Snowflake Cortex Agent + AWS Bedrock Knowledge Base via MCP

A reference architecture for cross-platform AI agent orchestration — connecting Snowflake Cortex Agents to AWS Bedrock Knowledge Bases using the Model Context Protocol (MCP).

This project demonstrates how to build a unified AI agent that queries data across both platforms in a single conversation, with the agent intelligently routing questions to the right data source.

Prerequisites

Snowflake

• Snowflake account with ACCOUNTADMIN role (or a role with CREATE DATABASE, CREATE AGENT, CREATE SEMANTIC VIEW privileges)
• A warehouse (XS is sufficient) — the scripts use DEMO_WH
• Cortex Agents enabled in your account (AI & ML > Agents should be visible in Snowsight)
• Cross-region inference enabled for model access:
  hljs language-sql

  Copy

  ALTER ACCOUNT SET CORTEX_ENABLED_CROSS_REGION = 'ANY_REGION';
  

AWS

• AWS account with access to us-east-1 region
• AWS CLI configured (aws configure) with credentials that have permissions to:
  • S3: CreateBucket, PutObject
  • Bedrock: CreateKnowledgeBase, Retrieve
  • Lambda: CreateFunction, UpdateFunctionCode
  • API Gateway: CreateApi, CreateRoute
  • Cognito: CreateUserPool, CreateUserPoolClient
  • IAM: CreateRole, PutRolePolicy
• Python 3.10+ with boto3 installed
• Amazon Bedrock model access enabled (Titan Embed Text v2 at minimum)

Local Development

• Python 3.10+
• Git
• SnowSQL CLI (or use Snowsight SQL worksheets to run the .sql files)
• pip for installing Python dependencies

Network

• Snowflake account must be able to reach AWS API Gateway endpoint (no network policy blocking outbound to *.execute-api.*.amazonaws.com)
• No VPN/firewall blocking Cognito hosted UI (*.auth.*.amazoncognito.com)

What This Demonstrates

Architecture

For detailed technical documentation including auth flows, MCP protocol details, security model, and latency characteristics, see diagrams/architecture.md.

         ┌─────────────────────────────────────────────────────────┐
         │        SNOWFLAKE CORTEX AGENT (Orchestrator)             │
         │        Model: auto | Budget: 60s                         │
         ├─────────────────────────────────────────────────────────┤
         │                                                         │
         │  ┌──────────────┐ ┌──────────────┐ ┌────────────────┐ │
         │  │ Cortex       │ │ Cortex       │ │ External MCP   │ │
         │  │ Analyst      │ │ Search       │ │ Server         │ │
         │  │ (text-to-SQL)│ │ (RAG)        │ │ (AWS Bedrock)  │ │
         │  └──────┬───────┘ └──────┬───────┘ └───────┬────────┘ │
         └─────────┼────────────────┼──────────────────┼───────────┘
                   │                │                   │
                   ▼                ▼                   ▼
         ┌──────────────┐  ┌──────────────┐   ┌────────────────────┐
         │ Semantic View │  │ Cortex Search│   │ AWS API Gateway    │
         │ (structured  │  │ Service      │   │ + Cognito (OAuth2) │
         │  tables)     │  │ (unstructured│   │        │           │
         └──────────────┘  │  documents)  │   │  Lambda MCP Server │
                           └──────────────┘   │  (implements MCP)  │
                                              │        │           │
                                              │  Bedrock Managed   │
                                              │  Knowledge Base    │
                                              │        │           │
                                              │  S3 Documents      │
                                              └────────────────────┘

The Integration Challenge

Snowflake External MCP Servers only support OAuth2 authentication. AWS Bedrock services use IAM/SigV4 authentication. These are fundamentally different auth systems:

• OAuth2: User-centric, token-based, cloud-agnostic standard
• SigV4/IAM: AWS-specific, request-signing, machine-to-machine

This project solves the gap with a Lambda function that:

1. Accepts OAuth2-authenticated requests (validated by API Gateway + Cognito)
2. Implements the MCP protocol (tools/list, tools/call)
3. Calls Bedrock KB Retrieve API using its IAM execution role
4. Returns results in MCP format back to Snowflake

Example Use Case: Supply Chain Manufacturing

The included example uses a manufacturing supply chain scenario to demonstrate the integration with realistic data:

The Cortex Agent orchestrates across all sources — a single question like "For suppliers with quality issues, what are the freight costs from their regions and have customers complained?" triggers the Analyst (structured query), Cortex Search (emails), AND the MCP tool (Bedrock KB) in one turn.

