bedrockbot
bedrockbot is a bot operated by Amazon that crawls pages into a dataset that is then reused or sold. Connects to and crawls URLs that have been selected for use in a user's AWS bedrock application. It is documented as honouring robots.txt, but no IP range list or reverse-DNS convention is published, so a request carrying this user agent cannot be proven genuine.
bedrockbot at a glance
| User agent | bedrockbotToken only. The operator has not published a full user-agent string, so match on the substring rather than an exact header. |
|---|---|
| Operator | Amazon |
| Purpose | Data scraping for custom AI applications. |
| Respects robots.txt | Yes, documentedsource |
| Verification method | None published, user agent only Runs from an AWS customer account, so the source IP belongs to whoever configured the Bedrock knowledge base rather than to AWS as a crawler operator. https://docs.aws.amazon.com/bedrock/latest/userguide/webcrawl-data-source-connector.html |
| Crawl pattern | Not published |
| Robots.txt tokens | bedrockbot |
| Operator documentation | None published |
Connects to and crawls URLs that have been selected for use in a user's AWS bedrock application.
Allow or block bedrockbot
Paste one of these into the robots.txt file at the root of your domain. Rules are per token, so a block on one crawler leaves every other bot untouched.
User-agent: bedrockbot
Disallow: /Blocks every path for this crawler only.
User-agent: bedrockbot
Allow: /Explicit allow. Useful when a wildcard rule above it would otherwise catch this crawler.
User-agent: bedrockbot
Allow: /
Disallow: /account/
Disallow: /checkout/
Disallow: /searchEdit the Disallow paths to match your own account, checkout and search URLs.
What blocking actually costs you
Blocking bedrockbot stops your content being packaged and resold to third parties. Whoever bought earlier crawls still has them.
Block every crawler in the directory at onceIs that really bedrockbot?
A user-agent header is a string the client chooses. Scrapers copy bedrockbot precisely because site owners allow it. Runs from an AWS customer account, so the source IP belongs to whoever configured the Bedrock knowledge base rather than to AWS as a crawler operator.
Paste the IP address from your access log below. You will see whether it belongs to a hosting provider, a residential proxy pool or a Tor exit, plus the ASN that announces it, which is what tells you whether the claim holds up.
Other crawlers run by Amazon
Related crawlers
Identify crawlers automatically instead of by hand
Agentscan checks a request against published crawler ranges, reverse DNS and hosting data, then returns a verdict your edge can act on. One call per request, no range files to keep up to date.