For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to the page URL.
Primary navigation

Suggested

Getting started

Feature Configuration

Identity and access

Deployment and configuration

ChatGPT Work

Collaboration and sharing

Plugins and connections

Usage and analytics

Security and compliance

API Dashboard
Try ChatGPT

Bedrock GovCloud configuration

Configure local Codex workflows with Amazon Bedrock in AWS GovCloud

This guide explains how to configure Codex to perform inference against Amazon Bedrock in GovCloud. We cover AWS access, managed device settings, and network controls.

Codex configuration reference

This guide is not legal advice and does not grant an authorization to operate (ATO). Review the configuration, selected AWS services, endpoint controls, and data flows with your security and authorizing officials against your agency’s requirements and system security plan.

Shared responsibility

Review the AWS shared responsibility model and your selected services’ documentation to understand which controls AWS provides. Your agency is responsible for authorizing their use.

In a supported deployment, Codex sends inference requests to the configured Bedrock endpoint using AWS authentication. Your organization secures the devices running Codex, including credentials, repositories, local records, and enabled third-party services. Using GovCloud for inference does not establish that the entire workflow meets your agency’s requirements.

Codex client

Verification checklist · Feature settings

Before you begin

Use desktop app version 26.1002.51308 or later, as shown in About.

Prepare What you need
AWS access An AWS GovCloud account with access to the Bedrock model you’ll use.
Configuration A reviewed requirements.toml, approved network destinations, and rollback instructions.
Device management System configuration or MDM access, with app, device, and agent-command network policies.

1. Deploy device requirements

Deploy requirements.toml through system configuration or MDM before app launch. Follow Managed configuration for file locations and MDM delivery. Protect the managed policy and verify its settings on the machine running Codex in step 3.

The default requirements.toml below is intentionally restrictive. Administrators can enable additional features if they accept the risk that they pose. Reference the feature docs and network control docs.

requirements.toml
# Disable ChatGPT sign-in.
allowed_login_methods = ["api"]

# https://learn.tpg.studydeckedu.com/docs/agent-approvals-security#common-sandbox-and-approval-combinations
allowed_sandbox_modes = ["read-only", "workspace-write"]

# Approval prompts are reviewed by the user.
allowed_approvals_reviewers = ["user"]
allowed_approval_policies = [
{ granular = { sandbox_approval = false, rules = true, mcp_elicitations = false, request_permissions = false, skill_approval = true } },
]

# Allow cached search only if your AWS GovCloud Region supports web search.
allowed_web_search_modes = ["disabled", "cached"]

# Block agent browser use and native-app control.
allow_browser_and_computer_use = false

# Appshots: https://learn.tpg.studydeckedu.com/docs/appshots
allow_appshots = false

# Remote control: https://learn.tpg.studydeckedu.com/docs/remote-connections#pick-up-work-from-another-device
allow_remote_control = false

# Managed hooks: https://learn.tpg.studydeckedu.com/docs/enterprise/managed-configuration#enforce-managed-hooks-from-requirements
allow_managed_hooks_only = true

check_for_update_on_startup = false

# MCP servers, apps, and plugins are disabled by default.
# Admins can enable supported integrations after accepting the risks
# for their use case and configuring access and network controls.
# https://learn.tpg.studydeckedu.com/docs/enterprise/managed-configuration
mcp_servers = {}

[features]
apps = false
enable_mcp_apps = false
plugins = false

# Enable the network proxy for sandboxed commands.
# https://learn.tpg.studydeckedu.com/docs/agent-approvals-security#network-isolation
network_proxy = true

in_app_dictation = false
realtime_conversation = false

# Browser controls: https://learn.tpg.studydeckedu.com/docs/enterprise/managed-configuration#disable-codex-feature-surfaces
# Note that both browser use and computer use are up to your organization's risk appetite.
# An agent using your browser or computer may navigate to any websites or applications that the
# computer has access to. OpenAI does not currently provide additional protections restricting
# the network paths that browser use and computer use may exercise.
in_app_browser = false
browser_use = false
browser_use_external = false
browser_use_full_cdp_access = false

# Computer Use: https://learn.tpg.studydeckedu.com/docs/computer-use
# Enable after accepting the risks and configuring app and network access.
computer_use = false

# Set to true to let users update through the app.
# App-store, package-manager, and MDM updates are controlled separately.
# https://learn.tpg.studydeckedu.com/docs/enterprise/manage-app-updates#turn-off-in-app-updates
in_app_updates = false

image_generation = false

# Memories: https://learn.tpg.studydeckedu.com/docs/customization/memories
memories = false

# Computer History: https://learn.tpg.studydeckedu.com/docs/customization/computer-history
chronicle = false

external_agent_memory_import = false

# We recommend that users review approval requests themselves.
# Admins can enable automatic review after accepting the risks for their use case.
# https://learn.tpg.studydeckedu.com/docs/agent-approvals-security#automatic-approval-reviews
guardian_approval = false
guardianv2 = false

# Disable background skill-search experiments.
skill_search = false

# Hooks: https://learn.tpg.studydeckedu.com/docs/hooks
hooks = false

# If you enable web search, use cached search through Bedrock Mantle
# where supported by your AWS GovCloud Region.
standalone_web_search = false

# Disable feedback submissions to OpenAI.
[feedback]
enabled = false

# Network controls for agent commands:
# https://learn.tpg.studydeckedu.com/docs/enterprise/managed-configuration#configure-network-access-requirements
[experimental_network]
enabled = true
managed_allowed_domains_only = true

# No domains allowed by default. Add destinations approved for your use case.
domains = {}

# Add approved Unix socket paths here.
unix_sockets = {}

# Set to true when using an organization-approved upstream proxy.
allow_upstream_proxy = false

# Keep the command proxy bound to localhost.
dangerously_allow_non_loopback_proxy = false
dangerously_allow_all_unix_sockets = false

