Configure the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US)
The ChatGPT desktop app is now available on Amazon Bedrock in AWS GovCloud (US). This post walks through a controlled local deployment that routes model inference to Amazon Bedrock in AWS GovCloud (US-West) using API-mode sign-in, a managed device policy, a named AWS profile, and network restrictions, so a security team can validate it before broader use.
The ChatGPT desktop application is now accessible via Amazon Bedrock in AWS GovCloud (US) for organizations necessitating model inference through AWS GovCloud (US) identities, endpoints, and regional controls. This guide outlines the configuration process to route model requests through Amazon Bedrock's Mantle in us-gov-west-1, where access is governed by AWS Identity and Access Management (IAM) and existing AWS GovCloud (US) network controls.
To configure the app, follow these steps:
1. Establish authentication: Choose the approved AWS GovCloud (US) account and IAM identity or role with access to the model in us-gov-west-1. Obtain credentials through your organization's approved method, preferably using a named profile like codex-il5. Ensure credentials, bearer tokens, session tokens, and other secrets remain outside TOML files and protected from ChatGPT desktop app task writes.
2. Configure ChatGPT desktop app settings: Create two configuration files, config.toml and requirements.toml, before launching the application. The file locations vary depending on the operating system.
- Windows: %USERPROFILE%\.codex\config.toml, %ProgramData%\OpenAI\Codex\requirements.toml
- Linux: ~/.codex/config.toml, /etc/codex/requirements.toml
- macOS: ~/.codex/config.toml, /etc/codex/requirements.toml
For Windows users, the bearer token can be supplied via the %USERPROFILE%\.codex\.env environment variable. On Linux and macOS, use ~/.codex/.env for bearer token configuration.
The ChatGPT desktop app supports two authentication pathways: Amazon Bedrock API key or the AWS SDK credential chain, which can utilize AWS credentials from ~/.aws/credentials and related profile settings or SSO profiles from the AWS config file and cached SSO session.
Written by urgent.news from AWS Machine Learning's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
