# ChatGPT desktop app now runs on Amazon Bedrock in AWS GovCloud (US)

published: 2026-10-31T04:05:34.835Z
topic: infrastructure
source: https://aws.amazon.com/blogs/machine-learning/configure-the-chatgpt-desktop-app-with-amazon-bedrock-in-aws-govcloud-us/
url: https://aiagentnews.io/stories/chatgpt-desktop-app-now-runs-on-amazon-bedrock-in-aws-govcloud-us

The ChatGPT desktop app and Codex can now send model inference to Amazon Bedrock in AWS GovCloud (US), through the Mantle endpoint in us-gov-west-1. AWS has published a walkthrough for configuring the app with IAM credentials, managed device policies and network allowlists so that agency security teams can test it before wider use.

AWS has made the ChatGPT desktop app available on Amazon Bedrock in AWS GovCloud (US), giving access to OpenAI's models through the app and through Codex, its coding agent. Requests go to the Bedrock Mantle endpoint in us-gov-west-1, so access is governed by IAM and existing GovCloud network controls. Inference runs through the Responses API on Bedrock and is billed per token.

The guide covers a controlled local deployment. Authentication uses either an Amazon Bedrock API key or the AWS SDK credential chain, which includes SSO through IAM Identity Center. Two configuration files must be in place before the first launch: an administrator-controlled requirements.toml that sets limits users cannot override, and a user config.toml that selects amazon-bedrock as the provider and names the endpoint and AWS profile.

The network policy allows only the approved Bedrock endpoint and denies OpenAI and ChatGPT domains. For rollback, AWS says to return affected devices to the previous policy, revoke temporary AWS credentials or API keys, and document any failed check. AWS also notes that using GovCloud and following the guide do not by themselves authorize a workload.

## Why it matters if you build agents

Developers building agents in regulated environments can run the ChatGPT desktop app and Codex against Bedrock under IAM-governed access, instead of ChatGPT workspace accounts, which these controls would not cover. Check the requirements.toml restrictions after each restart, because the guide says the API-only sign-in setting does not apply the capability policy. Confirm the endpoint and model with OpenAI before relying on them, since changing the URL alone does not establish support.