October 26, 2026

Building a governed semantic layer for agentic AI on AWS with Denodo and Amazon Bedrock AgentCore

← AI for Your Work

WebCrimp analysis and practical explanation. AI-assisted; reviewed before publication.

Quick Summary

This analysis explains how Denodo Platform provides a governed, live semantic layer over Amazon Aurora, Amazon Redshift, and on-premises PostgreSQL for an Amazon Bedrock AgentCore-hosted agent. It covers federated customer-360 views, VQL queries, Denodo MCP Server registration, identity on-behalf-of token exchange, and Global Security Policies for row and column filtering.

What Happened?

The article describes replacing a Stardog knowledge graph with Denodo Platform as the semantic layer behind a Strands agent on Amazon Bedrock AgentCore. The agent uses a foundation model to plan and write VQL queries against Denodo Virtual DataPort. Denodo federates live data from Aurora, Redshift, and an on-premises PostgreSQL database without ETL. The Denodo MCP Server exposes governed views through Model Context Protocol, registered as an AgentCore Gateway target. User identity flows from an enterprise IdP through AgentCore Identity On-Behalf-Of token exchange to Denodo, where Global Security Policies enforce row and column filters at query time.

Why It Matters

Agentic AI needs governed access to live enterprise data across hybrid and multi-cloud estates. By keeping joins, metric definitions, and access controls inside a semantic layer rather than the prompt, teams reduce data movement, enforce PII masking consistently, and let agents query distributed sources through a single contract. This pattern supports customer-360 use cases such as churn analysis and rewards auto-enrollment while maintaining auditability and least-privilege access.

Who Can Use It?

AI/ML · Data Analytics · Cloud · DevOps · Cybersecurity · Software Development · Operations · Management

How Can I Use This?

If you work in AI/ML, Data Analytics, Cloud, DevOps, Cybersecurity, Software Development, Operations, Management

  • Profession-specific actions: AI/ML engineers can design agent skills that generate VQL against Denodo instead of raw SQL across sources. Data analysts can define metric views such as lifetime_customer_value once and reuse them across agent prompts. Cloud architects can deploy Denodo on AWS Agora or self-manage on EC2/EKS and connect on-premises PostgreSQL through Denodo without moving data into a VPC. DevOps engineers can register the Denodo MCP Server as an AgentCore Gateway target and configure outbound credential exchange. Cybersecurity and operations teams can apply Global Security Policies tagged to pii_sensitive columns such as ssn and card_num to enforce row and column filters per caller. Management can govern metric definitions centrally so every consumer sees the same lifetime spend calculation. All workflow suggestions need verification against your environment and require human oversight.

AI Tip

Use Denodo Assistant natural-language authoring to draft a candidate VQL join between Aurora customer data and Redshift order history, then review and refine the generated VQL in Design Studio before saving it as a derived view.

AI Trick

Tag PII columns such as ssn and card_num with pii_sensitive at base-view creation time so a single Global Security Policy can mask or filter them for every derived view that references those base views, including agent-generated queries.

Example Workflow

  1. 1. Ingest base views for aurora_customer, aurora_address, aurora_credit_card, redshift_order, redshift_product, and postgres_rewards_account in Denodo Design Studio. 2. Mark cid as the primary key or join field and apply pii_sensitive tags to sensitive columns. 3. Create a derived customer_360 view joining sources on cid at query time. 4. Define a metric view lifetime_customer_value for reusable spend aggregation. 5. Register the Denodo MCP Server as an AgentCore Gateway target so the agent's tool calls route through Gateway. 6. Configure AgentCore Identity On-Behalf-Of token exchange to convert the inbound user JWT into a Denodo-scoped bearer token. 7. Apply Global Security Policies to enforce row and column filters at execution time. 8. Test the agent with a natural-language question such as 'Which top 20 customers by lifetime spend have not enrolled in rewards?' Verify all workflow steps in a non-production environment with human review before production use.

Copy This Prompt

You are a data agent with access to Denodo Virtual DataPort through VQL. The user asks: '{{user_question}}'. Use the semantic layer objects customer_360 and lifetime_customer_value. Do not invent joins outside Denodo. Return only the VQL query and a short explanation of which base views and sources it touches. Use placeholders: {{user_question}}, {{denodo_catalog}}, {{agent_role}}.

Recommended Tools

  • Amazon Bedrock AgentCore
  • Denodo Platform
  • Denodo MCP Server
  • Amazon Aurora
  • Amazon Redshift
  • PostgreSQL
  • Model Context Protocol
  • Identity Provider

Check official documentation, availability and pricing before using these suggestions.

Difficulty

Intermediate

Estimated Time Saved

Not measured; validate with your own workflow.

Source

AWS AI
Build a semantic layer for agentic AI on AWS with Denodo and Amazon Bedrock AgentCore
Original publication date: 2026-10-20T15:39:04+00:00