Configure the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US)

The ChatGPT desktop app is now accessible on Amazon Bedrock in AWS GovCloud (US), offering entry to OpenAI’s frontier fashions via two elements. Work completes advanced, multi-step duties and delivers review-ready outcomes, and Codex is a coding agent for creating, testing, and reviewing software program.

This walkthrough is meant for organizations whose safety structure requires mannequin inference to make use of AWS GovCloud (US) identities, endpoints, and Regional controls. It configures Codex to route mannequin requests via Amazon Bedrock Mantle in us-gov-west-1, the place entry will be ruled utilizing AWS Identification and Entry Administration (IAM) and present AWS GovCloud (US) community controls.

Codex is the OpenAI coding agent for AI-powered software program improvement. With GPT fashions powering inference, Codex introduces a brand new class of intelligence optimized for advanced, long-horizon developer workflows. You should utilize the ChatGPT desktop app, the Codex CLI, and IDE integrations with Visible Studio Code, JetBrains, and Xcode. Mannequin inference is routed via the Responses API on Amazon Bedrock.

For patrons with knowledge residency necessities, processing stays throughout the Amazon Bedrock AWS Area that you choose. You pay per token with no seat licenses and no per-developer commitments. Zero knowledge retention (ZDR) can be supported. On this configurable mode, prompts and responses are processed with out being written to sturdy storage by AWS or shared with mannequin suppliers. This helps you defend delicate info and meet stringent data-governance, privateness, and safety necessities.

This submit walks via a managed native deployment of the ChatGPT desktop app that sends mannequin inference to Amazon Bedrock in AWS GovCloud (US-West). The configuration makes use of API-mode sign-in, a managed gadget coverage, a named AWS profile, and community restrictions. These restrictions enable entry solely to the accepted Amazon Bedrock endpoint whereas disabling different exterior connections and network-enabled capabilities. The result’s a deployment that an company safety staff can take a look at and doc earlier than approving broader use.

Utilizing AWS GovCloud (US) and following this information don’t, by themselves, authorize your workload. Your group stays chargeable for reviewing the chosen mannequin, AWS companies, Area, endpoint, workstation controls, repositories, credentials, and knowledge flows in opposition to its system safety plan and authorization course of.

Answer overview

You should utilize the ChatGPT desktop app in two methods:

• Work for bigger duties that want planning, analysis, information, and a completed consequence.
• Codex for technical work similar to enhancing code, operating exams, and reviewing pull requests.

The ChatGPT desktop app runs on an organization-managed pc via the desktop app or CLI. It makes use of the configured AWS credentials to securely ship requests to the Amazon Bedrock Mantle endpoint in us-gov-west-1. As a result of this setup makes use of AWS straight, ChatGPT workspace guidelines and person roles don’t management it. The principle safety controls are the pc’s insurance policies and the AWS id and permissions getting used.

Walkthrough

The configuration has three important steps: arrange authentication, arrange the ChatGPT desktop app configuration information, after which launch, initialize, and confirm the deployment.

Stipulations

Earlier than establishing the ChatGPT desktop app with AWS GovCloud (US), make certain your model of the ChatGPT desktop app helps Amazon Bedrock in AWS GovCloud (US). You want an accepted AWS GovCloud (US) account, an IAM id and accepted credentials, entry to the accepted mannequin, AWS Area, and endpoint, and permission to make use of them. You additionally must arrange the necessities.toml and config.toml information.

Step 1: Arrange authentication

Choose the accepted AWS GovCloud (US) account and IAM id or function with entry to the accepted mannequin in us-gov-west-1. Get hold of credentials via your group’s accepted mechanism. This walkthrough makes use of the named profile codex-il5. Maintain credentials, bearer tokens, session tokens, and different secrets and techniques out of TOML information.

Shield the profile configuration, credential supply, SSO token cache, and any credential helper from ChatGPT desktop app process writes, whereas permitting accepted authentication instruments to keep up and refresh credentials.

