Does bedrockbot respect robots.txt?

Yes. The operator documents that bedrockbot reads robots.txt and follows Disallow rules for its own token. Rules take effect on the next fetch of the file, which can be hours or days after you publish them.

How do I block bedrockbot?

Add the bedrockbot token to robots.txt with Disallow: /. If the crawler ignores robots.txt, match the user agent at your CDN or reverse proxy and return 403 there instead.

IPScanner

Dataset builders

bedrockbot

Q: How do I verify a request really came from bedrockbot?

You cannot, at least not from the request itself. Runs from an AWS customer account, so the source IP belongs to whoever configured the Bedrock knowledge base rather than to AWS as a crawler operator. Compare the source IP against hosting and datacenter ranges instead, and rate limit anything that behaves like a crawler.

bedrockbot is a bot operated by Amazon that crawls pages into a dataset that may be reused or shared with third parties. Connects to and crawls URLs that have been selected for use in a user's AWS bedrock application. It is documented as honouring robots.txt, but no IP range list or reverse-DNS convention is published, so a request carrying this user agent cannot be proven genuine.

Verify an IP that claimed to be bedrockbot

No operator check exists for bedrockbot, so this will not be able to confirm the name. What it can still tell you is what the address actually is: which network announces it, and whether it is a hosting range, a residential proxy or a Tor exit.

The check needs JavaScript. The evidence it uses is public either way: the operator's own documentation says how a request claiming to be bedrockbot can be verified, and the table below repeats it.

bedrockbot at a glance

Reference data for the bedrockbot crawler
User agent	`bedrockbot` Token only. The operator has not published a full user-agent string, so match on the substring rather than an exact header.
Operator	Amazon
Purpose	Data scraping for custom AI applications.
Respects robots.txt	Yes, documentedsource
Verification method	None published, user agent only Runs from an AWS customer account, so the source IP belongs to whoever configured the Bedrock knowledge base rather than to AWS as a crawler operator. https://docs.aws.amazon.com/bedrock/latest/userguide/webcrawl-data-source-connector.html
Crawl pattern	Not published
Robots.txt tokens	`bedrockbot`
Operator documentation	None published

Connects to and crawls URLs that have been selected for use in a user's AWS bedrock application.

robots.txt

Allow or block bedrockbot

Paste one of these into the robots.txt file at the root of your domain. Rules are per token, so a block on one crawler leaves every other bot untouched.

Block bedrockbot

User-agent: bedrockbot
Disallow: /

Blocks every path for this crawler only.

Allow bedrockbot

User-agent: bedrockbot
Allow: /

Explicit allow. Useful when a wildcard rule above it would otherwise catch this crawler.

Allow, except the pages you never want quoted

User-agent: bedrockbot
Allow: /
Disallow: /account/
Disallow: /checkout/
Disallow: /search

Edit the Disallow paths to match your own account, checkout and search URLs.

What blocking actually costs you

Blocking bedrockbot keeps your pages out of the datasets it builds from future crawls. It does not remove anything collected earlier, and how each operator uses or shares its data varies, so check their policy.

Block every crawler in the directory at once

Verification

Is that really bedrockbot?

A user-agent header is a string the client chooses. Scrapers copy bedrockbot precisely because site owners allow it. Runs from an AWS customer account, so the source IP belongs to whoever configured the Bedrock knowledge base rather than to AWS as a crawler operator.

Paste the IP address from your access log below. You will see whether it belongs to a hosting provider, a residential proxy pool or a Tor exit, plus the ASN that announces it, which is what tells you whether the claim holds up.

Datacenter IP detectionNearly every real AI crawler egresses from cloud ranges. A residential IP claiming to be one is the first thing to check.IP reputation checkSee whether the address behind a fake crawler hit has a history of abuse elsewhere.Residential proxy detectionScrapers that get blocked by user agent often come back through residential proxy pools.

Other crawlers run by Amazon

amazon-kendraAI search crawlers AmazonbotAI search crawlers AmazonBuyForMeAutonomous agents Amzn-SearchBotAI search crawlers Amzn-UserAssistant fetchers NovaActAutonomous agents

Related crawlers

amazon-kendraAmazon · AI search crawlers AmazonbotAmazon · AI search crawlers AmazonBuyForMeAmazon · Autonomous agents YandexAdditionalYandex · Dataset builders AgentTimesThe Agent Times · Dataset builders

Agentscan

Identify crawlers automatically instead of by hand

Agentscan checks a request against published crawler ranges, reverse DNS and hosting data, then returns a verdict your edge can act on. One call per request, no range files to keep up to date.

How Agentscan works API reference Pricing What is my IP

FAQ