Configuring OpenAI Codex to Use Amazon Bedrock: A Step-by-Step Guide

Configuring Codex (CLI, desktop app, and IDE extensions) to use OpenAI's GPT-5.5 and GPT-5.4 models via Amazon Bedrock instead of OpenAI's hosted API. This setup keeps all model inference within your AWS account and selected region.

Meena Thandavarayan

Published Jun 7, 2026

Last modified Jun 7, 2026

Introduction

OpenAI's Codex is a powerful AI-powered software development agent that helps developers write, review, and optimize code through natural language interactions. With the general availability of OpenAI models on Amazon Bedrock, you can now run Codex using AWS infrastructure while maintaining data residency, leveraging IAM security controls, and benefiting from AWS's compliance framework.

In this post, I'll walk you through configuring Codex (CLI, desktop app, and IDE extensions) to use OpenAI's GPT-5.5 and GPT-5.4 models via Amazon Bedrock instead of OpenAI's hosted API. This setup keeps all model inference within your AWS account and selected region.

Why Route Codex Through Bedrock?

Running Codex through Amazon Bedrock offers several advantages for enterprise environments:

Data Residency: All inference requests stay within your selected AWS region
Unified Security: Leverage IAM permissions, VPC isolation, KMS encryption, and CloudTrail logging
Compliance: Meet regulatory requirements that prohibit sending data to external APIs
Cost Management: Consolidated billing through AWS with service-specific budgets and cost allocation tags
Network Control: Use AWS PrivateLink to keep traffic within your VPC

Prerequisites

Before you begin, ensure you have:

Codex CLI version 0.128.0 or later (or desktop app/VS Code extension version 26.429.30905+)
An AWS account with Amazon Bedrock access
Model access enabled for OpenAI GPT-5.5 or GPT-5.4 in Amazon Bedrock
IAM permissions for Bedrock model invocation
AWS CLI configured with valid credentials

Verify Your Codex Version

1
2
codex --version
# Should output: codex-cli 0.128.0 or later

If you need to update Codex:

1
2
3
4
5
# Via npm
npm update -g @openai/codex

# Or download from OpenAI's platform
# Visit: https://platform.openai.com/docs/codex

Step 1: Enable Model Access in Amazon Bedrock

First, request access to OpenAI models in the Bedrock console.

Navigate to the Amazon Bedrock console
In the left navigation, select Model access
Click Manage model access
Enable access to:
- OpenAI GPT-5.5 (most capable model)
- OpenAI GPT-5.4
Click Save changes

Access is typically granted immediately for most accounts. You can verify access using the AWS CLI:

1
2
3
4
aws bedrock list-foundation-models \
  --region us-east-2 \
  --query 'modelSummaries[?contains(modelId, `openai`)].[modelId]' \
  --output text

Step 2: Configure IAM Permissions

Your AWS identity needs permissions to invoke Bedrock models. Add this policy to your IAM role or user:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:GetFoundationModel",
        "bedrock:ListFoundationModels"
      ],
      "Resource": "*"
    }
  ]
}

For production environments, scope the Resource field to specific model ARNs:

1
"Resource": "arn:aws:bedrock:us-east-2::foundation-model/openai.gpt-5.5"

Step 3: Configure Codex for Amazon Bedrock

Codex reads its configuration from ~/.codex/config.toml. Add the following Bedrock configuration:

1
2
3
4
5
6
7
# Amazon Bedrock Configuration
model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"

[model_providers.amazon-bedrock.aws]
region = "us-east-2"
wire_api = "responses"

Understanding the Configuration

model: The OpenAI model ID on Bedrock (openai.gpt-5.5 or openai.gpt-5.4)
model_provider: Set to amazon-bedrock to route requests through AWS
region: AWS region where the model is available (GPT-5.5 is currently in us-east-2)
wire_api: Set to responses to use the Responses API format

Regional Availability

At the time of writing, OpenAI models on Bedrock are available in:

us-east-2 (Ohio) - GPT-5.5, GPT-5.4
Check the AWS regional availability page for current regional support

Step 4: Set Up AWS Authentication

Codex supports two authentication methods with Bedrock:

Option 1: AWS SDK Credential Chain (Recommended)

Codex will automatically use your AWS credentials from:

Shared AWS credentials (~/.aws/credentials)
Environment variables (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY)
AWS SSO (aws sso login)
IAM roles (when running on EC2, ECS, Lambda)

If you already have AWS CLI configured, no additional setup is needed:

1
2
aws configure
# Enter your credentials when prompted

Option 2: Named AWS Profile

To use a specific AWS profile, add it to your config:

1
2
3
4
[model_providers.amazon-bedrock.aws]
profile = "my-bedrock-profile"
region = "us-east-2"
wire_api = "responses"

Option 3: Bedrock API Key

If your organization uses Bedrock API keys, set the environment variable:

1
export AWS_BEARER_TOKEN_BEDROCK="your-bedrock-api-key"

For the Codex desktop app or VS Code extension, create ~/.codex/.env:

1
2
AWS_BEARER_TOKEN_BEDROCK=your-bedrock-api-key
AWS_REGION=us-east-2

Important: Desktop apps and IDE extensions don't inherit shell environment variables, so the .env file is required for GUI-based Codex usage.

