Amazon Bedrock Managed Agents Powered by OpenAI: The Complete Guide for Agentic AI Architects (2026)

On September 29, 2026, at OpenAI’s DevDay in San Francisco, AWS and OpenAI unveiled something that would have been unthinkable eighteen months earlier: OpenAI’s agentic runtime running natively inside Amazon’s cloud, with data that never crosses an AWS boundary. Amazon Bedrock Managed Agents powered by OpenAI is now in public preview — and for enterprises that have spent the past two years caught between “we want OpenAI models” and “our data stays in AWS,” the procurement gap just closed.

This is not simply another model endpoint. Bedrock Managed Agents (BMA) wraps OpenAI’s Agents API in AWS-native identity, governance, and compute infrastructure. Agents preserve context across multi-step workflows, coordinate specialized tools, and run inside Firecracker microVMs — the same isolation technology that powers AWS Lambda — all while billing against existing AWS commitments. For RPA teams already orchestrating bots on AWS, it is the clearest signal yet that the cloud hyperscalers see agentic AI as the next control plane for enterprise automation.

This guide breaks down exactly how BMA works, what it costs, where it fits alongside existing RPA orchestration platforms like UiPath and Automation Anywhere, and what Agentic AI Architects need to know before deploying their first managed agent.

Why This Matters: The End of the Microsoft Exclusivity Era

To understand why BMA exists, you need to understand what changed upstream. On April 28, 2026 — one day after Microsoft’s exclusive distribution rights over OpenAI models formally ended — AWS announced OpenAI models on Amazon Bedrock. The renegotiated agreement preserved Microsoft’s license to OpenAI intellectual property through 2032, but made it non-exclusive. AWS became the first third-party cloud distributor for OpenAI Frontier, the enterprise platform.

The timing was strategic. Organizations running production workloads on AWS had faced an awkward procurement split: AWS for infrastructure, Microsoft-billed tooling for OpenAI models. As Futurum Research analysts noted, Bedrock Managed Agents “removes the cloud-procurement gap that previously pushed AWS-anchored teams toward Microsoft-billed tooling.” Now, OpenAI model usage can count toward existing AWS Enterprise Discount Programs (EDPs), simplifying budgets and eliminating dual-vendor complexity.

For RPA and automation teams, this is particularly relevant. UiPath and Automation Anywhere both run production orchestration on AWS, and many enterprises already have their bot infrastructure, document stores, and integration layers inside AWS accounts. BMA lets those teams add agentic AI capabilities without moving data out of their existing security perimeter.

Architecture: How Bedrock Managed Agents Actually Works

BMA is built from three layers, each owned by a different party:

The critical design decision: the agent never communicates directly with your infrastructure. Tools execute in the compute environment that you provide, and all flows are mediated through an outbound-only exec server. This is a fundamentally different security posture from hosted agent platforms where vendor code runs inside your network.

The Six Core Components

1. Session — The stateful conversation container. Each session holds its model configuration, system instructions, tool definitions, an IAM role, and execution environment reference. Think of it as a long-lived agent instance that persists across multiple interactions.

2. Turn — A single unit of work: one user message in, one or more reasoning steps plus tool calls out. A turn runs until the agent completes its response or hits a cancellation signal. Critically, cancelling a turn does not undo side effects from tools that already completed — there is no built-in transaction rollback.

3. Execution Environment — Customer-provided compute where tools actually run. This can be a developer laptop, an EC2 instance, an ECS container, or the managed AgentCore Runtime (more on this below).

4. Exec Server — The codex exec-server process that bridges your execution environment to BMA. It maintains an outbound-only connection to the BMA control plane, receives tool invocation requests, executes them locally, and returns results. The outbound-only design means no inbound firewall rules are required.

5. Items & Events — The durable record layer. Items are persistent records of messages, tool calls, and results within a session. Events are the live stream of progress updates during a turn. This dual-layer approach supports both real-time streaming UIs and after-the-fact audit trails.

6. Session Role — The IAM identity that BMA assumes for model calls and service interactions. Three distinct IAM identities are required in production: the caller identity, the session role, and the exec environment identity. This separation of privilege is native AWS IAM — no proprietary auth layer to learn.