The ChatGPT desktop app helps two Amazon Bedrock authentication pathways: an Amazon Bedrock API key or the AWS SDK credential chain. AWS SSO via AWS IAM Identification Heart is supported throughout the credential-chain pathway.

The app first checks for AWS_BEARER_TOKEN_BEDROCK in its setting. For desktop use, this variable will be provided via %USERPROFILE%.codex.env on Home windows or ~/.codex/.env on Linux and macOS. When current, the bearer token takes priority over profile-based authentication.

If no bearer token is accessible, the app falls again to the usual AWS SDK credential chain. The chain can learn AWS credentials from ~/.aws/credentials and associated profile settings from ~/.aws/config. On Home windows, the corresponding default paths are %USERPROFILE%.awscredentials and %USERPROFILE%.awsconfig. The chain additionally helps SSO profiles. For SSO, it makes use of the profile settings within the AWS config file and the cached SSO session to acquire momentary function credentials. These credentials don’t have to be manually saved within the AWS credentials file. See OpenAI’s Bedrock authentication documentation and the AWS IAM Identification Heart credential supplier documentation.

Step 2: Arrange ChatGPT desktop app configuration information

You could create two ChatGPT desktop app configuration information: config.toml and necessities.toml.

Essential: the configuration information have to be arrange earlier than the applying is launched. The next desk reveals the file places.

Begin from the necessities.toml file. necessities.toml is an administrator-controlled guidelines file. It units safety limits that customers can’t override, for instance, limiting which permission ranges, instruments, or settings the ChatGPT desktop app is allowed to make use of.

Use the next baseline for the supported AWS GovCloud (US) Amazon Bedrock deployment. The [windows] part applies solely to Home windows, and sandbox_private_desktop should be supported by the accepted runtime.

allowed_login_methods = ["api"]
allowed_sandbox_modes = ["read-only", "workspace-write"]
allowed_approvals_reviewers = ["user"]
allowed_approval_policies = [
{ granular = { sandbox_approval = false, rules = true,
mcp_elicitations = false, request_permissions = false,
skill_approval = true } },
]
allowed_web_search_modes = ["disabled", "cached"]
allow_browser_and_computer_use = false
allow_appshots = false
allow_remote_control = false
allow_login_shell = false
allow_managed_hooks_only = true
check_for_update_on_startup = false
mcp_servers = {}

[feedback]
enabled = false

[features]
network_proxy = true
in_app_chat = false
in_app_dictation = false
in_app_browser = false
browser_use = false
browser_use_external = false
browser_use_full_cdp_access = false
computer_use = false
in_app_updates = false
image_generation = false
recollections = false
chronicle = false
external_agent_memory_import = false
guardian_approval = false
guardianv2 = false
guardian_ext = false
apps = false
enable_mcp_apps = false
plugins = false
remote_plugin = false
plugin_sharing = false
recommended_plugins = false
skill_mcp_dependency_install = false
skill_search = false
workspace_dependencies = false
hooks = false
standalone_web_search = false

[experimental_network]
enabled = true
managed_allowed_domains_only = true
domains = {}
unix_sockets = {}
allow_upstream_proxy = false
dangerously_allow_non_loopback_proxy = false
dangerously_allow_all_unix_sockets = false
allow_local_binding = false

[application.network]
enabled = true

[application.network.domains]
"bedrock-mantle.us-gov-west-1.api.aws" = "enable"
"api.openai.com" = "deny"
"chat.openai.com" = "deny"
"chatgpt.com" = "deny"
"ab.chatgpt.com" = "deny"
"platform.openai.com" = "deny"
"auth.openai.com" = "deny"
"gov.api.openai.com" = "deny"
"gov.chatgpt.com" = "deny"
"sdfedpreastus2.oaiusercontent.com" = "deny"
"o33249.ingest.us.sentry.io" = "deny"
"persistent.oaistatic.com" = "deny"
"oaisidekickupdates.blob.core.home windows.web" = "deny"

[windows]
allowed_sandbox_implementations = ["elevated"]
sandbox_private_desktop = true

Subsequent, configure the config.toml file. config.toml tells the ChatGPT desktop app how you can function, together with which mannequin supplier to make use of (amazon-bedrock), which mannequin to pick, and settings similar to permissions or context limits.