Step 5: Test Your Configuration

CLI Testing

Test Codex with a simple prompt:

1
echo "write a python function to calculate fibonacci numbers" | codex exec

You should see output similar to:

1
2
3
4
5
6
7
8
9
10
11
12
OpenAI Codex v0.137.0
--------
workdir: /home/user/projects
model: openai.gpt-5.5
provider: amazon-bedrock
region: us-east-2
--------

def fibonacci(n):
    if n <= 1:
        return n
    return fibonacci(n-1) + fibonacci(n-2)

Desktop App and VS Code

Restart the Codex desktop app or reload VS Code
Open a new Codex session
Look for the model indicator - it should show openai.gpt-5.5
Try a code generation prompt

The model provider information appears in the session header, confirming you're using Bedrock.

Complete Configuration Example

Here's a complete ~/.codex/config.toml with Bedrock configuration alongside other Codex settings:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
# Amazon Bedrock Configuration
model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"

[model_providers.amazon-bedrock.aws]
region = "us-east-2"
wire_api = "responses"
# Optional: profile = "default"

# Codex behavior settings
[desktop]
ambient-suggestions-enabled = false
conversationDetailMode = "STEPS_COMMANDS"

# Enable plugins
[plugins."documents@openai-primary-runtime"]
enabled = true

[plugins."spreadsheets@openai-primary-runtime"]
enabled = true

[plugins."browser@openai-bundled"]
enabled = true

# Project trust levels
[projects."/path/to/your/project"]
trust_level = "trusted"

[features]
js_repl = true

Monitoring and Cost Management

CloudWatch Metrics

Track Bedrock usage with CloudWatch metrics:

1
2
3
4
5
6
7
8
aws cloudwatch get-metric-statistics \
  --namespace AWS/Bedrock \
  --metric-name InvocationCount \
  --dimensions Name=ModelId,Value=openai.gpt-5.5 \
  --start-time 2024-01-01T00:00:00Z \
  --end-time 2024-01-31T23:59:59Z \
  --period 86400 \
  --statistics Sum

CloudTrail Audit Logging

Enable CloudTrail to audit all Bedrock API calls:

1
2
3
4
aws cloudtrail lookup-events \
  --lookup-attributes AttributeKey=EventName,AttributeValue=InvokeModel \
  --start-time 2024-01-01 \
  --max-results 10

Cost Allocation Tags

Tag your Bedrock usage for cost allocation:

1
2
3
aws bedrock tag-resource \
  --resource-arn arn:aws:bedrock:us-east-2::foundation-model/openai.gpt-5.5 \
  --tags Key=Team,Value=Engineering Key=CostCenter,Value=AI-Platform

Troubleshooting

Error: "Model not found" (404)

Symptom: The model 'openai.gpt-5.5' does not exist

Causes:

Model access not enabled in Bedrock console
Wrong region (GPT-5.5 requires us-east-2)
Typo in model ID

Solution:

Verify model access in Bedrock console
Confirm region matches model availability
Check model ID is exactly openai.gpt-5.5

Error: "Access Denied"

Symptom: User is not authorized to perform: bedrock:InvokeModel

Solution:

Check IAM permissions (see Step 2)
Verify AWS credentials: aws sts get-caller-identity
Ensure you're using the correct AWS profile

Error: "Codex version too old"

Symptom: Bedrock configuration options not recognized

Solution: Update Codex to 0.128.0 or later:

1
npm update -g @openai/codex

Desktop App Not Using Bedrock

Symptom: Desktop app still using OpenAI API despite config changes

Solution:

Create ~/.codex/.env with AWS credentials
Completely quit and restart the desktop app (not just close the window)
Verify config.toml changes were saved correctly

Connection Timeouts

Symptom: Requests timeout or reconnect repeatedly

Possible Causes:

Network connectivity issues to AWS endpoints
VPC endpoint misconfiguration
Service quotas exceeded

Solution:

Test Bedrock connectivity directly:```bash
aws bedrock invoke-model
--region us-east-2
--model-id openai.gpt-5.5
--body '{"messages":[{"role":"user","content":"test"}],"max_tokens":10}'
--cli-binary-format raw-in-base64-out
/tmp/test.json```
Check AWS service health dashboard
Verify security group rules if using VPC endpoints

Advanced Configuration

Using VPC Endpoints

For enhanced security, route Bedrock traffic through VPC endpoints:

Create a VPC endpoint for Bedrock in your VPC:```bash
aws ec2 create-vpc-endpoint
--vpc-id vpc-xxx
--service-name com.amazonaws.us-east-2.bedrock-runtime
--subnet-ids subnet-xxx
--security-group-ids sg-xxx```
Update Codex config to use the VPC endpoint:```toml
[model_providers.amazon-bedrock.aws]
region = "us-east-2"
wire_api = "responses"
endpoint_url = "https://vpce-xxx.bedrock-runtime.us-east-2.vpce.amazonaws.com"```

