AWS has published an enterprise implementation guide for deploying OpenAI Codex on Amazon Bedrock, detailing how platform teams can configure access paths between developer workstations and AWS infrastructure.
The November 11, 2026, guidance outlines three primary deployment patterns: Native AWS Access, AgentCore Gateway, and LLM gateways like LiteLLM. While Native AWS Access and AgentCore Gateway simplify routing and guardrails, the guide notes they lack built-in hard per-user spending limits. Consequently, teams requiring strict budget enforcement must evaluate gateway-based architectures before expanding beyond initial pilots.
The post documents deployment and migration choices, not a new Codex model release. Its recommended starting point is a small, least-privilege pilot using Native AWS Access. Teams can then choose AgentCore Gateway for AWS-managed routing and Bedrock Guardrails, or an LLM gateway for centralized request-path controls.
The most consequential detail sits in the accompanying open-source quickstart: managed routing and hard spending limits are different capabilities. A deployment can have corporate sign-in, centralized routing and content guardrails while still lacking a mechanism to stop an individual user at a defined spending limit.
That distinction should shape the architecture before access expands beyond a pilot.
Codex Stays Local; the Model Access Path Changes
Codex continues to run on the developer’s workstation in every architecture described by AWS. The deployment configures the path between that local agent and Bedrock.
The Guidance for Codex on AWS repository explains the gateway request loop: Codex sends task context and tool definitions to a gateway, which authenticates the request, applies configured policies and forwards it to Bedrock Runtime. When the model requests a tool, Codex executes it locally and sends the result in a subsequent turn.
This separation matters for governance. Centralizing inference does not move local tool execution into a managed AWS environment. Platform teams still need rules for workstation configuration, approved skills and Model Context Protocol, or MCP, servers.
My view is that this is the guide’s most useful framing: there are two connected control surfaces, the local agent and its model-access path. Governing only the Bedrock endpoint leaves part of the workflow outside that design.
Choose the Path by Its Required Controls
AWS recommends selecting the simplest access path that meets the organization’s current requirements. The repository quickstart makes the decision more concrete:
Start with Native AWS Access when workforce identity, IAM permissions and usage monitoring are sufficient for the pilot.
Choose AgentCore Gateway when the team needs AWS-managed routing, Bedrock Guardrails or related gateway capabilities without operating gateway infrastructure.
Choose an LLM gateway when requests must pass through centralized enforcement, including hard per-user or per-team budgets and rate limits.
Consider custom integration only for requirements the documented patterns cannot meet. AWS describes it as the advanced form of the LLM gateway approach, not a quick start.
The important qualification is budget enforcement. In the documented patterns, Native AWS Access and AgentCore Gateway do not provide built-in hard per-user or per-team spending limits. AgentCore’s request-rate throttling is a separate control: limiting requests per minute does not define a user’s total spending allowance.
A team with mandatory spending caps should therefore evaluate the gateway path from the outset. Starting with native access can validate identity and model connectivity, but it cannot validate an enforcement capability that the pattern lacks.
How the Documented Patterns Compare
The table below summarizes the repository’s comparison. These are reference-pattern capabilities, not universal guarantees for every gateway product or configuration.
Decision point
Native AWS Access
AgentCore Gateway
LiteLLM Gateway reference
Authentication
IAM Identity Center and temporary AWS credentials
OIDC bearer token through a CUSTOM_JWT authorizer
Scoped gateway key, with optional OIDC mapping
Request path
Codex directly to Bedrock
Codex through a managed gateway
Codex through a customer-operated gateway
Additional infrastructure operated by the customer
None for the access path
Managed/serverless gateway
ECS, RDS and Application Load Balancer
Hard per-user or team budgets
Not built in
Not built in
Configured in the gateway
Individual attribution in Bedrock-side records
Native per-user attribution described by the guide
Gateway IAM role
Gateway IAM role
Individual usage reporting
AWS identity and usage records
Gateway telemetry
Gateway telemetry and spend logs
The quickstart specifically warns that gateway capabilities vary by product, version and tier. Teams should verify the selected implementation’s enforcement behavior before relying on it for financial controls.
Build a Least-Privilege Native AWS Pilot
The AWS walkthrough separates identity validation, model access and Codex configuration into distinct checks. That sequence is worth preserving because it narrows troubleshooting.
Prepare Identity, Permissions and Model Access
Create a dedicated pilot group in the workforce identity system and provision it into IAM Identity Center. AWS’s example uses Okta for SAML authentication and SCIM provisioning of users and groups. IAM Identity Center then supplies temporary AWS credentials; the identity provider is not configured inside Codex.
Before developers begin:
Select an approved AWS account, Region and supported OpenAI model.
Confirm access to the required inference path, including an inference profile if the selected API requires one.
Grant only the model-inference permissions needed by Codex, direct validation commands and the chosen observability destination.
Use a non-production repository and name a rollback owner.
