Bedrock Web Search ships with no published price and a silent 403 on external web access

Summary. AWS made Web Search on Amazon Bedrock generally available on 4 August 2026 in three US regions, and the announcement tells buyers to "visit the Amazon Bedrock pricing page for cost details." That page carries no price for Web Search — only the sentence "You are charged per query, where a query represents a single web search request." The only published figure sits on a different product's page: Web Search on Bedrock AgentCore is $7.00 per 1,000 queries. Against Google's $14 per 1,000 search queries for Gemini 3.x grounding and Microsoft's $14 per 1,000 transactions for Grounding with Bing Search, that looks cheap. The bigger problem is operational: external_web_access defaults to true, but the AmazonBedrockFullAccess managed policy does not grant bedrock-websearch:ExternalWebAccess. The request does not fail. The agent grounds on search results and silently fails every page fetch.

What shipped, and which product you are actually buying

There are two AWS products called Web Search, launched eight weeks apart, and they are not the same thing.

Web Search on Amazon Bedrock went GA on 4 August 2026. From the AWS announcement: "a built-in server side tool that performs web search entirely within AWS, enabling OpenAI models (GPT-5.4, GPT-5.5, and GPT-5.6 Sol/Terra/Luna) to ground responses with current web knowledge while maintaining data residency within your secured AWS environment with zero data egress." It is "generally available today in US East (N. Virginia), US East (Ohio), and US West (Oregon)."

Web Search on Bedrock AgentCore went GA on 16 June 2026 as an MCP gateway connector, per its own announcement, "generally available today in the AWS Region: US East (N. Virginia)."

The region lists have since diverged in a way neither announcement records. The AgentCore connector docs now list three regions: us-east-1, eu-west-1 and ap-northeast-1. The Bedrock version remains US-only. For a buyer in India or the EU who wants web grounding attached to GPT-5.6 on Bedrock, there is no in-region option at all as of 20 August 2026 — a real constraint if data residency was the reason you chose Bedrock in the first place.

One more binding detail from the Bedrock Web Search user guide: "Web Search is available for OpenAI GPT models served through the Amazon Bedrock bedrock-mantle endpoint, using the Responses API," and "Web Search is a server-side tool, so it isn't available when you call the Responses API on the bedrock-runtime endpoint." Calling the wrong endpoint is a silent no-tool, not an error.

The price AWS did not publish

The Bedrock pricing page renders in full. It is not a JavaScript shell — Guardrails is listed at $0.15 per 1,000 text units, Intelligent Prompt Routing at $1 per 1,000 requests, Knowledge Bases at $1.00 per 1,000 API calls. Every one of those carries a number.

Web Search gets two sentences and no figure. The August announcement points buyers at that page for cost details. The page does not contain the cost.

The only published number is on the AgentCore pricing page: "Web Search is priced at $7 per 1,000 queries," with a worked example showing "200,000 x $7/1K Queries = $1,400.00." Treat that as AgentCore's price. AWS has not stated that it applies to the Bedrock version.

Here is how the published prices compare, all taken from each vendor's own pricing page as of 20 August 2026:

Do not read that table as a straight ranking, because the units are not the same thing. Google's Gemini API pricing is explicit: "A customer-submitted request to Gemini may result in one or more queries to Google Search. You will be charged for each individual search query performed." The older Vertex tier billed the opposite way — one charge per grounding prompt no matter how many searches fired. Perplexity bills "per successful request, including a successful request with multiple queries."

That gives a crossover point worth knowing. Google's $35 per 1,000 prompts and $14 per 1,000 queries are equal at 2.5 searches per prompt. An agent that habitually fires four or five searches per user turn is more expensive on the newer, apparently cheaper pricing. The same trap applies to any comparison against Bedrock's "per query" wording once AWS publishes a number. We worked through the general version of this in our agent web search API cost comparison; the point here is that the unit, not the headline rate, decides the bill.

The 403 that does not look like a 403

This is the part that will cost teams a debugging afternoon.

The Bedrock user guide documents three IAM actions under the bedrock-websearch prefix. InvokeSearch issues a query and "Does not make outbound calls." InvokeFetch retrieves cached page content and "Does not make live outbound calls." ExternalWebAccess "Governs whether search and fetch may access the external web."

Then, verbatim from the same page:

"The external_web_access parameter defaults to true, matching the OpenAI Responses API so that your call does not have to change. The AmazonBedrockFullAccess policy grants the basic Web Search actions — bedrock-websearch:InvokeSearch and bedrock-websearch:InvokeFetch — but does not grant bedrock-websearch:ExternalWebAccess. As a result, a request that leaves external_web_access at true from an identity that does not hold ExternalWebAccess returns a 403 AccessDenied on the authorization check. The model does not fail the request: it grounds its answer in Search but fails all Fetch requests and reports that it could not obtain external web access."

Read that carefully. A role holding AWS's own full-access policy for Bedrock, calling with the documented default, gets an agent that returns plausible answers built only on search snippets, with every page fetch failing, and no exception anywhere in your application. Your logs look healthy. Your grounding quality is quietly worse than the demo.

Four managed policies exist to sort this out: AmazonBedrockWebSearchFullAccess, AmazonBedrockWebSearchReadOnly, AmazonBedrockExternalWebSearchFullAccess and AmazonBedrockExternalWebSearchReadOnly. The two you need are the External pair.

A second IAM subtlety from the Web Search security page undercuts the obvious workaround: "Fetch is not limited to URLs you supply, so if you intend to constrain the model to specific sources, restricting InvokeSearch alone does not achieve that." Locking down search does not lock down fetch.