Cross-Account Access

To use Bedrock from a different AWS account:

Create an IAM role in the account with Bedrock access
Configure the role ARN in your AWS config (~/.aws/config):```ini
[profile bedrock-cross-account]
role_arn = arn:aws:iam::123456789012:role/BedrockAccessRole
source_profile = default
region = us-east-2```
Reference the profile in Codex config:```toml
[model_providers.amazon-bedrock.aws]
profile = "bedrock-cross-account"
region = "us-east-2"
wire_api = "responses"```

Switching Between Models

Create multiple configuration profiles to switch between models:

1
2
3
4
5
6
7
8
9
10
11
12
# Default: GPT-5.5
model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"

[model_providers.amazon-bedrock.aws]
region = "us-east-2"
wire_api = "responses"

# Alternative profile for GPT-5.4
[profiles.fast]
model = "openai.gpt-5.4"
model_provider = "amazon-bedrock"

Use the -p flag to select a profile:

1
codex -p fast "your prompt here"

Known Limitations

When using Codex with Amazon Bedrock, the following features are currently unavailable:

Image generation - OpenAI models on Bedrock support image input but not image generation
Voice transcription - Audio input/output is not supported
Cloud plugin store - Only local plugins are available
Cloud agents - Review agents, security agents, and web agents require OpenAI API

These limitations are specific to the Bedrock integration. All core code generation, editing, and analysis features work normally.

Production Considerations

Service Quotas

Monitor your Bedrock quotas to avoid throttling:

1
2
3
aws service-quotas list-service-quotas \
  --service-code bedrock \
  --query 'Quotas[?contains(QuotaName, `GPT`)]'

Request quota increases through the AWS console if needed.

High Availability

For production deployments:

Use cross-region inference if available for your compliance requirements
Implement retry logic with exponential backoff
Monitor CloudWatch metrics for error rates and latency
Set up CloudWatch alarms for quota breaches

Security Best Practices

Use IAM roles instead of long-term credentials when possible
Enable CloudTrail logging for audit compliance
Encrypt sensitive data using KMS customer-managed keys
Use VPC endpoints to avoid internet egress
Implement least-privilege IAM policies scoped to specific models
Rotate API keys regularly if using Bedrock API key authentication

Pricing Comparison

Compare costs between OpenAI's API and Bedrock:

OpenAI API Pricing (as of publication):

GPT-4 Turbo: $10/1M input tokens, $30/1M output tokens

Amazon Bedrock Pricing:

Varies by model and region
No additional AWS data transfer costs when using VPC endpoints
Volume discounts available through Savings Plans
Pay only for what you use (no minimum commitments)

Check the Amazon Bedrock pricing page for current rates.

Conclusion

Configuring Codex to use Amazon Bedrock gives you the power of OpenAI's most advanced models while maintaining control over data residency, security, and compliance. This setup is particularly valuable for enterprises that need to:

Keep sensitive code within their AWS environment
Meet regulatory requirements for data residency
Leverage existing AWS security and compliance frameworks
Consolidate AI infrastructure costs under AWS billing

With OpenAI's GPT-5.5 and GPT-5.4 models now available on Bedrock, you can build sophisticated AI-powered development workflows without compromising on security or compliance requirements.

Next Steps

Explore Amazon Bedrock Guardrails to add content filtering
Set up model evaluation to test model performance
Configure knowledge bases to extend Codex with private documentation
Integrate with Amazon Q Developer for a complete development assistant experience

Additional Resources

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

Configuring OpenAI Codex to Use Amazon Bedrock: A Step-by-Step Guide

Meena Thandavarayan

Introduction

Why Route Codex Through Bedrock?

Prerequisites

Verify Your Codex Version

Step 1: Enable Model Access in Amazon Bedrock

Step 2: Configure IAM Permissions

Step 3: Configure Codex for Amazon Bedrock

Understanding the Configuration

Regional Availability

Step 4: Set Up AWS Authentication

Option 1: AWS SDK Credential Chain (Recommended)

Option 2: Named AWS Profile

Option 3: Bedrock API Key

Step 5: Test Your Configuration

CLI Testing

Desktop App and VS Code

Complete Configuration Example

Monitoring and Cost Management

CloudWatch Metrics

CloudTrail Audit Logging

Cost Allocation Tags

Troubleshooting

Error: "Model not found" (404)

Error: "Access Denied"

Error: "Codex version too old"

Desktop App Not Using Bedrock

Connection Timeouts

Advanced Configuration

Using VPC Endpoints

Cross-Account Access

Switching Between Models

Known Limitations

Production Considerations

Service Quotas

High Availability

Security Best Practices

Pricing Comparison

OpenAI API Pricing (as of publication):

Amazon Bedrock Pricing:

Conclusion

Next Steps

Additional Resources