Introducing Internet Search on Amazon Bedrock for basis mannequin grounding

August 5, 2026

3

When a basis mannequin must reply a query about final week’s earnings name, yesterday’s regulatory change, or this morning’s climate forecast, it wants data it was by no means educated on. Grounding the mannequin in present internet data closes that hole – whether or not it’s powering chatbots, coding assistants, CLI instruments, or enterprise purposes, grounding helps reply questions past the mannequin’s coaching and reduces hallucinations. Historically, connecting a mannequin to internet data required builders to determine, combine, and keep a third-party Internet Search supplier, a course of that delays challenge timelines and introduces information residency dangers and operational overhead.

At AWS New York Summit 2026, we introduced the common availability of Internet Search on AgentCore. Right this moment, we’re extending it additional with the final availability of Internet Search on Amazon Bedrock. It’s a server-side built-in software that grounds mannequin responses in present internet data. With Internet Search, grounding turns into a local functionality of Amazon Bedrock, with no third-party distributors to onboard, no exterior APIs to orchestrate, and no further third celebration vendor safety opinions to conduct.

On this put up, we stroll by way of what Internet Search on Amazon Bedrock is, why it issues, learn how to allow it utilizing the OpenAI Responses API, and learn how to get began with the software.

What Internet Search on Amazon Bedrock gives

Internet Search is designed for Amazon Bedrock mannequin inference, with the next differentiators:

Multi-source grounding method: Internet Search is backed by an online index that Amazon operates, spanning billions of paperwork and refreshed frequently. It combines this index with a built-in data graph that anchors the entities in a website together with the connections between them. When a query is factual in nature; say, who wrote a specific guide or what yr an occasion happened; Internet Search makes use of the data graph to reply with sturdy confidence, reasonably than leaving the mannequin to deduce the reply from extracted web page textual content. That may assist reduce down on the small factual inaccuracies that have a tendency to slide in every time an agent assembles a solution from fragments by itself.

Context-efficient retrieval. Relatively than handing the mannequin a uncooked web page and hoping it finds the related half, Internet Search performs semantic snippet extraction – pulling the passages from every internet web page that bear on the question and returning them in a type optimized for the mannequin’s context window. The mannequin sees the elements that matter, with fewer tokens spent on boilerplate. Retrieval is quick, so grounded responses could be delivered with minimal latency.

Single-parameter enablement. Internet Search turns into a single parameter in your present OpenAI-compatible API name, eradicating the necessity for vendor onboarding, API keys, orchestration layers, and separate SDKs.

Serving to with enterprise-grade compliance out of the field. By default, Internet Search on Bedrock affords zero information egress, so your information by no means leaves your AWS atmosphere. As we introduce new capabilities, some future options could expose information solely at your specific request. For the newest data, please check with the Amazon Bedrock documentation . Internet Search operates completely inside Amazon Bedrock’s infrastructure, supporting clients’ compliance necessities.

The way it works

When Internet Search is enabled in an API name, Bedrock handles the whole search lifecycle server-side. First, the mannequin identifies {that a} question requires up-to-date internet data. Bedrock then formulates a search question, retrieves related content material from Amazon’s internet index and data graph, and injects outcomes – together with related snippets, supply URLs and titles – into the mannequin’s context window. The mannequin causes over the retrieved content material and generates a grounded response with supply citations. The API returns the ultimate response with structured quotation annotations, together with URL and web page title for every referenced supply. There’s no client-side tool-use loop to construct, no exterior API responses to parse, and no retries or charge limits to handle – a single API name returns a grounded response.

Getting began with the OpenAI Responses API

The Responses API helps built-in instruments natively, so Internet Search could be known as with out defining a operate schema or constructing a client-side loop. Enablement takes three steps: configure AWS credentials, level the OpenAI consumer on the bedrock-mantle endpoint, and add the Internet Search software to the request. At launch, Internet Search is offered for OpenAI fashions served by way of Amazon Bedrock’s next-generation inference engine.

Step 1: Configure authentication and permissions. Internet Search makes use of your present AWS credentials – there are not any separate API keys to provision. The atmosphere should have AWS credentials obtainable by way of the usual credential chain (an IAM position, the AWS CLI profile, or atmosphere variables), that are used to authenticate requests to the bedrock-mantle endpoint. The calling identification wants two units of permissions:

Inference permissions on Amazon Bedrock, so the mannequin name itself succeeds. Connect the AmazonBedrockMantleInferenceAccess managed coverage, or grant the particular inference actions your name requires.
Internet Search software permissions, so the mannequin can name the software through the request. At minimal grant bedrock-websearch:InvokeSearch; add bedrock-websearch:InvokeFetch to let the mannequin learn a consequence’s full web page content material. Dwell-web retrieval moreover requires bedrock-websearch:ExternalWebAccess, which is the default request conduct — in case your identification doesn’t have it, set external_web_access: false on the software. If InvokeSearch is denied, Internet Search is successfully disabled and the mannequin solutions from its coaching information as an alternative.

