Paying $7 per 1,000 queries keeps web search inside an AWS account you already reviewed

A Custom Search key is one secret in one environment variable. The replacement path needs two identities. AgentCore assumes a gateway service role to invoke the Web Search connector, and that role needs two actions: `bedrock-agentcore:InvokeGateway` on the gateway ARN, and `bedrock-agentcore:InvokeWebSearch` on `arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-search.v1` ^[8]. The caller is a separate grant. The AWS credentials on the Pi need their own permission to invoke that specific gateway, and the report states that this grant has to live in the caller's own identity policy, separate from the gateway service role ^[9].

Scoping matters on the way in. The trust policy in the report lets `bedrock-agentcore.amazonaws.com` assume the role only under an `aws:SourceAccount` match and an `ArnLike` condition on gateway ARNs ^[10]. The gateway is created with `--protocol-type MCP` and `--authorizer-type AWS_IAM` ^[11].

The connector target pins `connectorId` `web-search` at version `1.2.0` and takes its credentials from `GATEWAY_IAM_ROLE` ^[12]. The version number decides the feature set. Domain and publication-date filters are available when the target uses connector version 1.2.0 or later ^[13], and pinning keeps those filters in configuration instead of depending on a future default ^[14]. The rest of the schema is small: `query` is capped at 200 characters, and `maxResults` runs from 1 to 25 with a default of 10 ^[15]. An agent that forwards a whole user turn as its query will hit that cap.

The connector takes away the third-party search API key and the provider-specific result parsing; it leaves IAM, a gateway, and an MCP client to configure ^[7]. The author's own summary of the work is that the useful lessons were version pinning, validating security controls, and debugging each layer separately ^[22].

The AWS connector is 40 percent more per query ^[1]. At 200,000 queries a month, that gap is $400 ^[4]. Google's 100-query daily free tier comes to 36,500 queries a year, worth $182.50 at its paid rate ^[3].

Relevance is untested here. The report considered Brave and Exa, says it is not a search-quality benchmark, and did not measure matched-query relevance, latency, or like-for-like total cost ^[16]. AWS describes the index as Amazon-operated, spanning tens of billions of documents, refreshing continuously, and keeping queries within AWS infrastructure; the report labels those service claims that it did not independently verify ^[18]. For the premium to be worth paying in another team's setup, that index has to answer their agents' queries about as well as CSE did, and their vendor onboarding has to cost more than the difference. The first half is testable now against your own logged queries. I would spend the migration window there. The connector is currently available in us-east-1, eu-west-1, and ap-northeast-1 ^[19].