Setup Steps

Snowflake Side

# 1. Create database, tables, and synthetic data
snowsql -f snowflake/01_data_setup.sql

# 2. Create Cortex Search services (vector indexes for unstructured data)
snowsql -f snowflake/02_cortex_search.sql

# 3. Create Semantic View (schema for Cortex Analyst text-to-SQL)
snowsql -f snowflake/03_semantic_view.sql

# 4. Create Cortex Agent with Snowflake-native tools
snowsql -f snowflake/04_cortex_agent.sql

AWS Side

cd aws
pip install -r requirements.txt

# 5. Upload documents to S3 and create Bedrock Managed Knowledge Base
python setup_knowledge_base.py

# 6. Deploy Lambda MCP server + API Gateway + Cognito
python deploy_oauth_proxy.py --kb-id <KB_ID>

Connect the Platforms

# 7. Create External MCP Server in Snowflake pointing to Lambda
#    Edit 05_mcp_connection.sql with values from step 6, then:
snowsql -f snowflake/05_mcp_connection.sql

# 8. Authenticate in Snowflake CoWork
#    Go to agent > Connectors > Connect > Log in with Cognito credentials

Key Components

Snowflake Objects Created

AWS Resources Created

MCP Protocol Implementation

The Lambda implements these MCP methods:

Sample Questions

See the full list of 35 sample questions in the Sample Questions section below, organized by:

• Category A (15 questions): Snowflake-only — uses Cortex Analyst and/or Cortex Search
• Category B (10 questions): AWS-only — uses Bedrock KB via MCP
• Category C (10 questions): Cross-platform — orchestrates across both Snowflake and AWS

File Structure

├── README.md                           ← You are here
├── snowflake/
│   ├── 01_data_setup.sql              ← Database + tables + synthetic data
│   ├── 02_cortex_search.sql           ← Cortex Search services
│   ├── 03_semantic_view.sql           ← Semantic View for Cortex Analyst
│   ├── 04_cortex_agent.sql            ← Agent with Snowflake-native tools
│   └── 05_mcp_connection.sql          ← External MCP Server + ALTER AGENT
├── aws/
│   ├── requirements.txt
│   ├── setup_knowledge_base.py        ← S3 upload + Bedrock KB creation guide
│   ├── deploy_oauth_proxy.py          ← Lambda + API Gateway + Cognito deployment
│   ├── test_gateway.py                ← End-to-end MCP server test
│   ├── lambda/
│   │   └── mcp_proxy_handler.py       ← MCP server implementation
│   └── sample_documents/              ← Documents for Bedrock KB
│       ├── freight_costs/
│       ├── customer_returns/
│       └── compliance/
├── demo/
│   ├── requirements.txt
│   └── run_demo.py                    ← Agent REST API demo client
└── diagrams/
    └── architecture.md                ← Detailed technical architecture

Adapting to Your Use Case

This is a reference architecture. To adapt it to your domain:

1. Replace the Snowflake data — swap the supply chain tables with your own structured/unstructured data
2. Replace the S3 documents — upload your own documents to the Bedrock Knowledge Base
3. Update the Semantic View — model your tables' facts, dimensions, and metrics
4. Update the Agent instructions — change the orchestration routing rules for your tools
5. Keep the MCP bridge unchanged — the Lambda/API Gateway/Cognito infrastructure works for any Bedrock KB

The integration pattern (OAuth2 bridge between Snowflake and AWS) is domain-agnostic.

Sample Questions

Category A: Snowflake-Only (Cortex Analyst + Cortex Search)

Category B: AWS-Only (Bedrock Knowledge Base via MCP)

Category C: Cross-Platform Orchestration (Snowflake + AWS)