---
title: Amazon Bedrock Web Search External Web Access (Aug 19, 2026): Keep Fetch Inside AWS or Go Live
description: On August 19, 2026 AWS enabled live-web fetch for Bedrock Web Search in 3 US Regions. Default external_web_access is true; AmazonBedrockFullAccess still does not grant ExternalWebAccess — and the 403 does not fail the request.
url: https://www.factualminds.com/blog/amazon-bedrock-web-search-external-web-access-2026/
datePublished: 2026-08-20T00:00:00.000Z
dateModified: 2026-08-20T00:00:00.000Z
author: palaniappan-p
category: Generative AI
tags: bedrock, openai, web-search, iam, genai, security, foundation-models
---

# Amazon Bedrock Web Search External Web Access (Aug 19, 2026): Keep Fetch Inside AWS or Go Live

> On August 19, 2026 AWS enabled live-web fetch for Bedrock Web Search in 3 US Regions. Default external_web_access is true; AmazonBedrockFullAccess still does not grant ExternalWebAccess — and the 403 does not fail the request.

> **AWS lifecycle notice (June 30, 2026)** — Amazon Bedrock Agents Classic is in maintenance for new customers after **July 30, 2026**. Net-new agent builds should use [Bedrock AgentCore](/blog/amazon-bedrock-agentcore-production/). Full matrix: [lifecycle roundup](/blog/aws-service-lifecycle-updates-june-2026/).

On **August 19, 2026**, AWS [enabled live-web retrieval](https://aws.amazon.com/about-aws/whats-new/2026/08/amazon-bedrock-web-access-web-search/) for Web Search on Amazon Bedrock. That is **15 days** after the [August 4 GA](https://aws.amazon.com/about-aws/whats-new/2026/08/amazon-bedrock-web/), when the pitch was an in-AWS index and **zero data egress**.

The switch is two controls that have to agree: the Responses API parameter `external_web_access` (default **`true`**, matching OpenAI) and the IAM action `bedrock-websearch:ExternalWebAccess` (still **not** on `AmazonBedrockFullAccess`). Leave the parameter omitted on an identity that lacks the permission and you get a **403 AccessDenied on the auth check that does not fail the request**. The model answers anyway.

Set `external_web_access: false` on every call unless a named freshness lane is supposed to leave AWS.

Need the IAM split designed for a regulated Bedrock app? [Get a Bedrock grounding review](/contact-us/).

---

## What actually changed on August 19

Web Search is still a **server-side built-in tool**. You add `{"type": "web_search"}` to a Responses API call on **`bedrock-mantle`**. Bedrock runs search and fetch. The model returns grounded text plus `url_citation` annotations. No third-party search vendor, no client-side tool loop.

Until August 19, both operations stayed inside AWS: Amazon’s web index (AWS: tens of billions of documents, refreshed continually) plus a knowledge graph, and a cache for fetch. The August 4 ML blog still said live-web retrieval would land in a future update and told you to pass `false` so existing code would not need to change later.

August 19 is that update, in **three US Regions only**: `us-east-1`, `us-east-2`, `us-west-2`. Queries, fetches, index data, and results do **not** route across Regions.

Supported models, unchanged:

| Model ID               | Notes                      |
| ---------------------- | -------------------------- |
| `openai.gpt-5.4`       | Earlier GPT-5.4 on Mantle  |
| `openai.gpt-5.5`       | Earlier GPT-5.5 on Mantle  |
| `openai.gpt-5.6-luna`  | High-volume / routing tier |
| `openai.gpt-5.6-terra` | Everyday production        |
| `openai.gpt-5.6-sol`   | Flagship agentic           |

Not on this tool: Claude, Nova, Llama, Mistral. Not on this path: `bedrock-runtime`, Converse, `InvokeModel`.

