AWS’s GovCloud walkthrough configures Codex in the ChatGPT desktop app to send model requests through Amazon Bedrock Mantle in us-gov-west-1. Before configuring the app, accept the model’s EULA through the standard AWS account linked to GovCloud, then enable the model in the GovCloud account. The steps below follow that order and cover credentials, files, network controls, and the provider check.
Models AWS lists for GovCloud
AWS lists GPT-5.4 for in-region Bedrock Mantle in us-gov-west-1. Its regional table also lists gpt-oss-120b and gpt-oss-20b in both GovCloud regions, us-gov-west-1 and us-gov-east-1. Use the model ID approved for your account; the desktop setup calls for an approved ID rather than one universal value. A regional listing is a catalog entry, not account activation. (AWS regional model documentation)
Enable model access before configuring Codex
AWS documents a two-part access sequence:
- Accept the model EULA through the standard AWS account linked to your GovCloud account. AWS specifies
us-east-1orus-west-2for this step. - Enable the model in GovCloud. In the GovCloud account, use the model’s access controls to enable it. AWS says entitlement propagation may take a few minutes.
The desktop setup is specifically for Codex, OpenAI’s coding agent. It uses Bedrock Mantle in us-gov-west-1, the endpoint https://bedrock-mantle.us-gov-west-1.api.aws/openai/v1, and the Responses API. Before proceeding, have an approved GovCloud account, IAM identity, model, region, endpoint, and permissions. Confirm that the installed desktop-app version supports the GovCloud route.
Choose credentials and prepare the files
AWS describes two credential routes: a Bedrock API key or the AWS SDK credential chain, which can include an IAM Identity Center SSO profile. If AWS_BEARER_TOKEN_BEDROCK is present, Codex uses it before profile-based credentials. Keep secrets out of TOML files.
The administrator-controlled requirements.toml and user config.toml must both be in place before you launch the app. AWS gives these locations:
| Operating system | config.toml | requirements.toml |
| Windows | %USERPROFILE%\.codex\config.toml | %ProgramData%\OpenAI\Codex\requirements.toml |
| Linux or macOS | ~/.codex/config.toml | /etc/codex/requirements.toml |
In config.toml, select amazon-bedrock, the approved model ID, the GovCloud Mantle endpoint, and us-gov-west-1. Set the API to Responses. Use your organization’s approved model and identity choices rather than copying an example profile name as a requirement.
Set network controls and review data handling
AWS’s network-policy example allows bedrock-mantle.us-gov-west-1.api.aws and denies the listed OpenAI and other external domains. It also disables several network-enabled capabilities. The example is not a universal agency policy; apply the controls your organization requires. For this direct-to-AWS setup, AWS says ChatGPT workspace rules and user roles do not govern the requests. The workstation policy and AWS identity and permissions are the principal controls in this arrangement.
AWS describes configurable zero data retention (ZDR) for prompts and responses: in that mode, AWS says they are processed without being written to durable storage by AWS or shared with model providers. AWS’s GovCloud service guide separately says certain customer-defined metadata may leave GovCloud when the customer asks AWS to investigate a reported issue. It also says model-evaluation metadata cannot contain export-controlled data. (AWS GovCloud service guide)
Launch and check the provider
Launch the desktop app only after both files are in place. Check that amazon-bedrock appears as the provider in the app or in Codex CLI’s /status view.
AWS’s guide describes stopping rollout, restoring prior settings, revoking temporary keys or credentials, and documenting the failure if validation fails. AWS assigns the organization responsibility for assessing the model, region, endpoint, workstation controls, credentials, repositories, and data flows under its own workload-authorization process.