# Local/private networking: https://learn.tpg.studydeckedu.com/docs/agent-approvals-security#local-and-private-destinations
allow_local_binding = false

# App network controls: https://learn.tpg.studydeckedu.com/docs/enterprise/managed-configuration#control-desktop-app-network-destinations
[application.network]
enabled = true

# Example: Bedrock Mantle in us-gov-west-1.
# Replace this hostname with the Bedrock endpoint configured in config.toml.
[application.network.domains]
"bedrock-mantle.us-gov-west-1.api.aws" = "allow"

# OpenAI and ChatGPT endpoints.
# We recommend denying these endpoints to avoid any risk that user data is sent to commercial OpenAI infrastructure.
"api.tpg-oai.studydeckedu.com" = "deny"
"chat.tpg-oai.studydeckedu.com" = "deny"
"tpg.studydeckedu.com" = "deny"
"ab.tpg.studydeckedu.com" = "deny"
"platform.tpg-oai.studydeckedu.com" = "deny"
"auth.tpg-oai.studydeckedu.com" = "deny"
"gov.api.tpg-oai.studydeckedu.com" = "deny"
"gov.tpg.studydeckedu.com" = "deny"
"sdfedpreastus2.tpg-uc.studydeckedu.com" = "deny"
"o33249.ingest.us.sentry.io" = "deny"
"persistent.tpg-st.studydeckedu.com" = "deny"
"oaisidekickupdates.blob.core.windows.net" = "deny"

# Windows only: https://learn.tpg.studydeckedu.com/docs/config-file/config-reference#requirementstoml
[windows]
allowed_sandbox_implementations = ["elevated"]

2. Configure provider routing and network controls

Set the provider, model, Region, and endpoint in config.toml or managed defaults. Users can change these defaults within the limits set by requirements.toml.

The example below uses Mantle in us-gov-west-1. Replace the model ID and AWS profile with your deployment’s values. For another supported Region or endpoint, update the URL, Region, and network policy together.

The example turns off optional diagnostics and data sharing. Keep AWS credentials outside the TOML file. Keep the AWS profile, credentials, and credential helper scripts outside folders Codex can modify.

config.toml
# Replace with your approved Bedrock model ID.
model = "openai.gpt-5.6-terra"
model_provider = "amazon-bedrock"
approval_policy = { granular = { sandbox_approval = false, rules = true, mcp_elicitations = false, request_permissions = false, skill_approval = true } }
sandbox_mode = "workspace-write"

# Set to "cached" only when supported by your model and GovCloud Region
# and approved for your deployment.
# https://docs.aws.amazon.com/bedrock/latest/userguide/web-search.html
web_search = "disabled"

# Example: Bedrock Mantle in us-gov-west-1.
[model_providers.amazon-bedrock]
base_url = "https://bedrock-mantle.us-gov-west-1.api.aws/openai/v1"
wire_api = "responses"
requires_openai_auth = false

[model_providers.amazon-bedrock.aws]
region = "us-gov-west-1"

# Replace with your AWS profile name.
profile = "codex-govcloud"

[sandbox_workspace_write]
# Command destinations are controlled by requirements.toml.
network_access = true

# Disable sending Codex usage analytics to OpenAI.
[analytics]
enabled = false

# OpenTelemetry exports are off by default.
# Admins can configure an approved collector for logs, traces, and metrics.
# https://learn.tpg.studydeckedu.com/docs/config-file/config-advanced#observability-and-telemetry
[otel]
exporter = "none"
trace_exporter = "none"
metrics_exporter = "none"
log_user_prompt = false

This example uses AWS credentials with Bedrock Mantle. For Bedrock Runtime or a gateway, follow the provider setup instructions.

Apply network controls

Add approved app destinations, including Bedrock, to application.network.domains. Add approved command destinations to experimental_network.domains.

Codex’s network settings do not replace your device firewall.

3. Verify the deployment

  1. Confirm that your policy is active and Codex is using the intended AWS credentials and Bedrock settings.
  2. Run an approved workflow with sample data.
  3. Confirm that user settings cannot override the managed restrictions.
  4. Test invalid or expired credentials and routing failures. Confirm that content is not sent to an unapproved destination.

Troubleshoot common problems

Problem What to check
Unsupported endpoint Confirm with OpenAI that your installed desktop and app-server versions support the endpoint and model.
Wrong AWS account or role Check the active credentials and selected AWS profile. A Bedrock API key may take precedence over the profile.
Restrictions aren’t applied Confirm the intended requirements.toml is loaded on the machine running Codex.
Feature still unavailable Check the feature docs for required settings and Bedrock support, then check your network controls.

Feature settings

Users cannot override feature settings enforced by requirements.toml.

The table summarizes the configuration above. On means permitted where supported; other permissions and network controls still apply.

For provider support, see Bedrock feature availability.

Feature Default Notes
Local coding, files, Git, and subagents On —
Local scheduled tasks On —
Browser Off Includes the built-in browser, connected browsers, agent browser control, and Developer mode.
Computer Use and Appshots Off —
Memory and Computer History Off —
Image generation Off Does not block image inputs or reading existing image files.
Web search Off Cached search requires support in your model and GovCloud Region. Command-network rules do not restrict hosted search.
Apps and plugins Off —
Configured MCP servers Off Admins can enable approved servers after accepting the risks for their use case and configuring access and network controls.
Interactive MCP apps Off —
Dictation Off —
Automatic approval review Off —
Remote control Off SSH connections are separate.
App updates Off —

Enabling agent browser use or Computer Use also requires allow_browser_and_computer_use = true.