Data Flow: What Happens When an Agent Runs

When a user submits a message to a BMA session, the flow proceeds as follows:

1. The API call (signed with SigV4) hits the bedrock-mantle regional endpoint
2. BMA orchestrates the agent loop: the model reasons about the message and decides which tools to call
3. Tool invocation requests are sent to the exec server running in your environment
4. The exec server executes the tool locally, using your IAM credentials and network access
5. Results flow back to BMA, which feeds them to the model for further reasoning
6. The cycle repeats until the agent produces a final response
7. All interactions are logged as durable items for audit

A successful API submission returns an empty body (HTTP 202 — accepted, not completed). You confirm completion by polling the session state, reading items, or streaming events. This async-first design supports long-running agent workflows that might take minutes to complete — a pattern familiar to anyone who has built multi-step A2A or MCP-based agent orchestrations.

Deployment Modes: Self-Hosted vs. AgentCore Runtime

BMA offers two deployment options, each with different operational trade-offs:

Option 1: Self-Hosted Compute

You run the codex exec-server process on your own infrastructure — a development machine, a container, or an EC2 instance. This gives you full control over the execution environment: install any dependencies, access any network resources, use any operating system.

Best for: Development, testing, environments with strict network topology requirements, or cases where tools need access to resources that cannot be exposed to a managed runtime.

Trade-off: You manage uptime, scaling, and patching of the exec server yourself.

Option 2: AgentCore Runtime (Managed)

AWS provides a managed microVM per session, powered by Firecracker (the same technology behind Lambda). The exec server and adapter come pre-installed on ARM64 Linux. The runtime integrates with VPC, IAM, and S3 out of the box.

Key specifications:

Best for: Production workloads where you want AWS to manage compute lifecycle, scaling, and isolation — similar to how you might choose Fargate over self-managed ECS.

Trade-off: Less flexibility in environment configuration. The NAT gateway alone costs approximately $33/month whether the agent runs or not, so this is not a zero-cost-at-idle option.

Supported Models and Pricing

BMA supports the full range of OpenAI models available on Bedrock, including the latest frontier models announced at DevDay:

Note: Bedrock in-Region rates carry approximately a 10% premium over OpenAI’s global pricing — the cost of data-residency guarantees. No service fee during preview (may change at GA).

AgentCore Runtime costs add $0.1276/vCPU-hour and $0.0169/GB-hour, with CPU billing paused during I/O waits. A typical 10-minute agent session on GPT-5.6 Luna processing 200K input and 20K output tokens costs approximately $0.12 all-in — competitive with running a traditional RPA bot for the same duration on many cloud platforms.

Tool Integration: MCP, Skills, and the Execution Model

BMA supports two primary mechanisms for connecting agents to external capabilities:

MCP (Model Context Protocol) Servers

In the current preview, BMA supports STDIO-based MCP servers running inside your execution environment. Remote MCP is not yet available. You can restrict which tools an agent can access from each MCP server using allowed_tools lists — an important safety control when agents operate in production environments with access to sensitive systems.

For teams already building MCP-based tool ecosystems, this means your existing MCP server implementations can plug directly into BMA agents. The same MCP server that serves tools to Claude, Gemini, or an open-source agent framework can serve tools to a Bedrock Managed Agent — true multi-runtime portability.

Skills System

BMA uses SKILL.md documentation files (up to 32 capability paths) to describe agent capabilities in structured Markdown. This is the same pattern used by Claude Code and other agentic frameworks — a filesystem-based skill registry where each skill is a self-contained folder with a manifest describing what it does and how to invoke it. The convergence around this pattern across vendors is notable and suggests it may become a de facto standard for agent capability description.

What About Guardrails?

BMA inherits Bedrock Guardrails for output filtering, bias mitigation, and content grounding. However, authorization and human-in-the-loop approval workflows must be implemented in your application or tool layer — there is no built-in approval gate where a human reviews an agent’s proposed action before execution. For RPA teams accustomed to UiPath’s attended automation model (where bots pause for human approval), this is a meaningful gap that requires custom engineering.

