How to Configure OpenAI Codex with GPT Models on Amazon Bedrock Using AWS IAM Identity Center

Want to use OpenAI's Codex without managing API keys? With GPT-5.5 and GPT-5.4 now available on Amazon Bedrock, you can run the Codex Desktop App, CLI, and VS Code Extension using your existing AWS IAM Identity Center (SSO) credentials — no OpenAI API key, no Bedrock API key, just your organization's standard SSO login. This step-by-step guide walks you through the complete setup on Mac, from configuring your SSO profile and IAM permissions to troubleshooting common Desktop App issues.

Ayush_S

Published Jun 24, 2026

Last modified Jun 24, 2026

OpenAI Codex is a powerful AI coding assistant that can now run inference against GPT models (GPT-5.5, GPT-5.4) hosted on Amazon Bedrock. This means you can use Codex — the Desktop App, CLI, or VS Code Extension — without needing an OpenAI API key, authenticating entirely through your existing AWS credentials.

In this tutorial, I'll walk you through configuring Codex to use Amazon Bedrock as the model provider with AWS IAM Identity Center (formerly AWS SSO) for authentication.

💡 Key Highlight: This article focuses exclusively on AWS IAM Identity Center (SSO) integration with Codex. No OpenAI API key (OPENAI_API_KEY) and no Bedrock API key (AWS_BEARER_TOKEN_BEDROCK) are used. Authentication is handled entirely through your organization's existing IAM Identity Center setup — the same SSO credentials you already use for AWS Console access.

Prerequisites

Before you begin, make sure you have:

An AWS account with Amazon Bedrock access enabled
AWS IAM Identity Center configured for your organization
Codex installed (Desktop App, CLI, or VS Code Extension)
AWS CLI v2 installed

How It Works

The architecture is straightforward:

1
Codex (local) → Bedrock Mantle endpoint → OpenAI models on Amazon Bedrock

When configured, Codex sends model requests directly to Amazon Bedrock's Mantle endpoint. No OpenAI sign-in is required. Authentication is entirely AWS-native using your IAM Identity Center credentials.

Step 1: Configure Your AWS SSO Profile

Set up a named AWS SSO profile that Codex will use to obtain credentials.

Run the SSO configuration wizard

1
aws configure sso --profile codex-bedrock

You'll be prompted for the following values:

Prompt	Example Value
SSO session name	codex-sso
SSO start URL	https://d-xxxxxxxxxx.awsapps.com/start
SSO Region	us-east-1
SSO registration scopes	sso:account:access
Account ID	<your-aws-account-id>
Role name	BedrockCodexAccess (or your role)
Default Region	us-east-1
Output format	json

Resulting ~/.aws/config

After running the wizard, your ~/.aws/config will contain:

1
2
3
4
5
6
7
8
9
10
[sso-session codex-sso]
sso_start_url = https://d-xxxxxxxxxx.awsapps.com/start
sso_region = us-east-1
sso_registration_scopes = sso:account:access

[profile codex-bedrock]
sso_session = codex-sso
sso_account_id = <your-aws-account-id>
sso_role_name = BedrockCodexAccess
region = us-east-1

About SSO Registration Scopes

The sso_registration_scopes field controls what the SSO token can do:

sso:account:access — Allows listing accounts and assuming roles (required)

This is typically the only scope needed for Codex + Bedrock.

Step 2: Set Up IAM Permissions

The IAM role assumed via SSO must have permissions to invoke OpenAI models on Bedrock. Without these, authentication succeeds but inference calls return 401 Unauthorized.

Required Policy

Add this inline policy to your IAM Identity Center Permission Set:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BedrockMantleAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock-mantle:CreateInference",
        "bedrock-mantle:*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BedrockModelAccess",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream",
        "bedrock:ListFoundationModels",
        "bedrock:GetFoundationModel"
      ],
      "Resource": "*"
    }
  ]
}

⚠️ The bedrock-mantle:CreateInference action is critical. This is what Codex calls when sending inference requests to the Bedrock Mantle endpoint.

Applying the Policy

Via AWS Console:

Go to IAM Identity Center → Permission Sets
Find your Permission Set (e.g., BedrockCodexAccess)
Edit → Inline policy → Paste the JSON above
Save and assign to your user/group

Via CLI:

1
2
3
4
aws sso-admin put-inline-policy-to-permission-set \
  --instance-arn "arn:aws:sso:::instance/ssoins-xxxxxxxx" \
  --permission-set-arn "<your-permission-set-arn>" \
  --inline-policy file://bedrock-policy.json

Step 3: Login via SSO

1
aws sso login --profile codex-bedrock

This opens your browser for authentication. Once complete, AWS SDK credentials are cached locally.

Verify credentials

1
aws sts get-caller-identity --profile codex-bedrock

Expected output:

1
2
3
4
5
{
  "UserId": "AROAXXXXXXXXX:<your-alias>",
  "Account": "<your-aws-account-id>",
  "Arn": "arn:aws:sts::<your-aws-account-id>:assumed-role/AWSReservedSSO_BedrockCodexAccess_.../<your-alias>"
}

⚠️ SSO tokens expire (typically 8–12 hours). You'll need to re-run aws sso login when they expire.

Step 4: Configure ~/.codex/config.toml

This file tells Codex which model and provider to use.

Create or edit the file

1
2
mkdir -p ~/.codex
nano ~/.codex/config.toml

Required contents

1
2
3
4
5
6
model = "openai.gpt-5.5"
model_reasoning_effort = "medium"
model_provider = "amazon-bedrock"

[model_providers.amazon-bedrock.aws]
region = "us-east-1"

Opening config.toml

Multiple ways to access the file:

Terminal: code ~/.codex/config.toml (VS Code) or nano ~/.codex/config.toml
Finder: Cmd+Shift+G → type ~/.codex/ → double-click config.toml
Note: The .codex folder is hidden. Press Cmd+Shift+. in Finder to show hidden files.

