AWS Builder Center

Builder Center

Use OpenAI Codex with GPT Models in Amazon Bedrock

Want to use OpenAI's Codex without a ChatGPT subscription? Now that GPT-5.5 and GPT-5.4 are on Amazon Bedrock, you can run Codex CLI and the desktop app straight from your AWS account. This step-by-step guide walks you through the setup on a Mac—keeping your prompts and per-token billing within AWS, with no separate OpenAI sign-in.

Qinjie Zhang

OpenAI's GPT-5.5 and GPT-5.4 models are now available in Amazon Bedrock, and you can drive them with OpenAI's own Codex, both the CLI and the desktop app. This step-by-step guide walks you through configuring Codex on a Mac to use GPT models hosted in Bedrock, so your prompts stay within your AWS account with no separate OpenAI subscription required.
By default, Codex talks to OpenAI's hosted API and asks you to sign in with a ChatGPT account. By pointing it at Amazon Bedrock instead, you get per-token billing through your existing AWS account, data residency in the AWS Region you choose, and no extra OpenAI account to manage. This guide shows you how to set it up step by step.

Prerequisites

You have installed the AWS CLI on your Mac and authenticated so that you can access the Amazon Bedrock service through the CLI.
To verify your authentication status, run the following command in your terminal:b
1
aws sts get-caller-identity
You should see output similar to the following:
1
2
3
4
5
{
"UserId": "AROAWWNJHDG5GDPWF5MCK:xxxx",
"Account": "xxxx",
"Arn": "arn:aws:sts::460453255610:assumed-role/Admin/qinjie-Isengard"
}
Run the following command to confirm your active AWS profile:
1
aws configure list
You should see output similar to the following. In this case, qinjie-Admin is the active AWS profile.
1
2
3
4
5
NAME : VALUE : TYPE : LOCATION
profile : qinjie-Admin : env : ['AWS_PROFILE', 'AWS_DEFAULT_PROFILE']
access_key : ****************6WUW : custom-process :
secret_key : ****************e9JY : custom-process :
region : us-west-2 : config-file : ~/.aws/config
Note: Your profile's default Region may be different from the one used in this guide. GPT-5.5 is currently available only in US East (Ohio), us-east-2, so we explicitly set that Region in the steps below regardless of your profile default. GPT-5.4 is available in US East (Ohio), US West (Oregon), and AWS GovCloud (US-West).

Step 1: Install the Codex CLI and Desktop App

Download the Codex desktop app from https://developers.openai.com/codex/app .
Install the Codex CLI:
1
curl -fsSL https://chatgpt.com/codex/install.sh | sh
Verify the installation:
1
codex --version

Step 2: Configure the Bedrock Model Provider

Create the file ~/.codex/config.toml if it does not already exist:
1
2
mkdir -p ~/.codex
touch ~/.codex/config.toml
Add the following to the top of the file:
1
2
3
4
5
6
model = "openai.gpt-5.5"
model_reasoning_effort = "medium"
model_provider = "amazon-bedrock"
​
[model_providers.amazon-bedrock.aws]
region = "us-east-2"
Tip: To use GPT-5.4 instead, change the model ID to openai.gpt-5.4.

Step 3: Set Environment Variables

Codex picks up credentials and Region settings from environment variables. The desktop app and IDE extensions do not always inherit your shell environment, so Codex reads them from ~/.codex/.env.
Create the file if it does not already exist:
1
touch ~/.codex/.env
Add the following variables:
1
2
3
4
AWS_REGION="us-east-2"
AWS_PROFILE="qinjie-Admin"
OPENAI_BASE_URL="https://bedrock-mantle.us-east-2.api.aws/openai/v1"
BEDROCK_OPENAI_MODEL_ID="openai.gpt-5.5"
Note: Replace AWS_PROFILE with your own profile name from the Prerequisites step. AWS_PROFILE and AWS_REGION are the essential variables that tell Codex which credentials and Region to use; the Bedrock OpenAI-compatible endpoint is resolved automatically by the amazon-bedrock provider.

Step 4: Verify the Codex CLI

Start Codex:
1
codex
Within Codex, run /status to confirm that the current model provider is Amazon Bedrock:
1
/status

Step 5: Verify the Codex Desktop App

Launch the Codex desktop app.
Because you configured the environment variables to use a GPT model in Amazon Bedrock, the app will not prompt you to sign in. Send any prompt to confirm that it responds using the Bedrock-hosted GPT model.
Note: The desktop app does not yet provide a /status equivalent to display the active model provider. As long as it works without asking you to log in, it is using your Bedrock configuration.

Troubleshooting: Codex Fails on EC2 with bwrap: ... Operation not permitted

If you run Codex on an EC2 instance (Ubuntu 24.04+) and every command, including codex review, fails like this:
1
2
3
⚠ Codex's Linux sandbox uses bubblewrap and needs access to create user namespaces.
...
bwrap: loopback: Failed RTM_NEWADDR: Operation not permitted
The cause is not Codex, your model, or your repo. Codex's Linux sandbox uses bubblewrap (bwrap), which creates a network namespace and brings up its loopback interface. Ubuntu 24.04 ships with AppArmor hardening that restricts unprivileged user namespaces, which blocks that loopback setup, so every sandboxed command dies before it can do any work.
Confirm the cause:
1
2
sysctl kernel.apparmor_restrict_unprivileged_userns # 1 = restricted (the problem)
bwrap --unshare-net --ro-bind / / /bin/true # reproduces RTM_NEWADDR error
Fix by relaxing the AppArmor restriction with a persistent drop-in:
1
2
echo 'kernel.apparmor_restrict_unprivileged_userns=0' | sudo tee /etc/sysctl.d/60-apparmor-namespaces.conf
sudo sysctl --system
Re-run the bwrap test above; it should now print no error. Codex's sandbox will work normally, and the drop-in survives reboots.
Security note: This relaxes a host-wide kernel hardening (unprivileged user namespaces are a kernel-exploit surface). It is a reasonable trade-off on a single-user dev instance. If you would rather leave the host untouched, run Codex without its bwrap sandbox instead:
1
codex --sandbox danger-full-access

Summary

This guide shows you how to point OpenAI Codex, both the CLI and the desktop app, at OpenAI's GPT models hosted in Amazon Bedrock. With a single config.toml and a small .env file, you get:
  • GPT-5.5 (or GPT-5.4) accessible through the Codex tools you already use
  • Per-token billing through your existing AWS account, with no separate OpenAI subscription
  • Your prompts processed within your chosen AWS Region for data residency
  • No ChatGPT sign-in required
This is ideal for developers who already have Amazon Bedrock access and want to use OpenAI's coding agent without managing a separate OpenAI account or sending data to a public LLM API.

References

# amazon-bedrock# openai-gpt
Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.
Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article