What BMA Cannot Do Yet: Preview Limitations

The public preview has significant constraints that architects need to factor into deployment planning:

The lack of multi-agent orchestration is the most significant limitation for complex automation scenarios. Teams building multi-agent architectures will need to use AWS Step Functions, EventBridge, or a custom orchestration layer to coordinate multiple BMA sessions — unlike Microsoft’s Agent Framework 1.0, which supports hierarchical agent composition natively.

BMA vs. the Agentic Landscape: How It Compares

Where does BMA fit relative to other enterprise agent platforms? Here is how it stacks up across the dimensions that matter most to Agentic AI Architects:

The key differentiator is the intersection of OpenAI frontier models and AWS-native security. No other option gives you GPT-6-class reasoning with SigV4 authentication, VPC isolation, and CloudTrail logging. If your organization already standardizes on AWS for compliance, BMA eliminates the “but our AI vendor is on a different cloud” objection entirely.

What This Means for RPA Teams on AWS

If you are running UiPath Orchestrator, Automation Anywhere Control Room, or any RPA platform on AWS infrastructure, BMA opens three specific integration patterns:

Pattern 1: Agentic Pre-Processing for RPA Workflows

Use a BMA agent to handle the unstructured, judgment-heavy front-end of a process — reading emails, classifying documents, extracting entities from free-text — then hand structured output to a traditional RPA bot for the deterministic execution steps. The agent handles what bots cannot (ambiguity, context, reasoning), and the bot handles what agents should not (clicking through legacy UIs with pixel-perfect reliability).

Example: An invoice processing pipeline where the BMA agent reads incoming emails, classifies them by urgency and type, extracts key fields from attached PDFs (once image input is supported at GA), validates against business rules, and then triggers a UiPath or Automation Anywhere P2P bot to execute the actual ERP entries.

Pattern 2: Agent-Orchestrated Bot Supervision

A BMA agent monitors bot execution via MCP tools connected to your RPA orchestrator’s API. When a bot encounters an exception that it cannot handle, the agent reasons about the error, decides on a recovery action, and either retries the bot with corrected parameters or escalates to a human. This is the “agentic supervisor” pattern — the agent acts as an intelligent exception handler sitting above the bot layer.

Pattern 3: Gradual Migration from Bots to Agents

For processes where you are evaluating whether to rebuild a brittle RPA bot as an agentic workflow, BMA provides a migration path within your existing AWS account. Start by wrapping the bot’s API as an MCP tool, let the agent handle the decision logic, and progressively move execution steps from the bot to the agent as confidence grows. The data stays in the same AWS account throughout — no cross-cloud migration required.

Getting Started: Prerequisites and First Steps

To deploy your first Bedrock Managed Agent, you will need:

Prerequisites:

• An AWS account with Bedrock model access enabled in a supported region
• Node.js 20+ and AWS CLI v2 installed
• Codex CLI 0.154.0+ (includes the exec-server component)
• curl with SigV4 support and jq for API interactions
• IAM permissions for Bedrock, CloudFormation (for AgentCore), and related services

Step-by-step deployment:

1. Deploy IAM roles and infrastructure — Use the AWS CDK starter kit: cdk bootstrap followed by npm run deploy. This creates the VPC, subnets, NAT gateway, S3 buckets, and IAM roles required for AgentCore Runtime.
2. Create a session — Via CLI or the REST API, specifying the model (e.g., gpt-5.6-luna), system instructions, tool definitions, and execution environment.
3. Attach the exec server — For self-hosted: start codex exec-server on your machine. For AgentCore: the runtime provisions automatically.
4. Submit turns — Send messages via the REST API (SigV4 signed). Each submission is async; poll items or stream events for results.
5. Implement tools — Build MCP servers or direct tool implementations in your execution environment. Start with simple tools (database queries, API calls) before adding complex workflows.

The API surface is intentionally minimal: seven operations on the bedrock-mantle regional endpoint handle the full lifecycle (create/list/retrieve/delete sessions, submit turns, stream events, list items).

