One AWS Bedrock setting decides if user data leaves your AWS boundary. Learn what external_web_access does, the IAM permission behind it, and what to do before go-live.