AWS’s examples use GPT-5.6 Sol. The post directs readers to check Sol, Terra and Luna separately against Bedrock’s supported-models-by-Region documentation. Those names are not evidence that every model is available in every account, Region or inference path.
Validate Bedrock Before Configuring Codex
With AWS CLI v2 and an IAM Identity Center profile configured, the guide’s example can be expressed as:
These commands sign in, select the AWS profile for the current shell and request a short response from Bedrock Runtime. The model identifier and Region are AWS’s example values; confirm their availability and authorization before using them.
If the direct request fails, resolve the AWS profile, IAM permissions, Region, model or inference-profile access first. Adding Codex at that point would introduce another configuration layer without fixing the underlying access problem.
After the direct call succeeds, configure Codex’s amazon-bedrock provider using the repository’s native-access quickstart. Then run a limited task in the non-production repository, such as requesting a code summary without file changes.
I’d keep those validation results separate in the rollout checklist. A successful Bedrock call verifies one dependency; a successful Codex task checks that the client configuration connects correctly to it. Neither alone demonstrates that telemetry or spending policy works.
Gateway Choices Change Both Operations and Accountability
AgentCore Gateway offers a managed control point for routing and configured Bedrock Guardrails. The repository also lists AWS-private web search as an available capability, related to Zeniteq’s coverage of standalone web search in Bedrock AgentCore.
LiteLLM on ECS introduces more infrastructure ownership. The reference requires operating ECS, RDS and an Application Load Balancer, while providing gateway policy, budgets and rate limits. The repository identifies it as its most complete deployable reference implementation.
Portkey is another documented option. Its reference uses a customer-operated EKS data plane and a Portkey-managed control plane, with a Workspace Service API key and gateway logs. Those operational boundaries differ from LiteLLM’s, so “LLM gateway” should not be treated as one interchangeable deployment.
A custom integration adds another responsibility: the platform team must design and maintain the request-path controls itself. AWS explicitly positions this as an advanced option.
Central Routing Moves the Attribution Boundary
The quickstart’s attribution note describes a tradeoff that deserves attention before migration. Native access preserves per-user attribution in Bedrock CloudTrail and AWS Cost and Usage Reports. Gateway paths expose the gateway IAM role to those systems; individual reporting comes from gateway telemetry and spend logs.
The practical consequence is an additional dependency for chargeback and investigations. Once requests share a gateway role, Bedrock-side records alone cannot provide the same individual breakdown described for native access.
I’d require a sample user-and-team usage report before expanding a gateway pilot. That checks whether the identity seen at sign-in survives into the records finance and security actually need.
Assign Owners Before Expanding Access
AWS asks platform teams to decide approved users, models and Regions, configuration ownership, telemetry, usage allocation, and permitted skills or MCP servers. An actionable ownership map could look like this:
Identity and IAM: The identity team owns pilot-group membership, permission sets, temporary-session policy and access withdrawal procedures.
Client configuration: Developer platform owners maintain approved provider settings, model identifiers, Region choices and the configuration distribution process.
Gateway operations: The platform team owns routing policy, secrets and deployment lifecycle, with infrastructure responsibilities matched to the selected pattern.
Telemetry: Observability owners define collection, access and retention. The repository documents native Codex OpenTelemetry, an AWS Distro for OpenTelemetry collector, and CloudWatch integration.
Cost allocation: FinOps defines user and team mappings, reporting requirements, alert thresholds and whether blocking limits are mandatory.
Skills and MCP servers: Developer tooling and security owners define which extensions and external connections are permitted.
The proposed team assignments above are an implementation recommendation; AWS supplies the decisions that need ownership.
The repository says an ADOT collector can add organizational attribution and sign telemetry exports to CloudWatch. Gateway paths also supply server-side metrics and logs. Those components provide collection mechanisms, but useful reporting still depends on consistent identity and team mappings.
Before widening access, the rollout should demonstrate the required controls: approved users can reach approved models, configuration changes have an owner, usage reaches the intended reporting destination, and any mandatory blocking policy behaves as expected. This analysis draws on AWS’s guide and its linked repository, not independent deployment testing.
The migration decision becomes clearer when framed that way. Native access is a sensible low-overhead pilot. A gateway earns its operational cost when the organization needs controls that must sit directly in the request path.
Frequently Asked Questions
3 questions
1
Is This a New Codex Model Release?
No. AWS’s November 11 guide explains how to deploy Codex with Bedrock-backed inference and enterprise controls. Its model examples support that implementation walkthrough.
2
Does AgentCore Gateway Enforce Hard Spending Limits?
The documented pattern does not provide built-in hard per-user or per-team budgets. The quickstart directs teams needing those controls toward an LLM gateway.
3
What Does the Native AWS Pilot Require?
The quickstart lists AWS CLI v2, an AWS account with setup permissions, Bedrock access in the target Region and a SAML-capable identity provider connected to IAM Identity Center. Pilot users also need appropriately scoped inference permissions.
