ChatGPT and Codex can now run on Bedrock in GovCloud. The setup guide still does not authorize your workload

For a federal agency or a defense contractor, the first question about an AI coding tool is rarely “is it good?”. It is “where does the prompt go?”. A developer’s prompt can contain source code, system names and data that is not allowed to leave an approved boundary. Until there is a clean answer, the tool stays off the approved list.

AWS published one such answer on October 30: a configuration that routes model inference from the ChatGPT desktop app, including its Work mode for multistep tasks and the Codex coding agent, to Amazon Bedrock in AWS GovCloud (US), using the Responses API in the US-West region.

What the configuration does

The setup has three parts, each a familiar control rather than a new one.

Identity. Sign-in uses API mode only. The app authenticates either with a Bedrock API key or through the AWS SDK credential chain, which includes single sign-on through IAM Identity Center. In this mode, AWS identity and device policy govern access, not the usual ChatGPT workspace roles.

Configuration under management. Two files control the app: a user file and an administrator file that sets requirements. Both must be in place before the first launch, which means distribution through device management rather than by each developer.

Network. The app is restricted to the approved Bedrock endpoint, with other external connections disabled. AWS says zero data retention is supported, meaning prompts and responses are not written to durable storage by AWS or shared with model providers.

Pricing is per token, with no seat licenses, which changes the procurement conversation from licenses to consumption. The app runs on Windows, Linux and macOS, with IDE integrations for VS Code, JetBrains and Xcode.

What it does not settle

AWS is unusually direct about the limits, and they are the important part.

It does not authorize anything. The post states that using GovCloud and following the guide does not by itself authorize a workload. The organization remains responsible for its security and authorization review. GovCloud being an accredited environment does not make every service configuration inside it approved for a given system.

Changing an endpoint is not support. AWS notes that pointing the app at a different URL does not establish that the configuration is supported. Teams should confirm the supported desktop version, the approved model and region, and keep that combination under change control. A desktop update that alters network behavior is a change to the boundary.

Disabled features are part of the deal. Restricting the app to one endpoint means features that call other services are off. That is the point, and it should be explained to developers before rollout, or the first support tickets will ask for exceptions.

Three decisions this moves to the platform team

The architecture turns AI coding adoption into decisions a platform team already knows how to make.

1. Which endpoint is the boundary. One approved inference endpoint, enforced by network policy and device configuration, replaces a list of vendor domains to allow.
2. Which identity calls it. Prefer the SSO path over static API keys, so access is tied to a person, revocable and logged in the same place as other cloud activity.
3. Who approves configuration changes. The administrator file is now a security artifact. Version it, review changes and record which version each device runs.

This is the same lesson we drew when the same Claude models arrived through Azure and AWS with different boundaries: the delivery path is a governance decision, often a bigger one than the model. It also adds a link to the model supply chain every regulated organization should map. Here the model maker, the cloud operator and the client application vendor each control part of the path.

For regulated buyers outside government, the pattern transfers directly. A bank or a pharmaceutical company with an approved cloud region can apply the same three controls. The guide gives the configuration. The authorization, as AWS says, is still the customer’s work.