Build a semantic layer for agentic AI on AWS with AtScale and Amazon Bedrock AgentCore

Introduction

Creating a robust semantic layer is essential for turning scattered data into a unified, queryable view that both business intelligence tools and generative AI agents can trust. This guide walks you through building a dimensional semantic model with AtScale on AWS, exposing it via multiple protocols, and wiring it to an Amazon Bedrock AgentCore‑hosted Strands agent. By the end, you’ll have a production‑ready Customer 360 (C360) solution that leverages Amazon Redshift Serverless for analytics, Aurora PostgreSQL for operational data, and AtScale’s autonomous aggregate management to accelerate agent‑generated queries.

1. Modeling the C360 Domain in SML

AtScale uses the Semantic Modeling Language (SML) – a YAML‑based, Git‑versioned specification – to define datasets, dimensions, hierarchies, facts, measures, calculations, perspectives, and row‑level security.

• Datasets map directly to Redshift tables (e.g., `customer`, `purchase`, `product`).
• Dimensions such as `Customer`, `Product`, and `Date` group related attributes and include hierarchies (e.g., `Product → Category → Department`).
• Facts represent transactional tables like `purchase`; each fact is linked to dimensions via foreign keys (`cid`, `pid`).
• Measures are aggregations (e.g., `SUM(price * quantity)` for revenue). Calculated measures can express derived metrics such as `Average Order Value`.
• Perspectives expose subsets of the model to specific roles, enabling role‑based access control (RBAC).
• Row security policies filter rows based on the caller’s identity, ensuring that agents only see data they are authorized to access.

All SML files live in a Git repository, allowing version control, CI/CD pipelines, and collaborative editing.

2. Deploying AtScale on Amazon EKS

AtScale runs as a set of containers on Amazon Elastic Kubernetes Service (EKS). Use the official AtScale Helm chart and the AtScale K8s Blueprints repository to provision:

1. AtScale Server – hosts the query engine and SML model.
2. MCP (Model Context Protocol) Server – exposes the model over SQL, XMLA, and MCP.
3. Ingress – secures external access via TLS and integrates with AWS IAM OIDC for identity federation.

The Helm values file should reference the Redshift Serverless endpoint, Aurora credentials (via AWS Secrets Manager), and enable autonomous aggregate management. After deployment, verify connectivity by running a simple SQL query against the AtScale endpoint.

3. Connecting the AgentCore Strands Agent

Amazon Bedrock AgentCore provides a managed runtime for AI agents. To let the Strands agent query AtScale:

• Register the AtScale MCP server as a Data Source in the AgentCore Gateway configuration.
• Configure the agent’s outbound credentials to use an IAM role that can assume the AtScale service‑account role, enabling seamless SSO through AgentCore Identity.
• The foundation model (e.g., Anthropic Claude Sonnet) plans the query, while AgentCore injects the user’s identity token. AtScale then applies RBAC, row security, and perspective filters before executing the native Redshift SQL.

4. End‑to‑End Query Example

A typical business question – “Which of our top 20 customers by lifetime spend haven’t enrolled in the rewards program yet?” – demonstrates the full stack:

1. User issues the natural‑language request via a front‑end UI.
2. Claude Sonnet interprets intent and generates a logical query plan.
3. AgentCore forwards the plan to AtScale over MCP, attaching the user’s identity token.
4. AtScale resolves dimensions, applies joins, enforces row‑level security, and leverages autonomous aggregate management to materialize pre‑aggregated results where beneficial.
5. The final SQL runs in Redshift Serverless, returning a concise list of customers.

Because the semantic layer contains all join logic and metric definitions, the prompt remains simple and the agent’s output is consistent with existing BI tools.

5. Security and Governance

• Identity propagation: User authentication originates from the enterprise IdP, passes through AgentCore Identity, and arrives at AtScale where RBAC and row‑level filters are enforced.
• Auditability: All query requests are logged in CloudTrail and AtScale’s query‑audit tables, enabling compliance reporting.
• Data protection: Redshift Serverless encrypts data at rest; in‑transit traffic between AtScale, AgentCore, and the UI uses TLS.

Practical Close

By combining AtScale’s dimensional semantic modeling with Amazon Bedrock AgentCore’s managed AI runtime, you gain a unified, secure interface for both analysts and autonomous agents. The approach eliminates duplicated query logic, ensures consistent business definitions, and scales effortlessly on AWS. Deploy the model, register it with AgentCore, and let your agents start answering complex C360 questions—while your governance and performance teams sleep soundly.