AWS Brings ChatGPT Desktop App to Amazon Bedrock in GovCloud (US)

What AWS announced

Amazon Web Services says the ChatGPT desktop app is now available through Amazon Bedrock in AWS GovCloud (US), giving access to OpenAI's frontier models through two components: Work and Codex. According to AWS, Work completes complex, multi-step tasks and delivers review-ready results, while Codex is a coding agent for developing, testing, and reviewing software.

Who it's for

AWS says the configuration is intended for organizations whose security architecture requires model inference to use AWS GovCloud (US) identities, endpoints, and Regional controls. The company describes Codex as routing model requests through Amazon Bedrock Mantle in the us-gov-west-1 Region, where access is governed using AWS Identity and Access Management (IAM) and existing AWS GovCloud (US) network controls.

How it works

AWS describes Codex as a coding agent powered by GPT models, available through the ChatGPT desktop app, the Codex CLI, and IDE integrations with Visual Studio Code, JetBrains, and Xcode. Model inference is routed through the Responses API on Amazon Bedrock, according to the company.

AWS says customers with data residency requirements have their processing stay within the Amazon Bedrock AWS Region they select. The company says pricing is per token, with no seat licenses and no per-developer commitments. AWS also says the service supports zero data retention (ZDR), a configurable mode in which prompts and responses are processed without being written to durable storage by AWS or shared with model providers.

Deployment and authentication

AWS walks through a deployment that uses API-mode sign-in, a managed device policy, a named AWS profile, and network restrictions limiting access to the approved Amazon Bedrock endpoint while disabling other external connections, according to the company. AWS says the result is a deployment that an agency security team can test and document before approving broader use.

The company says the ChatGPT desktop app supports two Amazon Bedrock authentication pathways: an Amazon Bedrock API key or the AWS SDK credential chain, with AWS SSO through AWS IAM Identity Center supported within the credential-chain pathway. AWS says the app first checks for a bearer token in its environment and, if none is present, falls back to the standard AWS SDK credential chain, which can read credentials from a user's AWS profile, including SSO profiles.

AWS notes that because this configuration sends requests to AWS directly, ChatGPT workspace rules and user roles do not control it; the company says the main security controls are the computer's policies and the AWS identity and permissions being used.

AWS states that using AWS GovCloud (US) and following its configuration guide do not, by themselves, authorize a workload. The company says organizations remain responsible for reviewing the selected model, AWS services, Region, endpoint, workstation controls, repositories, credentials, and data flows against their own system security plan and authorization process.

Source: AWS Machine Learning Blog, published Oct. 30, 2026.