Amazon Bedrock Web Search External Web Access (Aug 19, 2026): Keep Fetch Inside AWS or Go Live

AWS lifecycle notice (June 30, 2026) — Amazon Bedrock Agents Classic is in maintenance for new customers after July 30, 2026. Net-new agent builds should use Bedrock AgentCore. Full matrix: lifecycle roundup.

On August 19, 2026, AWS enabled live-web retrieval for Web Search on Amazon Bedrock. That is 15 days after the August 4 GA, when the pitch was an in-AWS index and zero data egress.

The switch is two controls that have to agree: the Responses API parameter external_web_access (default true, matching OpenAI) and the IAM action bedrock-websearch:ExternalWebAccess (still not on AmazonBedrockFullAccess). Leave the parameter omitted on an identity that lacks the permission and you get a 403 AccessDenied on the auth check that does not fail the request. The model answers anyway.

Set external_web_access: false on every call unless a named freshness lane is supposed to leave AWS.

Need the IAM split designed for a regulated Bedrock app? Get a Bedrock grounding review.

What actually changed on August 19

Web Search is still a server-side built-in tool. You add {"type": "web_search"} to a Responses API call on bedrock-mantle. Bedrock runs search and fetch. The model returns grounded text plus url_citation annotations. No third-party search vendor, no client-side tool loop.

Until August 19, both operations stayed inside AWS: Amazon’s web index (AWS: tens of billions of documents, refreshed continually) plus a knowledge graph, and a cache for fetch. The August 4 ML blog still said live-web retrieval would land in a future update and told you to pass false so existing code would not need to change later.

August 19 is that update, in three US Regions only: us-east-1, us-east-2, us-west-2. Queries, fetches, index data, and results do not route across Regions.

Supported models, unchanged:

Not on this tool: Claude, Nova, Llama, Mistral. Not on this path: bedrock-runtime, Converse, InvokeModel.

Two controls, four outcomes

flowchart TD
  req[Responses API call]
  param{external_web_access}
  iam{ExternalWebAccess IAM}
  inAws[In-AWS index and cache]
  live[Live public web]
  silent[403 on auth check request still succeeds]
  req --> param
  param -->|explicit false| inAws
  param -->|true or omitted| iam
  iam -->|granted| live
  iam -->|denied| silent
  silent --> inAws

We recommend: make false the application default. Deny bedrock-websearch:ExternalWebAccess on the org SCP / permission boundary. Grant live fetch only on a dedicated IAM role used by one named lane (live prices, same-day docs, sports scores — AWS’s own examples).

Trade-off you accept: Amazon’s index can lag a page that changed this morning. You keep prompts and query text from leaving AWS, and you avoid the exfiltration path AWS documents: an agent encoding query data into a URL, then fetching that URL from the public internet.

For PHI and clinical RAG, keep the in-boundary setting and the rest of the HIPAA Bedrock build. For Bedrock vs calling OpenAI directly, see Bedrock vs OpenAI API.

First-party pricing math (not a client silhouette)

No anonymized engagement is cited for this August 19 change. The numbers below are arithmetic on the published Bedrock rate card, checked on August 20, 2026.

Amazon Bedrock pricing, US East (Ohio): Web Search queries $12.00 per 1K queries. A query is one web search request, billed on top of model inference. Re-check Bedrock pricing for us-east-1 and us-west-2 before you lock a budget. Do not use AgentCore Gateway Web Search rates here — different SKU.

Illustrative month: 50,000 Web Search queries (one search per turn; AWS samples often show two retrieval steps per turn, so this is the low end).

*Assume 2,000 input tokens and 500 output tokens per turn, 50,000 turns, Luna on-demand after the July 30 cut ($0.22 / $1.32 per 1M). One token mix, labeled as math.

Direction: at this mix, Web Search dominates the Luna inference line. Cap searches per turn, do not attach the tool to every classification call, and measure $ per completed grounded answer, not $ per 1K tokens.

Reproduce this — Open the Bedrock pricing page, select the Web Search tab, set Region to US East (Ohio). Confirm the Web Search queries row. Multiply your expected search count (not user turns) by $12.00 / 1,000. For the IAM and API behavior, copy the policy and Python below, then run against bedrock-mantle in us-east-2 with an identity that does not have ExternalWebAccess. You should see a completed response plus an access-denied data event if CloudTrail data events are on. Docs: Web Search user guide and controlling external web access.

What broke: the 403 that still returns an answer

What broke — AWS-documented failure mode, not a named client. You port an OpenAI Responses client to bedrock-mantle, add tools=[{"type": "web_search"}], and ship it on a role with AmazonBedrockFullAccess. Default external_web_access is true. FullAccess does not include ExternalWebAccess. Detection: CloudTrail data events on bedrock-websearch (off by default; extra data-event charges apply) show AccessDeniedException with the condition key; the application log shows HTTP 200 and citations. Fix: set "external_web_access": false in application code, and deny ExternalWebAccess in IAM so a future SDK default cannot reopen the door.