---

## Two controls, four outcomes

```mermaid
flowchart TD
  req[Responses API call]
  param{external_web_access}
  iam{ExternalWebAccess IAM}
  inAws[In-AWS index and cache]
  live[Live public web]
  silent[403 on auth check request still succeeds]
  req --> param
  param -->|explicit false| inAws
  param -->|true or omitted| iam
  iam -->|granted| live
  iam -->|denied| silent
  silent --> inAws
```

| API param                       | IAM `ExternalWebAccess` | What retrieval does                                                                                         |
| ------------------------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------- |
| `false`                         | anything                | Index + cache only. Request data stays in the AWS boundary. No extra permission.                            |
| `true` (default if you omit it) | allowed                 | Search and fetch **may** hit the live web. Request data **may** leave AWS.                                  |
| `true` (default if you omit it) | denied                  | **403** on the live-fetch check. Request **succeeds**. Search still grounds. Fetch fails. Model reports it. |

**We recommend:** make `false` the application default. Deny `bedrock-websearch:ExternalWebAccess` on the org SCP / permission boundary. Grant live fetch only on a dedicated IAM role used by one named lane (live prices, same-day docs, sports scores — AWS’s own examples).

**Trade-off you accept:** Amazon’s index can lag a page that changed this morning. You keep prompts and query text from leaving AWS, and you avoid the exfiltration path AWS documents: an agent encoding query data into a URL, then fetching that URL from the public internet.

For PHI and clinical RAG, keep the in-boundary setting and the rest of the [HIPAA Bedrock build](/blog/hipaa-compliant-ai-aws-bedrock/). For Bedrock vs calling OpenAI directly, see [Bedrock vs OpenAI API](/blog/aws-bedrock-vs-openai-api-enterprise/).

---

## First-party pricing math (not a client silhouette)

No anonymized engagement is cited for this August 19 change. The numbers below are **arithmetic on the published Bedrock rate card**, checked on **August 20, 2026**.

Amazon Bedrock pricing, **US East (Ohio)**: **Web Search queries $12.00 per 1K queries**. A query is one web search request, billed **on top of** model inference. Re-check [Bedrock pricing](https://aws.amazon.com/bedrock/pricing/) for `us-east-1` and `us-west-2` before you lock a budget. Do not use AgentCore Gateway Web Search rates here — different SKU.

**Illustrative month:** 50,000 Web Search queries (one search per turn; AWS samples often show **two** retrieval steps per turn, so this is the low end).

| Line                     | Math                              | Monthly $ |
| ------------------------ | --------------------------------- | --------: |
| Web Search (Ohio list)   | 50 × $12.00                       |  **$600** |
| GPT-5.6 Luna inference\* | 100M in × $0.22 + 25M out × $1.32 |   **$55** |
| Search vs that Luna line | $600 / $55                        |  **~11×** |

\*Assume 2,000 input tokens and 500 output tokens per turn, 50,000 turns, [Luna on-demand after the July 30 cut](/blog/openai-gpt-5-6-luna-terra-bedrock-pricing-2026/) ($0.22 / $1.32 per 1M). One token mix, labeled as math.

**Direction:** at this mix, Web Search **dominates** the Luna inference line. Cap searches per turn, do not attach the tool to every classification call, and measure **$ per completed grounded answer**, not $ per 1K tokens.

> **Reproduce this** — Open the [Bedrock pricing](https://aws.amazon.com/bedrock/pricing/) page, select the **Web Search** tab, set Region to **US East (Ohio)**. Confirm the **Web Search queries** row. Multiply your expected search count (not user turns) by $12.00 / 1,000. For the IAM and API behavior, copy the policy and Python below, then run against `bedrock-mantle` in `us-east-2` with an identity that does **not** have `ExternalWebAccess`. You should see a completed response plus an access-denied data event if CloudTrail data events are on. Docs: [Web Search user guide](https://docs.aws.amazon.com/bedrock/latest/userguide/web-search.html) and [controlling external web access](https://docs.aws.amazon.com/bedrock/latest/userguide/web-search.html#web-search-controlling-external).

---

## What broke: the 403 that still returns an answer

> **What broke** — AWS-documented failure mode, not a named client. You port an OpenAI Responses client to `bedrock-mantle`, add `tools=[{"type": "web_search"}]`, and ship it on a role with `AmazonBedrockFullAccess`. Default `external_web_access` is `true`. FullAccess does not include `ExternalWebAccess`. **Detection:** CloudTrail data events on `bedrock-websearch` (off by default; extra data-event charges apply) show `AccessDeniedException` with the condition key; the application log shows HTTP 200 and citations. **Fix:** set `"external_web_access": false` in application code, and deny `ExternalWebAccess` in IAM so a future SDK default cannot reopen the door.