Production Considerations: Cost, Security, and Scaling

Cost Management

BMA costs have three components that architects must budget for independently:

1. Model inference — The dominant cost for most workloads. GPT-5.6 Luna at $0.22/M input tokens is the cost-efficient default; GPT-6.1 Sol at $2.20/M is 10x more expensive but significantly more capable for complex reasoning chains.
2. AgentCore Runtime — Compute costs that pause during I/O waits. For agents that spend most of their time waiting for model responses (which is typical), actual CPU billing is much lower than wall-clock time would suggest.
3. Infrastructure overhead — The NAT gateway ($33/month baseline) and S3 storage are fixed costs that apply whether agents are active or idle. For low-volume deployments, self-hosted mode avoids this overhead entirely.

Cost optimization tip: For development and testing, use self-hosted mode with GPT-5.6 Luna to minimize costs. Reserve AgentCore Runtime and premium models for production workloads where isolation and performance justify the overhead.

Security Architecture

BMA’s security model is built on three principles that align well with enterprise compliance requirements:

• Data residency — All inference occurs within your selected AWS region. No data crosses region boundaries or leaves AWS infrastructure.
• Zero-trust execution — The three-identity IAM model (caller, session role, exec environment) enforces least-privilege at every layer. The exec server’s outbound-only connection means no inbound attack surface.
• Audit trail — CloudTrail captures all API calls. The items system provides a durable record of every agent action, tool invocation, and result — critical for regulated industries where you need to explain why an agent made a specific decision.

However, prompt injection defense remains a customer responsibility. BMA’s security guidance explicitly treats external inputs (tool results, user messages) as untrusted, but the actual filtering and validation logic must live in your tools and application layer.

Scaling Considerations

In the AgentCore Runtime model, each session gets its own Firecracker microVM — horizontal scaling is inherent. However, the current preview imposes per-account session limits (not publicly documented) and region restrictions. For high-volume production deployments, engage your AWS account team to discuss limit increases before going live.

Strategic Implications: What Futurum Research and the Market Are Saying

Futurum Research’s analysis frames BMA as part of a broader three-layer agent stack play by AWS, contesting procurement (billing consolidation), identity (IAM-based agent governance), and observability (CloudTrail + CloudWatch) simultaneously. The analysts note that “AWS is hosting a competitor’s inference runtime at margin-positive scale” — a structural repositioning that prioritizes platform revenue over model exclusivity.

Salesforce, as a launch customer, validates the enterprise appetite. Joe Inzerillo, Salesforce’s technology leader, stated that with BMA, “data never leaves AWS, and security stops being the bottleneck” — a sentiment that resonates with any enterprise that has stalled an AI project over data residency concerns.

The competitive dynamics are clear: BMA directly challenges Azure’s previous lock on OpenAI enterprise deployments. GitHub Copilot’s response — whether Microsoft extends multi-cloud billing or doubles down on Azure-only differentiation — will shape the next phase of the cloud AI wars. For enterprise buyers, this is unambiguously good news: more deployment options, more pricing competition, and fewer vendor lock-in concerns.

FAQs

Can I use non-OpenAI models with Bedrock Managed Agents?

No. BMA is specifically built on OpenAI’s Agents API and only supports OpenAI models available on Bedrock. For multi-model agent strategies, use Bedrock AgentCore, which supports models from Anthropic, Cohere, Mistral, Meta, and Amazon alongside OpenAI.

How does BMA compare to running OpenAI agents directly via the OpenAI API?

The core agent capabilities are similar (both use the Agents API), but BMA adds AWS-native IAM authentication, VPC isolation, CloudTrail logging, and data residency guarantees. The trade-off is a ~10% pricing premium and the current preview limitations (no subagents, no image input, no remote MCP). Choose BMA when compliance and data sovereignty are requirements; choose the direct API for maximum feature availability and lower cost.

Can BMA agents interact with my existing UiPath or Automation Anywhere bots?

