrix in AWS docs — agentic retrieval has been called out as managed-path oriented).
Choose customer-managed KB if you already run OpenSearch Serverless or Aurora pgvector well, need index-level control, or must prove where embeddings live for an audit — but still want Bedrock Retrieve APIs and agent integrations.
Custom RAG: when Cipher actually recommends it
Build outside (or beside) Knowledge Bases when:
- Retrieval quality plateaus after good chunking and Hybrid search on KB, and you need graph RAG, multi-corpus fusion, or domain-specific rankers.
- The serving path is not Bedrock-centric (for example agents on another runtime that already own a vector pipeline).
- Multi-tenant isolation needs row-level or collection-level controls that your compliance team will not accept as “managed black box.”
- You must keep a portable vector layer across clouds or on-prem.
For vector store selection inside a custom path, see Pinecone vs Weaviate vs Qdrant (2026).
Cost and failure modes (the cutover Cipher uses)
| Signal | Stay on Managed KB | Move to customer-managed / DIY |
|---|---|---|
| Time-to-first grounded demo | Days | Weeks+ |
| Ops headcount | App team can own it | Needs platform/DB ownership |
| Eval score stuck | Tune chunking, metadata filters, rerank | Custom retriever or store when tuning plateaus |
| ACL / tenancy | Metadata filters + IAM often enough | Hard multi-tenant boundaries → own the index |
| Bill shape | Storage + retrieve + model tokens | DB + embedding pipeline + model tokens (+ eng time) |
Cipher cutover: ship Managed KB with an eval harness (golden questions, citation checks, refusal tests). If after two serious tuning cycles you still fail the harness for structural reasons — not prompt fluff — then open the customer-managed or DIY path with a written ownership plan.
Security and AU/SG notes
Keep Knowledge Bases and source buckets in the customer account. Prefer customer-managed KMS keys when policy requires it. Decide whether raw documents, embeddings, and logs may leave the Region. Pair retrieval with Guardrails budgeting so grounded answers are also policy-filtered.
Related: Private AI on AWS Bedrock · AgentCore pricing · Applied AI Engineering
FAQ
Is Managed Knowledge Base “real RAG”? Yes. It is managed RAG. The trade-off is control, not legitimacy.
Can I bring Pinecone or Weaviate into Bedrock KB? Support matrices change; historically Bedrock KB vector options centered on AWS stores (OpenSearch Serverless, Aurora, Neptune, and managed paths). For third-party stores, teams often run custom RAG and call Bedrock only for generation. Verify current AWS docs before committing.
Does KB pricing include the LLM answer? No. Retrieve/storage meters are separate from foundation model tokens used to generate the final answer.
When should a mid-size AU company DIY? When Managed KB fails a written eval/ACL requirement after good-faith tuning — not on day one for prestige.
Who builds either path in production? Cipher Projects implements Managed KB, customer-managed KB, and custom RAG for Australian and Singapore teams, with eval harnesses and client-owned AWS accounts.
Conclusion
Pick the RAG path by ownership and failure mode, not by blog hype. Managed Knowledge Bases win speed and ops simplicity. Customer-managed KB wins store control with Bedrock APIs. Custom RAG wins when retrieval itself is the product. Start managed, measure, then earn the right to operate more surface area.