Giving an agent access to the web sounds simple until you ship it: pick a third-party search API, feed results to the model, let it decide which pages to fetch, scrape and trim them to fit the context window, synthesize, and (if you remembered) cite sources. Every step adds tokens, latency, another API key to rotate, and another vendor in your risk review.
On November 5, 2026, AWS announced Web Answer on Amazon Bedrock AgentCore, a managed AgentCore Gateway connector that takes a natural-language question and returns a written answer where every claim is tied to a source URL, in a single MCP tool call. It builds on Web Search, which landed in June and returns ranked results for your own model to process. This post covers how Web Answer differs from Web Search, how to wire it up with the CLI and Strands Agents (including from EKS), the filtering model, pricing, and what to check before you put it in front of users.
TL;DR
- Managed Gateway connector (
connectorId: "web-answer") that returns a synthesized, cited answer in one tool call. - Under the hood, an AWS-managed agent plans searches, runs several in parallel, reads key pages to verify facts, and searches again when evidence is thin.
- Searches an Amazon-operated web index plus Amazon's Knowledge Graph; queries are not sent to third-party search engines.
- Admin-level domain filters that agents can't bypass, plus per-call domain, published-date, and country filters.
- $10 per 1,000 tool calls, plus $0.005 per 1,000 Gateway invocations. Web Search is $7 per 1,000 queries.
- us-east-1 only, with a launch quota of 10 TPS per account.
- Terms require you to display the citations with any result you show users and prohibit bulk storage of results.
Request flow: the Gateway calls Web Answer with its own service role and returns a cited answer. Image: AWS.
Web Search vs. Web Answer
| Web Search | Web Answer | |
|---|---|---|
| Returns | URLs, titles, snippets, dates | Markdown answer with [[N](url)] citations |
| Who synthesizes | Your model | An AWS-managed agent |
| Tokens in your model | Many | Few |
| Price | $7 / 1,000 queries | $10 / 1,000 calls |
| Best for | Broad research, fine control | Specific factual questions |
AWS suggests using both. I agree: Web Search when your model needs to reason across many results, Web Answer when you just need a current, verifiable fact without burning your orchestrator's context window on ten web pages.
One detail I like: the Gateway service role does not need bedrock:InvokeModel. The model Web Answer uses runs on AWS's side and is included in the per-call price. Processing may use cross-Region inference, but within the same geography (US, EU, or APAC).
The response format
content[0].text is ready-to-render markdown with citation markers; structuredContent.answer[] holds blocks of text plus a citations list (url, optional domain). Marker N maps to citations[N-1] within the same block, there can be several blocks, and on failure isError is true with the reason in content[0].text. AWS's example shows a server-side latencyMs of about 5.2 seconds.
The filter model is a platform team's friend
Two levels, one rule: the admin sets the boundary, the agent can only narrow it.
- Target level (admin):
parameterValues.domainFilterwithincludeandexcludelists of up to 50 domains each, set when you create the target. - Call level (agent):
filters.domainFilter,filters.publishedDateFilter(from/to, inclusive, UTC, ISO-8601) anduserLocation.country(ISO 3166-1 alpha-2). - Excludes are merged (up to 100). If both levels set
include, the intersection is used, and an empty intersection is a validation error. Excluding a root domain also excludes its subdomains. - Per-call filters and
userLocationrequire connector version 1.1.0+. Queries can be up to 30,000 characters.
How the two filter levels combine. Diagram: CloudAcademy.ar (Spanish).
Hands-on
If you don't have a Gateway yet, the console wizard creates one in a few steps: MCP target, Connectors target type, then pick the tool. (The screenshot below is from the Web Search launch; Web Answer is added from the same place.)
Adding a connector target in the AgentCore console. Image: AWS.