Denying InvokeSearch alone does not disable the tool. Fetch still runs for any URL the model produces — including a URL in your prompt. To turn Web Search off, deny bedrock-websearch:*.

Codex on Bedrock (CLI 0.147.0+) already sets external_web_access to false. Match that in your own clients.

Keep it inside AWS (default this)

Context: OpenAI Python SDK against Bedrock Mantle in us-east-2. Mint a short-lived bearer token (up to 12 hours) from existing AWS credentials — an OpenAI platform API key will not work. Model ID from the Terra card; swap Luna/Sol by lane.

# openai>=1.x; aws-bedrock-token-generator; region us-east-2
from openai import OpenAI
from aws_bedrock_token_generator import provide_token

REGION = 'us-east-2'

client = OpenAI(
    base_url=f'https://bedrock-mantle.{REGION}.api.aws/openai/v1',
    api_key=provide_token(region=REGION),
)

response = client.responses.create(
    model='openai.gpt-5.6-terra',
    input='Summarize the current Amazon Bedrock Web Search user guide on external web access.',
    tools=[{'type': 'web_search', 'external_web_access': False}],
)

print(response.output_text)
for item in response.output:
    if item.type == 'message':
        for block in item.content:
            if block.type == 'output_text':
                for ann in block.annotations or []:
                    if ann.type == 'url_citation':
                        print(f'- {ann.title}: {ann.url}')

Least-privilege IAM for that identity — allow search/fetch, deny live web:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "WebSearchInAwsBoundary",
      "Effect": "Allow",
      "Action": ["bedrock-websearch:InvokeSearch", "bedrock-websearch:InvokeFetch"],
      "Resource": "*"
    },
    {
      "Sid": "DenyLiveWebFetch",
      "Effect": "Deny",
      "Action": "bedrock-websearch:ExternalWebAccess",
      "Resource": "*"
    }
  ]
}

Attach Mantle inference separately (AmazonBedrockMantleInferenceAccess or the equivalent actions). Do not treat AmazonBedrockFullAccess as “Web Search is fully locked down.”

Enable live web only on a named identity

Grant bedrock-websearch:ExternalWebAccess and pass "external_web_access": true only on a role that never sees PHI, secrets, or raw customer prompts you cannot leak. AWS’s examples for this path: latest sports scores, live pricing, newly released documentation.

# Same Mantle client as above. Live fetch: permission + explicit true.
response = client.responses.create(
    model='openai.gpt-5.6-terra',
    input='What is the list price for Bedrock Web Search queries in us-east-2 today?',
    tools=[{'type': 'web_search', 'external_web_access': True}],
)

If the freshness lane and the production chatbot share one role, you do not have a freshness lane. You have an egress path.

What to Do This Week

1. Grep every Responses client for web_search. If the tool object omits external_web_access, you are on the true default.
2. Set "external_web_access": false in application code for every existing lane. Deploy that before you grant any new IAM.
3. Confirm no role, permission set, or SCP allows bedrock-websearch:ExternalWebAccess. Add an explicit deny if you do not have a live-web use case.
4. Turn on CloudTrail data events for bedrock-websearch. Confirm you can see AccessDeniedException and the condition key. Query text is not in the trail — by design.
5. If a lane truly needs same-hour pages, create a dedicated role, grant ExternalWebAccess there only, and keep prompts on that role free of secrets.
6. Price the tool: count search requests, not chat turns, at $12.00 / 1K (Ohio list, August 20, 2026). Do not hang Web Search off high-QPS Luna classification.
7. If you are still wiring third-party search into Bedrock for GPT-on-Mantle, drop that vendor path for these five model IDs — then keep the in-boundary flag. Generative AI on AWS · Amazon Bedrock consulting · Get a Bedrock grounding review.

What This Post Doesn’t Cover

• A FactualMinds latency or citation-quality bakeoff of in-AWS index vs live fetch (no harness linked).
• AgentCore Gateway / MCP Web Search pricing and IAM. That is a different attachment point than this Responses tool.
• Claude, Nova, or Converse tool-use. This feature is Mantle + OpenAI GPT + Responses only.
• EU / non-US Regions. AWS lists three US Regions and says processing is strictly in-Region.
• Whether url_citation spans are enough for your legal display requirement — you must retain and show source citations to end users per AWS acceptable use.

Use the two controls. Default false. Opt in live web on purpose.

Related reading

• OpenAI GPT-5.6 Luna & Terra Price Cuts on Amazon Bedrock (July 2026)
• Amazon Bedrock + OpenAI Models, Codex & Managed Agents
• AWS Bedrock vs OpenAI API: Enterprise Decision Guide
• HIPAA-Compliant AI on AWS Bedrock
• Amazon Bedrock AgentCore in Production
• AWS Bedrock AI Agents and Agentic Workflows
• Generative AI on AWS · Amazon Bedrock services