AWS Ends Support for New Salesforce Connectors on Customer-Managed Bedrock Knowledge Bases

Sales operations teams starting a Salesforce connection to Amazon Bedrock Knowledge Bases face a changed integration choice. Since September 30, 2026, AWS no longer supports creating new Salesforce connectors on customer-managed knowledge bases. Existing connectors can continue ingesting and retrieving data, AWS says.

The distinction matters when an AI assistant needs sales records. AWS lists Accounts, Contacts, Leads and Opportunities among the content types for the older connector. Its managed Salesforce connector documentation instead describes crawling Salesforce Knowledge articles, attachments and documents. Teams should establish which content they need before treating the managed connector as their new route.

The managed route and its access boundary

AWS announced the managed Salesforce connector on September 23. Setting it up requires a Salesforce External Client App, a dedicated Run-As integration user, credentials in AWS Secrets Manager and appropriate AWS permissions. The Run-As user’s permissions govern what the connector can crawl.

Query access deserves equal attention. AWS says the managed connector does not support document-level access-control lists: users permitted to query the knowledge base can access all crawled content. Its documentation for the older connector likewise warns that synced data can be available to principals with Bedrock retrieval permission even when access was controlled in Salesforce. Those rules make the scope of the Run-As user and knowledge-base query permissions central setup decisions.

What a new build can choose

For teams whose assistant needs Knowledge articles and documents, the managed native connector is a documented option. AWS lists managed-knowledge-base index storage at $5 per GB of raw data per month and standard retrieval at $1 per 1,000 API calls; other services can add charges.

For a new build that needs sales records such as leads or opportunities, AWS also documents custom-data-source ingestion. Using it for Salesforce records would require a separate implementation rather than the managed native connector. The immediate decision is which Salesforce content the assistant must retrieve—and who should be allowed to retrieve it.