Amazon Bedrock Data Automation is now coupled with the Model Context Protocol (MCP) to turn raw evidence files stored in Amazon S3 into searchable, structured insights that surface directly inside Salesforce Agentforce. The change adds an event‑driven processing pipeline and a serverless MCP endpoint, allowing users to ask natural‑language questions about video, audio, image, or document evidence without leaving the Salesforce console.
Bedrock Data Automation pipeline
When a file lands in the S3 bucket used by the Agentforce external‑storage connector, an S3 event triggers a Lambda function. This function creates a unique document identifier, writes metadata to a DynamoDB table, and starts a Bedrock Data Automation job for the file. The job extracts media‑type‑specific insights—text and key fields for documents, object descriptions for images, and transcriptions plus scene summaries for video/audio. Upon completion, an EventBridge rule launches a second Lambda that writes the result payload to a dedicated output bucket.
Agentforce query path via MCP
A user’s chat in Agentforce invokes a configured action that sends an MCP request to AWS. The request passes through the Bedrock AgentCore Gateway, which authenticates the call and forwards it to an MCP server running on Lambda. That Lambda looks up the document identifier in DynamoDB, fetches the corresponding result file from the output bucket, and returns the data through the Gateway back to Agentforce, where it is injected into the agent’s context for a natural‑language response.
Implementation and operational implications
- Event‑driven architecture: The use of S3 event notifications, Lambda, and EventBridge decouples ingestion from processing, enabling horizontal scaling and independent failure domains.
- State tracking: DynamoDB stores document IDs and metadata, providing a lightweight index for downstream lookup without requiring a separate catalog service.
- Modular processing: Bedrock Data Automation jobs are configured per media type, so adding new extraction capabilities only requires updating the job definition in the console.
- Serverless cost model: All compute components (two Lambdas, EventBridge rule) run only on demand, aligning cost with evidence volume.
- Observability: Each Lambda can emit CloudWatch metrics and logs; EventBridge rules can be monitored for success/failure rates, giving operators visibility into pipeline health.
Security considerations
The integration relies on the Bedrock AgentCore Gateway to authenticate MCP calls from Agentforce. Practitioners should verify that the gateway’s authentication configuration aligns with their organization’s identity model and that IAM policies for the Lambda functions grant only the required S3, DynamoDB, and Bedrock permissions. Because the pipeline moves potentially sensitive evidence through multiple services, encryption at rest (S3, DynamoDB) and in transit (HTTPS for MCP) remains essential, though the source does not detail specific controls.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Engineers can now replace manual evidence review with an automated, serverless workflow that delivers structured insights back to a familiar SaaS UI. The pattern demonstrates how to combine Bedrock Data Automation with MCP to expose AI‑generated data without building a custom front end. When adopting, evaluate the Lambda execution time limits against expected file sizes, confirm DynamoDB throughput matches ingestion rates, and test the AgentCore Gateway authentication flow to ensure only authorized Agentforce instances can query the pipeline.