Yes, through MCP tools or direct API integration. Build an MCP server that wraps your RPA orchestrator’s API (UiPath Orchestrator API, Automation Anywhere Control Room API), and your BMA agent can trigger bot executions, check bot status, and handle exceptions. The agent and bots coexist — the agent handles reasoning, the bots handle deterministic UI automation.

When will BMA reach General Availability?

AWS has not published a specific GA date. The initial limited preview launched April 29, 2026, with public preview following September 29, 2026. Based on typical AWS preview-to-GA timelines, GA is expected in late 2026 or early 2027. Key GA additions are expected to include image/file input, subagent orchestration, remote MCP, and customer-managed KMS keys.

Is BMA suitable for high-volume automation at scale?

The AgentCore Runtime model supports horizontal scaling via per-session microVMs, but the current preview has undocumented per-account session limits. For high-volume production use, engage your AWS account team for limit increases. The async API design and event streaming architecture are built for scale, but real-world throughput benchmarks are not yet publicly available.

Key Takeaways

• BMA closes the procurement gap — OpenAI’s frontier models now run natively inside AWS with IAM, VPC, and CloudTrail integration. Enterprises no longer choose between “best AI models” and “data stays in AWS.”
• The architecture is security-first — Outbound-only exec servers, three-identity IAM separation, and Firecracker microVM isolation deliver defense-in-depth without proprietary auth layers.
• Pricing is transparent but not cheap — The ~10% Bedrock premium over direct OpenAI pricing buys data residency and AWS billing consolidation. AgentCore Runtime adds compute costs but pauses billing during I/O waits.
• Preview limitations are real — No multi-agent orchestration, no image input, no remote MCP, and no long-term memory in the current preview. Plan for external orchestration (Step Functions) and memory (DynamoDB) if you need these capabilities now.
• RPA integration is viable today — Wrap your RPA orchestrator’s API as an MCP tool and let BMA agents handle reasoning and exception management while bots execute deterministic workflows.
• The competitive landscape just shifted — AWS hosting OpenAI’s agent runtime at scale pressures Azure and Google to respond. Enterprise buyers benefit from more choice and lower switching costs.

What to Read Next

If you are evaluating how BMA fits into your broader agentic automation strategy, these related guides provide the surrounding context:

• A2A Joins MCP at the Agentic AI Foundation — Understand the protocol layer that enables multi-vendor agent interoperability, including how MCP servers work with BMA.
• Automation Anywhere vs UiPath Procure-to-Pay — For teams evaluating which RPA platform to pair with BMA agents for end-to-end process automation.
• Microsoft Agent Framework 1.0 and Foundry Agent Service — The Azure-side competitor to BMA, with native multi-agent orchestration that BMA currently lacks.
• NVIDIA Open Agent Safety Platform — Agent governance and safety patterns applicable to any agent runtime, including BMA.

References

1. AWS. “Amazon Bedrock Managed Agents powered by OpenAI.” aws.amazon.com/bedrock/managed-agents-openai
2. AWS Blog. “AWS Weekly Roundup: Amazon Bedrock Managed Agents powered by OpenAI, October 5, 2026.” aws.amazon.com/blogs/aws
3. Eesel.ai. “Amazon Bedrock Managed Agents explained: OpenAI’s agent harness inside your AWS account.” eesel.ai/blog/bedrock-managed-agents
4. The Next Web. “OpenAI’s agents can now run entirely inside Amazon’s cloud.” thenextweb.com
5. Futurum Group. “AWS Pushes the Agent Stack: Quick, Connect Verticals, OpenAI on Amazon Bedrock.” futurumgroup.com
6. TechWyse. “OpenAI Models, Codex, and Managed Agents Now Available on Amazon Bedrock After Microsoft Exclusivity Ends.” techwyse.com
7. Xebia. “Amazon Bedrock AgentCore: The runtime foundation for building, deploying, and scaling AI agents.” xebia.com
8. AWS. “Introducing Amazon Bedrock AgentCore: Securely deploy and operate AI agents at any scale.” aws.amazon.com/blogs/aws
9. Diginomica. “UiPath explains hybrid automation architecture: why agents need workflows.” diginomica.com

Published on rpabotsworld.com — Agentic AI Architecture for RPA Professionals