Substitute the mannequin ID and named profile (for instance, codex-il5) with accepted values.

mannequin = "REPLACE_WITH_APPROVED_MODEL_ID"
model_provider = "amazon-bedrock"
forced_login_method = "api"
approval_policy = { granular = { sandbox_approval = false,
guidelines = true, mcp_elicitations = false,
request_permissions = false, skill_approval = true } }
approvals_reviewer = "person"
sandbox_mode = "workspace-write"
web_search = "cached"
allow_login_shell = false
check_for_update_on_startup = false

[model_providers.amazon-bedrock]
base_url = "https://bedrock-mantle.us-gov-west-1.api.aws/openai/v1"
wire_api = "responses"
requires_openai_auth = false
supports_websockets = false
supports_standalone_web_search = false

[model_providers.amazon-bedrock.aws]
area = "us-gov-west-1"
profile = "codex-il5"

[sandbox_workspace_write]
network_access = false

[features]
network_proxy = true

[analytics]
enabled = false

[feedback]
enabled = false

[otel]
exporter = "none"
trace_exporter = "none"
metrics_exporter = "none"
log_user_prompt = false

[memories]
generate_memories = false
use_memories = false

[skills.bundled]
enabled = false

[apps._default]
enabled = false

[windows]
sandbox = "elevated"

Step 3: Launch, initialize, and confirm

Obtain the app from the ChatGPT web site and set up it. Go away the app closed after set up. If it opens routinely or if the app has been launched beforehand, absolutely exit ChatGPT and finish any lingering ChatGPT or Codex processes.

Make sure that necessities.toml and config.toml are in place earlier than the primary app launch.

Begin the app to load the necessities.toml and config.toml settings. Make sure that it reveals amazon-bedrock because the mannequin supplier.

Within the Codex CLI, you must see a /standing tab that appears like this:

Determine 1: The Codex CLI /standing tab confirming amazon-bedrock because the mannequin supplier

Within the ChatGPT desktop app, you may also verify amazon-bedrock because the mannequin supplier.

Determine 2: The ChatGPT desktop app settings displaying amazon-bedrock because the mannequin supplier

Troubleshooting

The appliance prompts for an OpenAI account. Confirm that necessities.toml and config.toml use the precise places and file names proven within the previous desk, terminate all ChatGPT and Codex processes, and relaunch. The information should precede app launch.

AWS GovCloud (US) endpoint is reported as unsupported. Affirm the precise desktop or app-server launch, endpoint, and mannequin with OpenAI. Altering the URL alone doesn’t set up assist.

The incorrect AWS id is used. Examine the efficient credential supply and named profile. Test whether or not an Amazon Bedrock API key takes priority over the profile.

Functionality restrictions are lacking. Examine the total efficient necessities after restart. The API-only sign-in setting doesn’t apply the potential coverage.

Rollback and cleanup

If a validation examine fails, cease the rollout. Return the affected gadgets to the beforehand accepted coverage and supplier settings, then restart the ChatGPT desktop app. Revoke any momentary AWS credentials or API keys, and make sure that these gadgets can now not hook up with Amazon Bedrock. Maintain a file of the take a look at and clearly doc what failed earlier than attempting once more.

Conclusion

The ChatGPT desktop app on Amazon Bedrock in AWS GovCloud (US) provides you a managed method to make use of OpenAI frontier fashions and coding help. Inference stays within the AWS GovCloud (US) Areas. By validating the configuration, confirming the accepted AWS id and endpoint, and verifying safety controls, you may confidently put together the deployment for broader use. This method helps innovation whereas aligning deployment selections with every group’s safety, authorization, and data-handling necessities.

Able to discover the ChatGPT desktop app with Codex on Amazon Bedrock in AWS GovCloud (US)? Begin with a managed deployment, validate your safety controls, and work along with your safety staff to arrange for broader adoption.

In regards to the authors