# Bedrock AgentCore Cross-Account Memory: The 3-Step Handshake

Emily Patterson · August 31, 2026

> Bedrock AgentCore Cross-Account Memory: The 3-Step Handshake. A single percentage point separates architectural waste from operationa...

| Takeaway | Detail |
| --- | --- |
| Cross-account memory eliminates redundant vector stores | Resource-based policies grant external AWS principals direct access to AgentCore Memory without duplicating OpenSearch Serverless instances |
| Embedding-heavy workloads gain measurable latency efficiency | Historical-image metadata retrieval adds only tens of milliseconds per query while maintaining deterministic output consistency under 0.5% relative difference |
| Data plane operations require explicit IAM configuration | The three-step handshake mandates bedrock-agentcore:CreateEvent and bedrock-agentcore:GetEvent actions via resource-based policies for secure cross-account event delivery |
| Centralized analytics bypass account silos | Memory resources route cross-account event delivery to S3 buckets, SNS topics, and Kinesis Data Streams in separate accounts with zero relative difference below 0.5% |

A single percentage point separates architectural waste from operational efficiency. Deterministic comparators verify cross-framework output consistency, reporting zero relative difference below 0.5% between isolated and federated agent responses during smoke tests. Yet most engineering teams still duplicate Bedrock Knowledge Bases across every AWS account, citing cross-account IAM complexity as an insurmountable barrier.

That risk perception is a cost bug. Duplicating vector indexes triples your OpenSearch Serverless bill while fragmenting governance. The AgentCore pattern resolves this through a precise three-step handshake that routes embedding-heavy queries like historical-image metadata retrieval directly to governed data hosted in separate accounts. Resource-based policies replace restrictive trust boundaries, enabling secure cross-account memory access without custom vector store pipelines.

This architecture preserves clear workload separation while eliminating redundant infrastructure costs. By configuring explicit data plane permissions and leveraging unified control APIs, teams achieve sub-100-millisecond overhead per request. The result is a scalable, auditable memory layer that scales with organizational growth rather than against it.

![Bedrock AgentCore Cross-Account Memory](https://static.mm-ais.com/article-images-ai/bedrock-agentcore-cross-account-memory-t-ai-1257d8bf.jpg)

## The Three-Step Handshake

The Three-Step HandshakeCross-account memory access was officially announced on June 23, 2026, enabling resource-based policies to grant external AWS principals access to AgentCore Memory. This capability eliminates the need to duplicate knowledge bases across accounts, but it introduces a strict dependency chain: if any link in the handshake fails, the agent receives no data, and the failure mode is often opaque without precise diagnostics. The architecture requires three sequential configurations that must align perfectly.

**Step 1: Principal-Scoped Resource Policy.** In the data account, attach a resource-based policy directly to the Bedrock Knowledge Base ARN. This policy must explicitly allow bedrock:Retrieve and bedrock:RetrieveAndGenerate for the specific IAM role ARN of the agent account. Without this principal-scoped statement, the Knowledge Base rejects cross-account calls with an AccessDeniedException, even if the caller possesses full account-level permissions. According to dev.classmethod.jp (July 4, 2026), data plane API cross-account access also requires explicit configuration of the bedrock-agentcore:CreateEvent and bedrock-agentcore:GetEvent actions via these same resource-based policies; omitting these events breaks the event-driven retrieval loop required by the Gateway.

**Step 2: Gateway Target Registration.** In the agent account, register the Knowledge Base as a Gateway target through the AgentCore Gateway configuration, referencing the Knowledge Base ARN and region. This step ensures the agent's tool-calling layer resolves retrieval as a managed tool rather than requiring hand-rolled API plumbing. The declarative harness demonstrated in the open-source sample code (aws-samples/sample-for-strands-agentcore-connect-cross-account-kb) confirms that this registration binds the control plane to the remote data plane, allowing the agent to invoke retrieval without managing session tokens manually.

**Step 3: The AssumeRole Path.** The agent account's execution role must call sts:AssumeRole on a role residing in the data account. The trust policy of this data account role must name the agent role as a trusted principal, and the assumed role must carry the bedrock:Retrieve permission. The resulting session token is what the Gateway presents during retrieval. Crucially, both the trust policy AND the KB resource policy must name each other or the chain fails silently. If the trust policy allows the role but the resource policy restricts the principal, or vice versa, the request terminates at the boundary with no actionable error message.

Retrieval mechanics demand model consistency. The Knowledge Base must embed queries using the exact same model used at ingestion—for example, Amazon Titan Text Embeddings V2 at 1024 dimensions. A cross-account setup does not permit swapping embedding models between write-time and read-time without triggering a full re-ingestion of the dataset. Deterministic comparators verify output consistency across frameworks, reporting zero relative difference (

Canonical: https://colorizethis.io/blog/bedrock-agentcore-cross-account-memory-the-3-step-handshake.php
Markdown: https://colorizethis.io/blog/bedrock-agentcore-cross-account-memory-the-3-step-handshake.php/index.md