The ChatGPT desktop app has been extended to operate on Amazon Bedrock within AWS GovCloud (US), specifically targeting the us-gov-west-1 region. Practitioners can now send model requests through the Bedrock Mantle endpoint, applying existing GovCloud IAM identities, network policies, and regional controls. This matters because it aligns AI inference with strict data‑residency, zero‑data‑retention, and compliance requirements common in government and regulated environments.
Authentication Options and Profile Setup
The application supports two distinct credential pathways. First, an Amazon Bedrock API key can be supplied directly. Second, the standard AWS SDK credential chain is used, which can draw from ~/.aws/credentials, ~/.aws/config, or an AWS SSO token cache. When the environment variable AWS_BEARER_TOKEN_BEDROCK is present (e.g., in ~/.codex/.env on Linux/macOS or %USERPROFILE%\.codex\.env on Windows), the bearer token overrides profile‑based authentication. The walkthrough recommends a named profile such as codex-il5 that references an approved GovCloud IAM role with permissions for the selected model in us-gov-west-1. Secrets must remain outside of any config.toml or requirements.toml files.
Network and Device Policy Controls
To satisfy agency security policies, the deployment restricts outbound traffic to the single Bedrock Mantle endpoint in the GovCloud region. A managed device policy disables other external connections and network‑enabled capabilities of the desktop client. This approach ensures that model inference cannot leak to unintended internet destinations and that all traffic is observable through existing GovCloud network controls.
Data‑Residency and Zero‑Data‑Retention
Inference processing stays within the selected GovCloud region, satisfying residency mandates. The service operates on a per‑token pricing model with no seat licenses or developer commitments. Zero‑Data‑Retention (ZDR) mode is available, meaning prompts and responses are not written to durable storage by AWS and are not shared with model providers. Practitioners must verify that ZDR is enabled for their workload to meet stringent data‑governance and privacy requirements.
Operational Checklist
- Confirm the installed ChatGPT desktop version includes GovCloud support.
- Create or select an IAM role with explicit Bedrock model permissions in
us-gov-west-1. - Configure a named AWS profile (e.g.,
codex-il5) and ensure credential helpers respect the profile’s security boundaries. - Set
AWS_BEARER_TOKEN_BEDROCKonly when a short‑lived token is preferred over profile authentication. - Apply a device policy that whitelists the Bedrock Mantle endpoint and blocks all other outbound traffic.
- Validate ZDR mode is active and that no logs or storage locations retain prompt data.
- Run the desktop client, initialize the Bedrock connection, and verify that requests succeed against the GovCloud endpoint.
Related CloudNinjas coverage: AWS.
What This Means For Practitioners
Engineers can now embed AI assistance into GovCloud‑restricted workflows without compromising regional data controls. The primary responsibilities shift to managing IAM permissions, maintaining secure credential flows, and enforcing network whitelists. Security teams should audit the device policy, confirm ZDR activation, and incorporate the Bedrock endpoint into existing monitoring and incident‑response processes. Future evaluations should focus on credential rotation strategies, IAM policy granularity, and any changes to Bedrock service limits that could affect token‑based billing or throughput.
