By ByteBot
OpenAI and Amazon launched Bedrock Managed Agents at DevDay 2026, and it answers the question every enterprise developer has been sitting on: can we use GPT-6 without routing our data through OpenAI’s servers? The answer is yes. All inference runs inside your AWS account. Your prompts, completions, and conversation history stay in Amazon’s cloud. And the migration from the direct OpenAI SDK takes exactly two environment variables.
What Bedrock Managed Agents Actually Is
The service combines three layers running inside your AWS environment: the OpenAI model (GPT-6 Sol, Luna, Astra, or GPT-5.6 Terra) handling inference on Amazon Bedrock, the Codex harness managing the agent loop and tool routing, and AgentCore Runtime providing the execution environment in your account. You choose where execution runs — AgentCore or your own compute. OpenAI’s servers never touch your data at any point in the chain.
The product is in limited preview. To request access, open the Amazon Bedrock console, navigate to Model access, and find the OpenAI models section. AWS reviews requests within a few days for accounts with active workloads. Provide a real description of your workload and compliance requirements — approval is gated on workload fit, not first-come first-served.
Two Endpoints, One Important Choice
Bedrock offers two endpoints for OpenAI models. Choosing the wrong one breaks features without obvious error messages.
bedrock-runtime is the recommended path for new applications. Requests are always synchronous. Model IDs use inference profile format: global.openai.gpt-5.6-sol or us.openai.gpt-5.6-sol. Note that client.models.list() does not work here — use the Bedrock ListFoundationModels and ListInferenceProfiles control-plane APIs to discover available models instead.
bedrock-mantle is the compatibility endpoint. Model IDs use the openai. prefix: openai.gpt-6-sol. This endpoint adds background inference, server-side web search, and support for multiple projects. client.models.list() works here. Available in 14 regions including EU (Frankfurt, Ireland, London, Milan, Stockholm), APAC (Tokyo, Sydney, Mumbai, Jakarta), South America, and GovCloud.
The default recommendation: start with bedrock-runtime unless you specifically need background mode or hosted web search, which are Mantle-only features.
Migration: Two Environment Variables
If you use the OpenAI Python or JavaScript SDK, the migration is a base URL swap and a key swap. Application code does not change.
# Before: direct OpenAI
OPENAI_BASE_URL=https://api.openai.com/v1
OPENAI_API_KEY=sk-...
# After: Bedrock Runtime
OPENAI_BASE_URL=https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1
OPENAI_API_KEY=<Bedrock API key from AWS console>Model IDs change format. The same model that was gpt-5.6-sol becomes global.openai.gpt-5.6-sol on Bedrock Runtime, or openai.gpt-5.6-sol on Mantle. Your Python client code stays identical:
from openai import OpenAI
client = OpenAI() # reads env vars automatically
response = client.responses.create(
model="global.openai.gpt-5.6-sol",
input="Summarize our Q3 financials.",
store=False # disable 30-day retention for sensitive data
)
print(response.output_text)What Does Not Work on Bedrock
Before migrating agentic workflows, audit against this list. These features are unsupported and fail silently or with non-obvious errors on Bedrock:
- Async tool calling
- WebSocket connections
- Mid-turn steering
- Remote MCP servers
- Hosted file search
- Shell tool and image generation tools
- Multi-agent orchestration (Agents API beta)
- Background mode (bedrock-runtime only — Mantle supports it)
If your current OpenAI workflow uses any of these, Bedrock is not a drop-in replacement today. For new greenfield agents built inside AWS, those gaps are manageable. For existing production agents, do the feature audit first.
The Data Retention Default That Trips Developers
The default is store: true. AWS retains your request and response data for 30 days, scoped to your project. “Data never leaves AWS” is accurate — but that is not the same as “data is not stored.”
For privacy-sensitive workloads, set store: false on every request. This disables retention entirely but breaks multi-turn conversation chaining via previous_response_id.
For full Zero Data Retention (ZDR) — the configuration required for HIPAA-covered transactions and FedRAMP strict workloads — setting store: false per request is not sufficient on its own. You must set the account or project data_retention_mode to none through the Bedrock data retention settings. With that enabled, Bedrock rejects any request where store: true is set and disables background mode entirely. This configuration brings you inside your existing AWS BAA for healthcare data processing.
One more data residency point: global inference profiles can route requests to any commercial AWS region. If you have EU GDPR or India data localization requirements, use a geographic inference profile rather than the global one to guarantee in-region processing.
The Enterprise Compliance Case
Using OpenAI’s direct API for HIPAA-covered workloads requires a separate Business Associate Agreement negotiation with OpenAI. On Bedrock, you operate under the AWS BAA you already signed. Bedrock carries HIPAA-eligible status, SOC 2, and FedRAMP-in-process across the service — your OpenAI inference inherits that compliance posture automatically.
On cost: Bedrock prices OpenAI models at parity with OpenAI direct pricing. For teams with AWS Enterprise Discount Programs (EDPs), OpenAI spend now counts toward existing cloud commitments. One invoice instead of two. The procurement consolidation has measurable finance-team value at scale.
What to Do Now
If you are already on the OpenAI API and your infrastructure runs in AWS, request preview access now. Limited preview means queue depth matters. Steps: AWS console → Bedrock → Model access → request OpenAI GPT-6 models. Describe your actual workload and compliance context in the request.
Before migrating any existing agents, run the feature gap list above against your current workflow. The two-variable swap is real and clean — but only if your agent does not depend on async tool calls, WebSockets, remote MCP servers, or the shell tool. For new agents built greenfield inside AWS, Bedrock Managed Agents drops directly into your existing IAM, CloudTrail, and VPC topology with no custom infrastructure required.
Full technical reference for both endpoints is in the OpenAI Amazon Bedrock developer guide.
