AI 客栈
返回首页

AWS 发布 Denodo 语义层接入 AgentCore 教程：跨源查询与 PII 掩码在语义层执行

  • 核心内容：AWS Machine Learning Blog 发布教程，演示把 Denodo Platform 作为 Amazon Bedrock AgentCore 上 Strands agent 的语义层。Agent 通过 Denodo MCP Server 以 VQL 查询受治理视图，MCP Server 注册为 AgentCore Gateway target。
  • 身份与治理：AgentCore Identity 以 On-Behalf-Of token exchange 将终端用户身份传给 Denodo，Virtual DataPort 在查询时执行 Global Security Policies，对带 pii_sensitive 标签的列做掩码或按角色过滤。
  • 数据范围：示例将 Amazon Aurora、Amazon Redshift 与本地 PostgreSQL 联合为 customer 360 视图，由 Denodo 在查询时下推各源 SQL 并合并结果，不建立 ETL 或跨库物化表。
  • 部署选项：教程覆盖 Denodo Agora 全托管服务，以及在 Amazon EC2 或 Amazon EKS 上自管部署；语义对象以 base view、derived view 与 metric view 维护，并可通过 Data Marketplace 发布。
  • 行业意义：该教程把跨源 join、指标定义与行/列级访问策略放在语义层，而不是 agent 提示词或应用代码中；对需要让 Agent 访问受监管企业数据的团队，这提供了一条将权限校验与业务语义集中到数据层的参考路径。 🔗 AWS Machine Learning Blog
Figure 1. Inbound authentication path and outbound query path between the caller, Amazon Bedrock AgentCore components, the Denodo MCP Server, Denodo Virtual DataPort, and the three data sources.Figure 2. The customer_360 derived view in Denodo Design Studio. Four base views appear on the canvas across the three sources, joined on cid and location. The ssn column on aurora_customer and the card_num column on aurora_credit_card carry the pii_sensitive tag referenced by the Global Security PoFigure 3. The lifetime_customer_value metric view in Design Studio. The SOURCES panel shows customer_360, redshift_order, redshift_product, the DIMENSIONS panel shows customer_360 and product views, and the METRICS panel shows lifetime_spend as SUM(redshift_order.price * redshift_order.quantity) , oFigure 4. The query flow from the C360 agent to Amazon Aurora, Amazon Redshift, and on-premises PostgreSQL and back. VDP rewrites one VQL request against customer_360 joined with lifetime_customer_value into source-native SQL per engine, collects the intermediate result sets, and joins them on cid iFigure 5. customer_360 Graph View listing in the Denodo Data Marketplace. The detail panel shows a BI Tool in Tableau Consuming the view and the Glossary Definition linked to the view.Figure 6. Identity propagation and query flow from the user’s login through Amazon Bedrock AgentCore to Denodo (MCP Server and VDP) and the underlying data sources. Black arrows show the outbound identity and query path. Green dashed arrows show the return path with the filtered result set.