Security boundary: answer first
Separate four permissions:
| Layer | Control |
|---|---|
| Model inference | Intended Bedrock Mantle inference actions or managed policy |
| Search | bedrock-websearch:InvokeSearch |
| Full-page fetch | bedrock-websearch:InvokeFetch |
| Live external retrieval | bedrock-websearch:ExternalWebAccess |
At launch, AWS says only indexed-web retrieval is served. Do not grant a future-facing action merely because the request field exists. Re-evaluate when live retrieval becomes available.
CloudTrail coverage and gap
AWS says InvokeSearch and InvokeFetch calls are logged as management events, including denials and the condition key that caused an AccessDeniedException. It also says the trail intentionally omits query text, returned URLs, and raw page content.
That protects sensitive prompt content from trail events but creates an evidence-design decision. If a research, audit, or safety workflow needs the actual query and sources, record them in an approved application store with access, minimization, retention, integrity, and deletion controls.
Least-privilege rollout
- Start in one supported Region with indexed retrieval only.
- Scope the role to the intended application, model, and tool actions.
- Test allowed search, denied search, fetch, citation rendering, timeout, and source failure.
- Alert on denials, anomalous volume, unexpected Regions, and role changes.
- Review query sensitivity, source trust, prompt injection, and output validation.
- Re-authorize any move to live external retrieval.
Frequently asked questions
Does “zero data egress” remove every data review?
No. Confirm the current AWS architecture, Region, service terms, logs, application storage, source URLs, outputs, and downstream systems.
Does CloudTrail prove an answer was correct?
No. It records tool use and identity context, not source authority or model correctness.
Where is the request example?
Use the Responses API setup guide.
Official source
Source check: August 5, 2026.