Requests to the endpoint are authenticated with an AWS-issued bearer token, which you’ll be able to mint out of your present AWS credentials utilizing the aws-bedrock-token-generator bundle. This bearer token isn’t a separate API key; it’s a short-lived (as much as 12 hours) credential derived out of your present AWS IAM identification through SigV4, packaged within the format the OpenAI consumer expects for its api_key parameter. No further key administration is required.

Begin from a normal name. A standard Responses API name, with out grounding, seems like this:

response = consumer.responses.create(
    mannequin="openai.gpt-5.4",
    enter="What have been the important thing bulletins at AWS re:Invent 2025?",
)

Step 2: Allow Internet Search. To floor that very same name in internet data, add a single instruments entry:

instruments=[{"type": "web_search", "external_web_access": False}]

The optionally available external_web_access subject selects the place Internet Search retrieves from: Amazon’s pre-indexed internet corpus, or stay content material fetched instantly from the online. Right this moment solely indexed-web retrieval is served; live-web retrieval will probably be enabled in a future replace, and the parameter is already within the API so your code gained’t want to alter. The default is true, which requires the bedrock-websearch:ExternalWebAccess permission. The examples under set false, which wants no further permission.

Step 3: Learn the grounded response with citations. Placing it collectively, right here’s the entire end-to-end instance, together with learn how to extract the supply citations:

from openai import OpenAI
from aws_bedrock_token_generator import provide_token

REGION = "us-east-1"

consumer = OpenAI(
    base_url=f"https://bedrock-mantle.{REGION}.api.aws/openai/v1",
    api_key=provide_token(area=REGION),
)

response = consumer.responses.create(
    mannequin="openai.gpt-5.4",
    enter="What have been the important thing bulletins at AWS re:Invent 2025?",
    instruments=[{"type": "web_search", "external_web_access": False}],
)

searches = [item for item in response.output if item.type == "web_search_call"]
print(f"Retrieval steps: {len(searches)}")
for name in searches:
    if name.motion.kind == "search":
        print(f"  search: {name.motion.queries}")
    elif name.motion.kind == "open_page":
        print(f"  open_page: {name.motion.url}")

for merchandise in response.output:
    if merchandise.kind == "message":
        for content material in merchandise.content material:
            if content material.kind == "output_text":
                print(content material.textual content)
                for quotation in content material.annotations or []:
                    if quotation.kind == "url_citation":
                        print(f"  [{citation.title}] {quotation.url}")

The above code produces the next output (abridged):

Retrieval steps: 2
  search: ['AWS re:Invent 2025 key announcements official AWS blog keynote recap']
  open_page: https://aws.amazon.com/blogs/aws/top-announcements-of-aws-reinvent-2025
The largest AWS re:Invent 2025 bulletins clustered round **AI brokers, customized
silicon/infrastructure, and developer productiveness**. ...
  [Top announcements of AWS re:Invent 2025 | AWS News Blog] https://aws.amazon.com/...
  [AWS re:Invent 2025: Amazon announces Nova 2, Trainium3, frontier agents] https://...

On this pattern, the request features a Internet Search entry within the instruments array. Bedrock executes the search server-side and returns the grounded response in a single round-trip – there isn’t any operate schema to outline and no client-side loop to handle.

Every quotation is a url_citation object within the message content material’s annotations array. Its wire form:

 AWS Information Weblog",
    "url": "https://aws.amazon.com/blogs/aws/top-announcements-of-aws-reinvent-2025"

start_index and end_index are character offsets into output_text, letting you render inline footnotes or spotlight the precise span every quotation helps.

Auditing and observability

Internet Search is built-in with AWS CloudTrail out of the field. Each name to bedrock-websearch:InvokeSearch and bedrock-websearch:InvokeFetch is recorded as a administration occasion, capturing the calling identification, timestamp, motion, supply identification (together with any forward-access-session originator), and the account and Area context of the request. Entry-denied outcomes are all the time logged, and every AccessDeniedException occasion consists of the particular situation key that brought about the denial — which makes IAM misconfigurations simple to diagnose with out turning on further trails.

By design, CloudTrail doesn’t report the question textual content, the URLs returned by search, or the uncooked web page content material retrieved by fetch. Question textual content is handled the identical manner as an inference immediate and isn’t uncovered in path occasions. Mixed with in-Area processing and nil information egress, this provides safety and compliance groups a full audit path of who used the software when, with out exposing what finish customers looked for.

Conclusion

Internet Search on Amazon Bedrock removes the undifferentiated heavy lifting of connecting basis fashions to up-to-date internet data. It delivers context-efficient, multi-source grounded outcomes with low-latency, and easy enablement by way of a single API parameter – so builders can add internet grounding with out managing distributors, orchestration, or compliance opinions.

Internet Search on Bedrock is usually obtainable in US, with in-region question dealing with in us-east-1, us-east-2 and us-west-2. For pricing particulars, see the Amazon Bedrock pricing web page. To get began, see the Internet Search documentation for full API references and examples.