Add ChatGPT Agents SDK and Amazon Bedrock AgentCore cookbook - #3057
Add ChatGPT Agents SDK and Amazon Bedrock AgentCore cookbook#3057rohan-eliza wants to merge 1 commit into
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 134c4852ef
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Stop if the account or principal is not the one returned by the access request. | ||
| If the enterprise uses the default AWS credential chain, omit `AWS_PROFILE`. | ||
|
|
||
| Run the read-only observability preflight before a credentialed invocation: |
There was a problem hiding this comment.
Document permissions needed by the required preflight
With the documented least-privilege local telemetry role, this required preflight cannot succeed: the policy only grants publishing plus logs:DescribeLogStreams, while aws-observability-preflight.sh also calls xray:GetTraceSegmentDestination, logs:DescribeResourcePolicies, logs:DescribeLogGroups, and servicequotas:ListServiceQuotas, and exits nonzero if any is denied. The linked verification policy only adds Logs Insights actions, so users following the access matrix still lack these prerequisites; either document/grant the additional read actions or specify that a separately privileged verifier must run this step.
Useful? React with 👍 / 👎.
sylvesterkaczmarek
left a comment
There was a problem hiding this comment.
One mismatch I noticed: the MCP tool schema accepts any three-character origin/destination, while RuntimeRequestSchema requires ^[A-Z]{3}$. A value like lhr therefore passes tool validation and then fails inside provider.call(). Could the tool boundary reuse the same airport-code schema or normalise to uppercase?
Summary
Adds an end-to-end Cookbook example for building a private ChatGPT flight-assistant plugin with the OpenAI Agents SDK and Amazon Bedrock AgentCore.
The contribution includes:
The content is isolated under
examples/partners/AWS/chatgpt_agents_sdk_aws_agentcore_cookbook/. A matchingregistry.yamlentry publishes the notebook on the Cookbook site.Motivation
Enterprise developers often need to connect ChatGPT to privately hosted tools without exposing a public MCP endpoint or assuming broad AWS permissions. This example provides a reproducible, least-privilege workflow with explicit credential, tracing, evaluation, and operational boundaries.
Validation
Live AWS, OpenAI trace export, and hosted Secure MCP Tunnel calls were not rerun as part of this public-repository copy; those paths remain explicitly opt-in and credential-gated.
Risk and rollback
The change adds a self-contained example plus one registry entry and does not modify existing examples. It can be rolled back by reverting the contribution commit.
For new content