Denying `InvokeSearch` alone does **not** disable the tool. Fetch still runs for any URL the model produces — including a URL in your prompt. To turn Web Search off, deny `bedrock-websearch:*`.

Codex on Bedrock (CLI **0.147.0+**) already sets `external_web_access` to `false`. Match that in your own clients.

---

## Keep it inside AWS (default this)

Context: OpenAI Python SDK against Bedrock Mantle in `us-east-2`. Mint a short-lived bearer token (up to **12 hours**) from existing AWS credentials — an OpenAI platform API key will not work. Model ID from the [Terra card](https://docs.aws.amazon.com/bedrock/latest/userguide/web-search.html); swap Luna/Sol by lane.

```python
# openai>=1.x; aws-bedrock-token-generator; region us-east-2
from openai import OpenAI
from aws_bedrock_token_generator import provide_token

REGION = 'us-east-2'

client = OpenAI(
    base_url=f'https://bedrock-mantle.{REGION}.api.aws/openai/v1',
    api_key=provide_token(region=REGION),
)

response = client.responses.create(
    model='openai.gpt-5.6-terra',
    input='Summarize the current Amazon Bedrock Web Search user guide on external web access.',
    tools=[{'type': 'web_search', 'external_web_access': False}],
)

print(response.output_text)
for item in response.output:
    if item.type == 'message':
        for block in item.content:
            if block.type == 'output_text':
                for ann in block.annotations or []:
                    if ann.type == 'url_citation':
                        print(f'- {ann.title}: {ann.url}')
```

Least-privilege IAM for that identity — allow search/fetch, **deny** live web:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "WebSearchInAwsBoundary",
      "Effect": "Allow",
      "Action": ["bedrock-websearch:InvokeSearch", "bedrock-websearch:InvokeFetch"],
      "Resource": "*"
    },
    {
      "Sid": "DenyLiveWebFetch",
      "Effect": "Deny",
      "Action": "bedrock-websearch:ExternalWebAccess",
      "Resource": "*"
    }
  ]
}
```

Attach Mantle inference separately (`AmazonBedrockMantleInferenceAccess` or the equivalent actions). Do not treat `AmazonBedrockFullAccess` as “Web Search is fully locked down.”

---

## Enable live web only on a named identity

Grant `bedrock-websearch:ExternalWebAccess` **and** pass `"external_web_access": true` **only** on a role that never sees PHI, secrets, or raw customer prompts you cannot leak. AWS’s examples for this path: latest sports scores, live pricing, newly released documentation.

