Accelerate Data Pipelines with Agentic Data Operations Platform (ADOP) on Amazon Bedrock

ADOP on Amazon Bedrock is now a GA‑level offering that lets data engineers compose LLM‑augmented transformations while the platform enforces least‑privilege cross‑cloud access.

Production‑ready patterns
- Define an AWS IAM role adop-exec-role with sts:AssumeRole only for the Bedrock service principal (bedrock.amazonaws.com). Attach a policy that grants bedrock:InvokeModel and s3:GetObject/s3:PutObject on the specific data bucket. Example (Terraform):

resource "aws_iam_role" "adop_exec" {
  name = "adop-exec-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17",
    Statement = [{
      Effect = "Allow",
      Principal = { Service = "bedrock.amazonaws.com" },
      Action = "sts:AssumeRole"
    }]
  })
}

resource "aws_iam_policy" "adop_policy" {
  name   = "adop-exec-policy"
  policy = jsonencode({
    Version = "2012-10-17",
    Statement = [
      { Effect = "Allow", Action = ["bedrock:InvokeModel"], Resource = "*" },
      { Effect = "Allow", Action = ["s3:GetObject","s3:PutObject"], Resource = "arn:aws:s3:::my-data-pipeline/*" }
    ]
  })
}

resource "aws_iam_role_policy_attachment" "attach" {
  role       = aws_iam_role.adop_exec.name
  policy_arn = aws_iam_policy.adop_policy.arn
}

- In GCP, create a Service Account adop-gcp-sa and grant roles/iam.serviceAccountTokenCreator only to the AWS IAM role via workload identity federation. The binding looks like:

bindings:
- members:
  - principal://iam.amazonaws.com/role/arn:aws:iam::123456789012:role/adop-exec-role
  role: roles/iam.serviceAccountTokenCreator

- ADOP pipelines invoke Bedrock models using the AWS SDK with an assumed role:

import boto3
sts = boto3.client('sts')
creds = sts.assume_role(RoleArn='arn:aws:iam::123456789012:role/adop-exec-role', RoleSessionName='adop')
bedrock = boto3.client('bedrock-runtime',
    aws_access_key_id=creds['Credentials']['AccessKeyId'],
    aws_secret_access_key=creds['Credentials']['SecretAccessKey'],
    aws_session_token=creds['Credentials']['SessionToken'])
response = bedrock.invoke_model(body=b'{}', modelId='anthropic.claude-v2')

Recent changes
- Bedrock added native support for aws:PrincipalTag conditions in 2025, allowing ADOP to tag the assumed role with pipeline=etl and enforce tag‑based IAM policies.
- GCP’s workload identity federation now accepts OIDC tokens signed by AWS STS, removing the need for long‑lived GCP keys.

Adoption guidance
- Use ADOP when pipelines need LLM‑driven data enrichment and you already have S3 and GCS as storage layers.
- Avoid if latency‑sensitive steps dominate; Bedrock model latency adds ~200‑400 ms per call, which can dominate high‑frequency micro‑batches.

Gotcha
Cross‑cloud token exchange expires after 1 hour; if a pipeline runs longer, you must refresh the STS credentials inside the job, otherwise the GCP Service Account token will be rejected and the step fails.