Amazon Bedrock AgentCore adds a web search API at $7 per 1,000 queries

Amazon has added a standalone Web Search API to Amazon Bedrock AgentCore. According to the official announcement, developers can now get ranked web results with one signed call and no gateway, at $7 per 1,000 queries.

One IAM-signed call replaces the gateway setup

Until now, web search in AgentCore reached agents only through AgentCore Gateway. A team had to create a gateway and a web search target, then call the tool from an MCP client. The new operation, InvokeWebSearch, sits on the bedrock-agentcore data plane and is called from the AWS SDKs or the AWS CLI. Requests are signed with the same IAM credentials as other AWS services, so there is no API key to manage and no resource to create first.

Each request carries a search string of up to 200 characters. The API returns 1 to 25 ranked results (25 if the caller does not set a limit). Every result has a text extract and, when the index has them, a title, URL and publication time. Callers can include or exclude up to 100 domains each, and a root domain also matches its subdomains. A publication date range can be set with publishedAfter and publishedBefore, both inclusive.

The caller needs one permission, bedrock-agentcore:InvokeWebSearch, on an AWS managed resource. Amazon says it is the same action a gateway’s service role uses, so one policy covers both routes. Code running on Lambda, ECS, EC2 or EKS picks up credentials from its execution role. The post gives Boto3 1.43.127, langchain-aws 1.9.3 and the AgentCore Python SDK 1.26.0 as the minimum versions with support.

Price, quotas and the six Regions that have it

The API is billed under the same usage type as the gateway connector, at $7 per 1,000 queries, with no gateway charges on top. At that rate a million queries cost $7,000 (our arithmetic, not an AWS example). Each account gets 10 requests per second per Region by default, and an increase can be requested. That default tops out at roughly 860,000 queries a day in a Region, so a busy production pipeline is likely to need a higher limit.

Six Regions are covered: Northern Virginia, Ohio and Oregon in the United States, Ireland in Europe, and Tokyo and Sydney in Asia Pacific. Ireland is the only European location the post names.

For private networks, Amazon describes an interface VPC endpoint through AWS PrivateLink for com.amazonaws.<Region>.bedrock-agentcore, which keeps traffic off the public internet. Endpoint policies and an aws:SourceVpce condition can limit who may search. Interface endpoints are billed at standard PrivateLink rates. CloudTrail can log calls as data events, but they are off by default. The events record the tool and maxResults, not the search text or filters.

The terms of use also apply to API results, including the requirement to keep and display the source citations and links that come with each result. That matters for anyone who planned to strip links before showing answers to users.

A cloud vendor now runs the search index itself

The most notable claim concerns where the queries go. Amazon says searches are served from a web index it operates and are not forwarded to a third-party search engine. It also says the index runs on the same infrastructure that powers Alexa+, Kiro, Quick and other Amazon products. Those statements come from the company and the post gives no independent figures on index size, freshness or result quality.

The product also shows how AWS is packaging agent parts. Amazon positions the gateway as the recommended route for most agent work, since it offers one MCP endpoint for several tools, JWT authorization and administrator-set domain lists that the agent cannot see. The API is the lower-level option for custom loops, LangChain or LlamaIndex code, and non-agent jobs such as dashboards or fact-checking pipelines. The trade-offs are concrete: the API authorizes with IAM only, each request carries its own filters, and the field names differ from the gateway’s MCP tool, which uses query, from and to.

The timing and the audience are also telling. Amazon’s separate what’s-new notice is dated November 10, a day before the blog post, and describes the API as generally available. AWS has pitched Bedrock as a way to reach many models under one account and one set of controls. Our explainer on Amazon Bedrock notes AWS documentation lists more than 100 foundation models from providers including Anthropic, OpenAI and DeepSeek. Search results grounded in an IAM-governed AWS service extend that pitch from models to data. An existing AWS customer can add current web facts without signing a contract with a separate search vendor or opening a new network path. Those buyers are already paying for the models, so the $7 rate sits next to a bill they have.

The post does not compare the price or quality with other search APIs, so cost-conscious teams will need to run their own tests. It also does not say how fresh the index is or how many pages it holds.

What readers can try today

Amazon offers two quick routes. In AWS CloudShell, aws bedrock-agentcore invoke-web-search --web-search-id web-search.v1 --search-query "latest EKS features" --max-results 5 runs with console credentials, provided the role has the permission or the managed policy BedrockAgentCoreFullAccess. The AgentCore console also has a Web Search page under Connections, where settings can be tested, turned into a code snippet, or used to create a gateway target.

For teams that already run a gateway, nothing needs to change: both routes search the same index and bill at the same rate.