AWS names the exfiltration risk itself

Vendors rarely write this plainly, so it is worth quoting in full from the user guide:

"Note that setting external_web_access to true introduces data exfiltration risk. An agent could encode query data into a URL and then attempt to fetch that URL from the external internet. When you work with sensitive data, set external_web_access to false to prevent data reaching the external internet."

That is the same channel as any outbound-fetch prompt-injection path: an attacker who can influence the model's context can also influence the URL it fetches, and a URL is a perfectly good place to put stolen data. The mitigation AWS gives is binary — turn external access off — which also removes the feature you bought. For agents touching regulated data, the honest reading is that external_web_access: false plus AWS's cached-content fetch is the safe configuration, and live web retrieval belongs on a separate, lower-trust agent. This is the same boundary problem covered in our notes on AI agent security and prompt-injection guardrails.

There is also a licensing constraint on the AgentCore connector that belongs in any build-versus-buy sheet: "You must retain and display the source citations and links provided with each Search Result... You may not use Web Search Tool to (a) extract, store, or reproduce content from Search Results in bulk, or (b) build or populate a competing index or database." If your plan was to cache results into your own retrieval index, that is out.

Quotas, and one gap

The AgentCore connector documents its limits precisely: the query string "Must be 200 characters or fewer"; maxResults has a "Valid range: 1-25. Defaults to 10"; domainFilter accepts include and exclude lists of "up to 100 domains per list," and those request-level filters need connector version 1.2.0 or later. The harness execution role needs bedrock-agentcore:InvokeGateway on the gateway ARN.

Neither AWS page publishes a rate limit or transactions-per-second figure for Bedrock Web Search. Microsoft does publish one for its competing service — "150 transactions per second / 1 Million transactions per day" on the Bing grounding pricing page. Treat the AWS number as unknown and load-test before you commit a launch date to it.

Neither product requires VPC or egress configuration, which is unusual and follows from retrieval happening inside AWS. That is the genuine advantage of the design and the reason the residency claim holds.

India-specific considerations

Web Search on Amazon Bedrock is not available in ap-south-1 as of 20 August 2026, and the AgentCore connector's Asia-Pacific region is Tokyo. Under the Digital Personal Data Protection Act 2023, sending user queries to a US region is a cross-border processing decision that needs to be recorded, and the "zero data egress" claim in the AWS announcement refers to egress from AWS, not to keeping data inside India. The user guide is clear that "Web Search is strictly regional. Each Region operates its own search and fetch tier, and queries, fetches, index data, and results are not routed across Regions" — which is a strong isolation guarantee, but only within whichever region you picked.

For Indian teams the practical sequence is: pick the region deliberately, record it, set external_web_access to false for anything touching personal data, and price the workload against a per-query assumption you have measured rather than the vendor's headline unit.

What to do before you ship

Confirm which of the two Web Search products you are using. If your call goes through the bedrock-mantle endpoint on the Responses API, it is the August one and it has no published price.

Attach AmazonBedrockExternalWebSearchFullAccess or its read-only variant, or explicitly set external_web_access to false. Do not leave the default in place with AmazonBedrockFullAccess and assume it works.

Add an assertion in your integration tests that at least one fetch succeeded. The silent-degradation mode is invisible without one.

Instrument searches per user turn before you model cost. Every vendor in the table above bills a different unit, and the ratio is what decides which one is cheapest for your traffic.

If the workload touches regulated data, treat live external fetch as a separate trust zone rather than a flag.

What is still unknown

AWS has not published a price for Web Search on Amazon Bedrock, a rate limit for it, or a date for expanding it beyond three US regions. The AgentCore connector's expansion from one region to three was never announced. Until the pricing page catches up with the launch, any cost model for this feature is an estimate borrowed from a different product.

FAQ

How eCorpIT can help

We size and instrument agent retrieval before it reaches production, which on this feature means proving that fetches actually succeed, measuring searches per user turn so the per-query unit maps to a real bill, and setting the external-access boundary deliberately rather than inheriting a default. Our cloud and AI engineering teams have run this on Bedrock AgentCore workloads, and we design data handling aligned with DPDP Act 2023 requirements where region choice is a cross-border decision. eCorpIT is CMMI Level 5, MSME Certified and ISO 27001:2022 certified. Reach our senior engineering team through /contact-us/.

References

1. AWS: Web Search on Amazon Bedrock is now generally available — 4 August 2026, models and regions.

1. AWS: Web Search on Amazon Bedrock AgentCore — 16 June 2026 launch.

1. Amazon Bedrock Web Search user guide — endpoint restriction, external_web_access default, the 403 behaviour, exfiltration note.

1. Amazon Bedrock Web Search security — IAM actions and managed policies.

1. AgentCore gateway web search connector — regions, quotas, domain filters.

1. Amazon Bedrock pricing — Guardrails, Prompt Routing and Knowledge Bases rates; no Web Search rate.

1. Amazon Bedrock AgentCore pricing — $7.00 per 1,000 queries and worked example.

1. Gemini API pricing — $14 per 1,000 search queries and per-query billing note.

1. Grounding with Bing Search pricing — $14 per 1,000 transactions, 150 TPS.

1. Brave Search API pricing — $5.00 per 1,000 requests.

1. Exa pricing — $7 per 1,000 search requests.

1. Tavily pricing — $0.008 per credit, one credit per basic search.

1. Perplexity Search API pricing — $5 per 1,000 requests, billed per request.

1. Ministry of Electronics and IT, Digital Personal Data Protection Act 2023 — cross-border processing obligations.

_Last updated: 20 August 2026._