AWS announced on October 30, 2026, that Kiro web search is available in AWS GovCloud (US). According to the company, the agent automatically searches when a question involves recent changes or information beyond the model’s training data, and answers that use web results include citations.
The launch also includes controls for organizations that need to restrict internet retrieval. Enterprise administrators can disable web search and web fetch organization-wide, while teams can remove web tools from custom agents or block them through capability-based permission rules, according to the AWS announcement.
For compliance-sensitive deployments, the most consequential detail sits in Kiro’s governance documentation: the web-tools policy is enforced on the client. That gives administrators a documented management control, but its strength depends partly on who controls the local machine.
When Kiro Searches the Web
Kiro’s web search gives the agent access to current search results and page content, according to AWS. The agent decides when to use it based on the question, including whether the answer requires recent information or knowledge beyond its training data.
The user action is therefore straightforward: ask a question that needs current information. AWS describes automatic retrieval, without specifying a separate search command that users must invoke for each request.
A question about a recent software change illustrates the use case. A model’s training data may describe an older version, while a current documentation page may describe the new behavior. Web retrieval gives Kiro a way to bring that newer material into its answer. This is an explanation of the feature’s intended use, not a result from an independent test.
Two tool names matter:
web_searchsearches the web.web_fetchretrieves content from URLs.
Kiro’s governance documentation identifies both tools and places them under the same Web Tools setting.
AWS says answers that use web results include citations. That qualification matters: the announcement does not promise citations on every answer. Citations also give readers a path to inspect the underlying material; they are not, by themselves, a guarantee that the answer interprets a source correctly.
My view is that this traceability is the most useful part of the user-facing change. For a question about current technical behavior, readers can check the cited page’s version, publication date and stated conditions before acting on the answer.
How Administrators Disable Web Search and Fetch
Kiro’s governance documentation says web tools are enabled by default. Administrators who want them unavailable need to change the setting.
The documented procedure is:
- Open the Kiro console.
- Choose Settings.
- Under Shared settings, switch Web search and web fetch tools to Off.
The AWS announcement points administrators to Settings; the governance page supplies the more precise location under Shared settings. These descriptions are consistent, with the documentation adding the final navigation step.
The setting disables both tools for all Kiro users in the account or organization. When disabled, the tools are hidden from users, according to the documentation.
The shared switch has an important practical consequence: this documented control groups search and URL fetching together. An administrator using it is turning off both discovering pages through search and retrieving content from URLs. The supplied documentation does not describe separate organization-wide toggles for the two tools.
What Users See in Each Client
The Web Tools setting applies to Kiro IDE and Kiro CLI V2 and V3 sessions. The documentation describes different notices for the two CLI versions:
| Client | Documented behavior when web tools are disabled |
|---|---|
| Kiro IDE | The shared policy applies, and disabled tools are hidden from users. |
| Kiro CLI V2 | Running /tools shows a warning that the administrator has disabled web tools. |
| Kiro CLI V3 | The session displays the administrator-disabled notice when it starts. |
The /tools command is a visibility check in this context, not a command to re-enable access. Kiro directs users who are not administrators to contact their organization administrator if they want the setting reviewed or restored.
That distinction should help support teams. A missing web tool can be an intended policy outcome, so checking the organization setting is a useful step before treating its absence as a client fault.
Teams Can Restrict Individual Agents
AWS also describes narrower controls for teams that do not want to disable web retrieval across the whole organization.
Teams can remove web tools from individual custom agents or block them with capability-based permission rules. These options address a different question from the global switch: which agents should have the tools available for their particular tasks?
| Control | Scope described by AWS | Practical use |
|---|---|---|
| Shared Web Tools setting | All Kiro users in an account or organization | Make web search and fetch unavailable broadly. |
| Custom-agent tool removal | Individual custom agents | Leave web tools out of a particular agent’s configuration. |
| Capability-based permission rules | Tool blocking through permission rules | Restrict web-tool availability through policy. |
For example, a team could decide that an agent answering questions about recent public documentation needs web retrieval, while an agent intended for a tightly bounded task should have those tools removed. That is a deployment example based on the announced controls, not an AWS-published configuration recipe.
I would start with the narrowest tool set that fits each agent’s job. The reasoning is simple: an agent with no need for current internet content gains little from having web tools available. Removing unnecessary capabilities also makes its intended scope easier to explain during a policy review.
AWS’s notice confirms that capability-based blocking exists, but it does not provide rule syntax or explain how those rules interact with every other control. There is not enough published detail here to supply a reliable permission-rule example or claim a particular precedence order.
The Client-Enforcement Caveat Matters
Kiro’s governance page includes a warning that the launch announcement leaves out. It says the web-tools policy is enforced at the client level and is:
“subject to modification by users with administrative access to their local machine.”
That warning comes directly from the Kiro governance documentation, which was also updated on October 30, 2026.
The distinction is between setting an organization policy and making that policy resistant to local modification. The console setting controls normal tool availability across the supported clients. The documentation also makes clear that users with local administrative access can modify client-enforced configuration.
Frequently Asked Questions
3 questions
1Does Kiro Cite Every Answer?
AWS says answers that use web results include citations. It does not promise citations for answers produced without web retrieval.