1. Let the Gateway service role invoke Web Answer. Note the aws account in the resource ARN: it's an AWS-owned tool.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "bedrock-agentcore:InvokeWebAnswer", "Resource": "arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-answer.v1" } ] } 2. Create the target with an allowlist. This one turns Web Answer into an "official docs only" assistant without running your own RAG:
aws bedrock-agentcore-control create-gateway-target \ --gateway-identifier "<GATEWAY_ID>" \ --name "web-answer-tool" \ --target-configuration '{ "mcp": { "connector": { "source": { "connectorId": "web-answer" }, "configurations": [{ "name": "WebAnswer", "parameterValues": { "domainFilter": { "include": ["docs.aws.amazon.com", "aws.amazon.com", "kubernetes.io"] } } }] } } }' \ --credential-provider-configurations '[{"credentialProviderType": "GATEWAY_IAM_ROLE"}]' \ --region us-east-1 3. Test it with MCP Inspector before writing code. If semantic search is enabled on the Gateway, tools/list also returns x_amz_bedrock_agentcore_search, possibly first, so match on the ___WebAnswer suffix rather than position.
Testing a Gateway tool with MCP Inspector (Web Search launch screenshot). Image: AWS.
4. Call it from Strands Agents with SigV4, no API keys:
from mcp_proxy_for_aws.client import aws_iam_streamablehttp_client from strands import Agent from strands.models import BedrockModel from strands.tools.mcp import MCPClient GATEWAY_URL = "https://<gateway-id>.gateway.bedrock-agentcore.us-east-1.amazonaws.com/mcp" gateway = MCPClient(lambda: aws_iam_streamablehttp_client( endpoint=GATEWAY_URL, aws_region="us-east-1", aws_service="bedrock-agentcore")) with gateway: agent = Agent( model=BedrockModel(model_id="us.anthropic.claude-sonnet-5", max_tokens=1024), tools=gateway.list_tools_sync(), system_prompt="Use WebAnswer only for facts that change over time, and always show its sources.", ) print(agent("Which Kubernetes versions does Amazon EKS currently offer in standard support?").message) 5. Running on EKS. The pod's role (via EKS Pod Identity) needs bedrock-agentcore:InvokeGateway on the Gateway ARN plus Bedrock permissions for your orchestrator model; it does not need Web Answer permissions, since the Gateway role handles that. For private clusters, the Gateway supports PrivateLink (com.amazonaws.us-east-1.bedrock-agentcore.gateway).
Pricing
Web Answer is $10 per 1,000 tool calls; Gateway invocations are $0.005 per 1,000. A back-of-the-envelope example: an internal assistant doing 2,000 questions per business day (about 44,000 a month) is roughly $440/month in Web Answer, plus your orchestrator model, which should spend fewer tokens than with raw Web Search results. Keep costs in check by telling the agent to call it only for time-sensitive facts, and consider Web Search at $7 for long research loops where your model filters anyway.
What to check before production
- Region: us-east-1 only, more "coming soon". If your Gateway is in sa-east-1 or eu-west-1, you'll need one in us-east-1 for this tool, with the cross-Region latency and transfer that implies.
- Data residency: AWS says queries stay within AWS, aren't sent to third-party engines, and AWS's diagram says they aren't used to train models. Still, if your agent puts customer data into the
query, you're shipping it to a US Region. Guardrails or a Gateway interceptor help. - Quota: 10 TPS per account at launch. A runaway agent loop or several teams in one account will hit it.
- Terms: you must retain and display citations; no bulk extraction or building your own index from results.
- Unknowns: I couldn't find documented retention for queries or how robots.txt is handled in the index. Ask your account team if that matters to you.
My take
Web Answer turns web research into a managed primitive with clear separation of duties: the agent decides when it needs external information, the Gateway decides who can use it and with which sources, and AWS does the searching and citing. For platform teams, that's governance you previously had to build. The trade-off is a black box: you don't choose the model, you don't see intermediate searches, and you depend on the quality of Amazon's index. Start with a narrow, strict-allowlist use case, measure quality and cost for a few weeks, then widen it.