```python
# Same Mantle client as above. Live fetch: permission + explicit true.
response = client.responses.create(
    model='openai.gpt-5.6-terra',
    input='What is the list price for Bedrock Web Search queries in us-east-2 today?',
    tools=[{'type': 'web_search', 'external_web_access': True}],
)
```

If the freshness lane and the production chatbot share one role, you do not have a freshness lane. You have an egress path.

---

## What to Do This Week

1. Grep every Responses client for `web_search`. If the tool object omits `external_web_access`, you are on the **true** default.
2. Set `"external_web_access": false` in application code for every existing lane. Deploy that before you grant any new IAM.
3. Confirm no role, permission set, or SCP allows `bedrock-websearch:ExternalWebAccess`. Add an explicit deny if you do not have a live-web use case.
4. Turn on CloudTrail **data events** for `bedrock-websearch`. Confirm you can see `AccessDeniedException` and the condition key. Query text is **not** in the trail — by design.
5. If a lane truly needs same-hour pages, create a **dedicated** role, grant `ExternalWebAccess` there only, and keep prompts on that role free of secrets.
6. Price the tool: count **search requests**, not chat turns, at **$12.00 / 1K** (Ohio list, August 20, 2026). Do not hang Web Search off high-QPS Luna classification.
7. If you are still wiring third-party search into Bedrock for GPT-on-Mantle, drop that vendor path for these five model IDs — then keep the in-boundary flag. [Generative AI on AWS](/services/generative-ai-on-aws/) · [Amazon Bedrock consulting](/services/aws-bedrock/) · [Get a Bedrock grounding review](/contact-us/).

---

## What This Post Doesn't Cover

- A FactualMinds latency or citation-quality bakeoff of in-AWS index vs live fetch (no harness linked).
- AgentCore Gateway / MCP Web Search pricing and IAM. That is a different attachment point than this Responses tool.
- Claude, Nova, or Converse tool-use. This feature is Mantle + OpenAI GPT + Responses only.
- EU / non-US Regions. AWS lists three US Regions and says processing is strictly in-Region.
- Whether `url_citation` spans are enough for your legal display requirement — you must retain and show source citations to end users per AWS acceptable use.

Use the two controls. Default **false**. Opt in live web on purpose.

---

## Related reading

- [OpenAI GPT-5.6 Luna & Terra Price Cuts on Amazon Bedrock (July 2026)](/blog/openai-gpt-5-6-luna-terra-bedrock-pricing-2026/)
- [Amazon Bedrock + OpenAI Models, Codex & Managed Agents](/blog/amazon-bedrock-openai-models-codex-managed-agents/)
- [AWS Bedrock vs OpenAI API: Enterprise Decision Guide](/blog/aws-bedrock-vs-openai-api-enterprise/)
- [HIPAA-Compliant AI on AWS Bedrock](/blog/hipaa-compliant-ai-aws-bedrock/)
- [Amazon Bedrock AgentCore in Production](/blog/amazon-bedrock-agentcore-production/)
- [AWS Bedrock AI Agents and Agentic Workflows](/blog/aws-bedrock-ai-agents-agentic-workflows/)
- [Generative AI on AWS](/services/generative-ai-on-aws/) · [Amazon Bedrock services](/services/aws-bedrock/)

## FAQ

### What changed for Bedrock Web Search on August 19, 2026?
AWS enabled live retrieval from the public web. Grant bedrock-websearch:ExternalWebAccess to the request identity and leave external_web_access at its default of true. Search and fetch may then reach the live web. Set external_web_access to false to keep retrieval on Amazon’s in-AWS web index and cache with no request data leaving the AWS boundary. Available in us-east-1, us-east-2, and us-west-2.

### When should I NOT enable external_web_access?
Keep it false for any lane that handles PHI, payment data, customer prompts you treat as confidential, or agent tool loops that could encode query text into a URL. AWS documents that setting the parameter to true introduces data-exfiltration risk. Also keep it false if you only need citations from Amazon’s index and knowledge graph, or if your identity does not hold ExternalWebAccess — the OpenAI-compat default of true will 403 the live-fetch check.

### What could go wrong if I leave the default true without the IAM permission?
The authorization check returns 403 AccessDenied, but the request itself does not fail. Per the Bedrock user guide, the model grounds from Search, fails Fetch, and reports that it could not obtain external web access. Callers see a completed response with citations that look grounded. Freshness SLAs silently miss. Detect this in CloudTrail data events for bedrock-websearch, which log access-denied outcomes and the condition key that caused the denial.

### Does AmazonBedrockFullAccess grant live web fetch?
No. AmazonBedrockFullAccess, AmazonMantleFullAccess, AmazonBedrockLimitedAccess, and AmazonBedrockMantleInferenceAccess grant bedrock-websearch:InvokeSearch and InvokeFetch. They do not grant bedrock-websearch:ExternalWebAccess. Live web is an explicit opt-in on a dedicated identity, not a side effect of “full access.”

### Which models and API path support Web Search?
OpenAI GPT models on the bedrock-mantle endpoint via the Responses API only: openai.gpt-5.4, openai.gpt-5.5, and openai.gpt-5.6-sol, openai.gpt-5.6-terra, openai.gpt-5.6-luna. It is not available on bedrock-runtime, Converse, or InvokeModel. Claude, Nova, Llama, and Mistral on Bedrock are not on the supported list. Codex CLI 0.147.0 or later uses text-only Web Search and sets external_web_access to false on each request.

### How much does Bedrock Web Search cost?
As of August 20, 2026 the Amazon Bedrock pricing page lists Web Search queries at $12.00 per 1K queries in US East (Ohio). A query is a single web search request, billed on top of model inference. Re-check aws.amazon.com/bedrock/pricing/ for us-east-1 and us-west-2 before you budget. AgentCore Gateway Web Search is a separate SKU and is not this rate.

---

*Source: https://www.factualminds.com/blog/amazon-bedrock-web-search-external-web-access-2026/*