Using multiple models

Set a default model in config.toml and override per session:

1
2
# Override at runtime (CLI)
codex --model openai.gpt-5.4

Step 5: Configure ~/.codex/.env

The Codex Desktop App and VS Code Extension do not inherit shell environment variables. You must place credentials in ~/.codex/.env for them to be picked up.

Create the file if it doesn't exist

1
touch ~/.codex/.env

Add the following lines

1
2
3
4
AWS_PROFILE=codex-bedrock
AWS_REGION=us-east-1
OPENAI_BASE_URL="https://bedrock-mantle.us-east-1.api.aws/openai/v1"
BEDROCK_OPENAI_MODEL_ID="openai.gpt-5.5"

Step 6: Verify the Codex CLI

After completing the configuration, verify that Codex is properly connected to Amazon Bedrock.

Start Codex CLI

On your local terminal run below command

1
codex

Check the /status tab

Once the CLI is running, type /status to view the current configuration. You should see:

Model provider: Amazon Bedrock - https://bedrock-mantle.us-east-1.api.aws/openai/v1
Model: openai.gpt-5.5

Send a test prompt

1
codex "Explain what Amazon Bedrock is in one sentence"

If you get a response, your setup is working correctly. The inference is routed through the Bedrock Mantle endpoint using your SSO credentials.

⚠️ If you see an authentication error, ensure your SSO session is active:Then try again.

Step 7: Codex Desktop App — Complete Setup

Sign-in page appearing

If the Desktop App shows the OpenAI sign-in page instead of using Bedrock:

Verify ~/.codex/config.toml has model_provider = "amazon-bedrock" at the top level
Verify ~/.codex/.env has all four environment variables from Step 5
Ensure SSO session is active (aws sso login --profile codex-bedrock)
Fully quit the app (right-click dock icon → Quit, not just close window)
Delete cached auth: rm -rf ~/.codex/auth*
Relaunch the app

Supported Models & Regions

Model ID	Best For	Regions
openai.gpt-5.5	Complex reasoning, hardest tasks	us-east-1, us-east-2
openai.gpt-5.4	Best price-performance	us-east-1, us-east-2, us-west-2, us-gov-west-1

Limitations when using Bedrock

Feature	Available?
Local code review, sandboxing, AGENTS.md	✅ Yes
Skills / local plugins	✅ Limited
Fast Mode	❌ No (on-demand only)
Codex Cloud tasks / GitHub @codex	❌ No
Web search / Image generation	❌ No
Slack / Linear cloud integrations	❌ No

Troubleshooting

TOML parse error: "key with no value, expected ="

Cause: Escaped underscores (model\_provider instead of model_provider) or empty lines inside sections.

Fix: Overwrite the file using the cat command shown in Step 4. Verify with cat -A ~/.codex/config.toml — no backslashes should appear in key names.

401 Unauthorized: bedrock-mantle:CreateInference not allowed

Cause: The IAM Permission Set is missing bedrock-mantle permissions.

Fix: Add the policy from Step 2 to your Permission Set. Wait ~1 minute for propagation, then re-login with aws sso login

config.toml lines disappear after restart

Cause: The Desktop App rewrites config.toml on launch.

Fix: Use the App's Settings UI to configure the model provider, OR make the file read-only (chmod 444 ~/.codex/config.toml).

Desktop App shows sign-in page

Cause: App cannot detect Bedrock config or credentials.

Fix: Ensure both config.toml and .env are correct. Delete ~/.codex/auth* and fully restart the app.

SSO credentials expired

SSO tokens expire every 8–12 hours. Re-run:

1
aws sso login --profile codex-bedrock

Then restart the Codex app.

Model not found / region error

Ensure you are using the correct region for your chosen model. GPT-5.5 is only available in us-east-2. Check your config.toml region matches the model availability table above.

Conclusion

With this setup, you can use OpenAI Codex with GPT-5.5 and GPT-5.4 models running on Amazon Bedrock, authenticated entirely through AWS IAM Identity Center. This gives you the power of Codex's local coding capabilities — sandboxing, code review, AGENTS.md — without needing an OpenAI API key.

Remember to re-authenticate via aws sso login when your SSO session expires, and you're all set!

# openai # amazon-bedrock # aws-iam-identity-center # openai-gpt # ai-security

Any opinions in this article are those of the individual author and may not reflect the opinions of AWS.

Enjoyed reading this content? Let the author know!

Your likes, comments, shares, and saves help creators reach more builders.

Loading recommendations

Loading article

Builder Center

How to Configure OpenAI Codex with GPT Models on Amazon Bedrock Using AWS IAM Identity Center

Ayush_S

Prerequisites

How It Works

Step 1: Configure Your AWS SSO Profile

Run the SSO configuration wizard

Resulting ~/.aws/config

About SSO Registration Scopes

Step 2: Set Up IAM Permissions

Required Policy

Applying the Policy

Step 3: Login via SSO

Verify credentials

Step 4: Configure ~/.codex/config.toml

Create or edit the file

Required contents

Opening config.toml

Multiple ways to access the file:

Using multiple models

Step 5: Configure ~/.codex/.env

Create the file if it doesn't exist

Add the following lines

Step 6: Verify the Codex CLI

Start Codex CLI

Check the /status tab

Send a test prompt

Step 7: Codex Desktop App — Complete Setup

Sign-in page appearing

Supported Models & Regions

Limitations when using Bedrock

Troubleshooting

Conclusion