AWS: lock ChatGPT desktop and Codex to Bedrock in GovCloud

AWS published a how-to on 30 October 2026 for running the ChatGPT desktop app and its Codex coding agent against Amazon Bedrock in AWS GovCloud (US), so that model requests use AWS identities and endpoints rather than an OpenAI account. The post is by AWS solutions staff Virgil Ennes and Sean Phuphanich. It is a configuration walkthrough, not a customer story, and it reports no results.

What the setup does

According to the post, the app runs on an organisation-managed computer and sends requests to the Amazon Bedrock Mantle endpoint in us-gov-west-1, using the Responses API. AWS says data residency follows the Bedrock region you choose, billing is per token with no seat licences, and zero data retention is supported as a configurable mode.

One consequence is spelled out: because the setup talks to AWS directly, ChatGPT workspace rules and user roles do not control it. The authors say the main controls are the computer's policies and the AWS identity and permissions in use.

The controls in the admin file

The walkthrough centres on two files. The admin-owned requirements.toml sets limits users cannot override; the user's config.toml selects the provider and model. AWS's baseline for the admin file includes:

• Sign-in restricted to API mode, with sandbox modes limited to read-only and workspace-write.
• Browser use, computer use, remote control, login shells, plugins, memories and MCP servers switched off.
• Network access limited to one allowed domain, the us-gov-west-1 Bedrock Mantle host, with api.openai.com, chatgpt.com, auth.openai.com and nine other OpenAI, update and telemetry hosts set to deny.
• In config.toml, network access inside the workspace sandbox set to false, analytics and feedback off, and prompt logging off.

Credentials come either from an Amazon Bedrock API key in the AWS_BEARER_TOKEN_BEDROCK variable or from the standard AWS credential chain, including IAM Identity Center single sign-on. The example uses a named profile, codex-il5, and tells readers to keep secrets out of the TOML files and to protect the profile and token cache from the agent's own task writes.

Where it can go wrong

The troubleshooting section is the most practical part. AWS says the files must be in place before the app first launches, and that if the app asks for an OpenAI account you should end every ChatGPT and Codex process and relaunch. It warns that a Bedrock API key takes precedence over the profile, so the wrong identity can be used without any error.

It also says that setting the API-only sign-in does not by itself apply the capability policy, so teams should inspect the full effective requirements after a restart. If the endpoint is reported as unsupported, the post says to confirm the exact app release, endpoint and model with OpenAI, because changing the URL alone does not establish support.

What the post leaves out

• No model is named; the config uses the placeholder REPLACE_WITH_APPROVED_MODEL_ID.
• No prices, latency or quota figures are given.
• No agency or customer is described as running it, and the verification step is a screen check that the provider shows amazon-bedrock.
• The post says the app version must support Bedrock in GovCloud but does not say which versions do.

AWS is explicit that GovCloud and this guide do not authorise a workload on their own. For a team in a regulated environment, the portable idea is the pattern: an admin-owned policy file, a deny-by-default network list with one approved host, and a written rollback. The post's rollback is to return devices to the previous policy, revoke temporary credentials, confirm the devices can no longer reach Bedrock, and record what failed.