ChatGPT Desktop App Now Runs on Amazon Bedrock in AWS GovCloud (US)

What AWS is offering

AWS says the ChatGPT desktop app gives access to OpenAI's frontier models through two components. Work handles complex, multi-step tasks and delivers review-ready results. Codex is a coding agent for developing, testing and reviewing software.

The walkthrough targets organizations whose security architecture requires model inference to use AWS GovCloud (US) identities, endpoints and Regional controls. It configures Codex to send model requests through Amazon Bedrock Mantle in us-gov-west-1, where access can be governed with AWS Identity and Access Management (IAM) and existing AWS GovCloud (US) network controls.

According to AWS, users can work with the ChatGPT desktop app, the Codex CLI, and IDE integrations for Visual Studio Code, JetBrains and Xcode. Inference is routed through the Responses API on Amazon Bedrock.

On commercial terms, AWS states that customers pay per token with no seat licenses and no per-developer commitments. For customers with data residency requirements, processing stays within the Amazon Bedrock AWS Region they select. Zero data retention (ZDR) is also supported: in this configurable mode, prompts and responses are processed without being written to durable storage by AWS or shared with model providers.

How the deployment is set up

The post describes a controlled local deployment in AWS GovCloud (US-West). It combines API-mode sign-in, a managed device policy, a named AWS profile and network restrictions. Those restrictions allow access only to the approved Amazon Bedrock endpoint and disable other external connections and network-enabled capabilities. AWS says the result is a setup that an agency security team can test and document before approving broader use.

The configuration has three main steps: set up authentication, create the configuration files, and then launch, initialize and verify the deployment. Prerequisites include a version of the app that supports Amazon Bedrock in AWS GovCloud (US), an approved AWS GovCloud (US) account, an IAM identity with approved credentials, and access to the approved model, Region and endpoint.

Authentication can use either an Amazon Bedrock API key or the AWS SDK credential chain, which includes AWS SSO through AWS IAM Identity Center. The app first looks for the AWS_BEARER_TOKEN_BEDROCK variable, and when present it takes precedence over profile-based authentication. Otherwise the app falls back to the standard credential chain. The walkthrough uses a named profile, codex-il5, and advises keeping credentials, bearer tokens and session tokens out of TOML files.

Configuration files and network limits

Two files must exist before the app is launched: config.toml and requirements.toml. The first tells the app how to operate, including the model provider (amazon-bedrock), the model and settings such as permissions or context limits. The second is an administrator-controlled rules file that sets limits users cannot override.

The baseline requirements.toml in the post allows only the api login method and the read-only and workspace-write sandbox modes. It turns off browser and computer use, remote control, login shells, in-app updates, memories, plugins and image generation, among other features, and sets the list of MCP servers to empty.

• The network allow list permits only bedrock-mantle.us-gov-west-1.api.aws.
• Domains such as api.openai.com, chatgpt.com, auth.openai.com and platform.openai.com are explicitly denied.
• A Windows-specific section requires the elevated sandbox implementation and a private desktop, which must be supported by the approved runtime.

AWS notes that because this setup talks to AWS directly, ChatGPT workspace rules and user roles do not control it. The main security controls are the computer's policies and the AWS identity and permissions in use.

What it means for agencies

AWS is clear that the guide does not grant approval on its own. Using AWS GovCloud (US) and following the steps do not, by themselves, authorize a workload. Each organization remains responsible for reviewing the model, AWS services, Region, endpoint, workstation controls, repositories, credentials and data flows against its system security plan and authorization process.

For government-focused teams, the post offers a documented starting point: a locked-down configuration that can be tested internally, with pay-per-token pricing and the option of zero data retention, before any wider rollout is considered.