Overview

The ChatGPT desktop app is a conversational AI integrated application from OpenAI for macOS, Windows, and Linux. Codex CLI is an AI terminal-native coding agent created by OpenAI that reads, edits, and execute code. Both ChatGPT Work and Codex support OpenAI frontier models on Amazon Bedrock Runtime and Mantle endpoints. This article covers how to configure them to use Bedrock Runtime

This article covers ChatGPT/Codex. Similar articles are available for Claude Code CLI and Claude Desktop

Requirements

You will need the following

• Amazon Bedrock access to OpenAI models
• AWS CLI installed and configured
• IAM permission access to Bedrock

Bedrock model access

Request Bedrock model access by selecting and interacting with a ChatGPT frontier model from the model catalog in the Amazon Bedrock console playground in your desired AWS Region.

Create a support case if you are unable to use any models.

IAM permission / IAM Identity Center permission set

Your AWS profile must have the following permissions

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:ListInferenceProfiles",
        "bedrock:GetInferenceProfiles"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Condition": {
        "StringEquals": {
          "aws:CalledViaLast": "bedrock.amazonaws.com"
        }
      },
      "Action": [
        "aws-marketplace:Subscribe",
        "aws-marketplace:ViewSubscriptions"
      ],
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

If you are using IAM Identity Center (IdC), create a permission set with the above as inline policy. Assign your user or group access to your AWS account with the created permission set.

Install AWS CLI

Installation files

To install, you can download latest binaries/installer

• Windows : https://awscli.amazonaws.com/AWSCLIV2.msi
• Mac OS: https://awscli.amazonaws.com/AWSCLIV2.pkg
• Linux: https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip

Do refer to AWS CLI documentation for guidance and other installation options.

To verify

aws --version

Output should be similar to below

aws-cli/2.35.20 Python/3.14.6 Windows/11 exe/AMD64

Configure AWS CLI profile

You need to configure AWS credentials on your local machine. The server uses these credentials to authenticate your requests.

Do secure your AWS credentials as credential theft can lead to LLMJacking attacks

Option 1: AWS Management Console credentials

If you have username and password that allows you to sign in to the console.

aws login

Option 2: AWS SSO (IAM Identity Center)

If you login using organization instance of IAM Identity Center

aws configure sso

Follow the prompts to set up as per your Identity Center configuration

SSO session name (Recommended): BedrockInference
SSO start URL [None]: https://d-12345678.awsapps.com/start
SSO region [None]: ap-southeast-1
SSO registration scopes [sso:account:access]:
Attempting to open your default browser. If the browser does not open, open the following URL.
If you are unable to open the URL on this device, run this command again with the '--use-device-code' option.

Option 3: IAM User

If you have a IAM user

aws configure

Enter your Access Key ID, Secret Access Key, default region, and output format.

Option 4: EC2 Instance

On EC2 instances with no AWS profiles configured, AWS CLI automatically and securely retrieves the credentials from the instance metadata without additional configuration.

If you wish to configure a profile, for example EC2, that uses EC2 instance metadata

aws configure set --profile EC2 credential_source Ec2InstanceMetadata
aws configure set --profile EC2 region ap-southeast-1

Do replace ap-southeast-1 with the correct Region Code

Verify AWS profile

Do note the profile name. If you do not specify one, the profile name is usually default. You can retrieve profile name with the following command

List Profiles

aws configure list-profiles

Output could be similar to below

BedrockInference

/aws/config file

Or you can view contents of ~/.aws/config file. Example below is a AWS SSO configured profile with name BedrockInference

[profile BedrockInference]
sso_session = BedrockInference
sso_account_id = 123456789012
sso_role_name = BedrockInference
region = ap-southeast-1

[sso-session BedrockInference]
sso_start_url = https://d-12345678.awsapps.com/start
sso_region = ap-southeast-1
sso_registration_scopes = sso:account:access

Verify Bedrock access

Run the following command (using correct AWS profile name) to list OpenAI models

aws bedrock list-inference-profiles --query "inferenceProfileSummaries[?status=='ACTIVE' && contains(inferenceProfileId, 'openai.gpt')].[inferenceProfileId]" --output text --profile BedrockInference

Refer to documentation for supported models

IAM Identity Center login

For IdC, you may have to login first

aws sso login --profile BedrockInference

Install ChatGPT and Codex

ChatGPT Desktop App

Desktop app can be installed from https://learn.chatgpt.com/docs/app

Close ChatGTP app when prompted to sign-in

Important: go to task notification bar. Click ChatGPT and select Exit

Codex CLI

Codex CLI can be installed from https://learn.chatgpt.com/docs/codex/cli

PS C:\ > powershell -ExecutionPolicy ByPass -c "irm https://chatgpt.com/codex/install.ps1 | iex"
==> Installing Codex CLI
==> Detected platform: Windows (x64)
==> Resolved version: 0.157.1
==> Downloading Codex CLI
==> PATH updated for future PowerShell sessions.
==> Current PowerShell session: codex
==> Future PowerShell windows: open a new PowerShell window and run: codex
Codex CLI 0.157.1 installed successfully.
Start Codex now? [y/N]: y

Close terminal when prompted to sign in

Codex IDE extension

IDE extensions can be installed from https://learn.chatgpt.com/docs/codex/ide

Configure ~/.codex/config.toml

Configure Bedrock Runtime

Use an editor to edit ~/.codex/config.toml

Add the following text with appropriate values for model, profile and region. (Refer to ChatGPT documentation for supported models)

model_provider = "amazon-bedrock-runtime"
model = "global.openai.gpt-6-luna"
model_reasoning_effort = "medium"

[model_providers.amazon-bedrock-runtime.aws] 
profile = "BedrockInference" 
region = "ap-southeast-1" 

Save the file

Start ChatGPT/Codex

ChatGPT

You may be prompted with the welcome wizard. Proceed to main screen

Codex CLI

VS Code Codex IDE Extension

More information

Refer to official documentation Use ChatGPT Work and Codex with Amazon Bedrock for up-to-date guidance including other configuration methods

Feature availability

Refer to documentation for feature availability

Agent Toolkit for AWS

To give ChatGPT and Codex the tools, knowledge, and guardrails to build production-ready infrastructure on AWS, you can install Agent Toolkit for AWS. Refer to this article for installation guidance