{"resourceId":"openai-codex-chatgpt-desktop-bedrock-govcloud-guide-202610","versions":[{"version":"external-f23c5b79a5f44584f18ca2e0a292f308a317549091391f3e771bafa17d1027b5","resource":{"id":"openai-codex-chatgpt-desktop-bedrock-govcloud-guide-202610","title":"OpenAI guide configures Codex and the ChatGPT desktop app for Bedrock inference in AWS GovCloud, with restrictive defaults and no ATO claim","organization":"OpenAI","sector":"State and local government (also federal)","geography":"United States","publishedAt":"Undated documentation; AWS announcement dated October 30, 2026","publicationDate":null,"eventDate":"2026-10-30","sourceName":"OpenAI ChatGPT Learn","sourceLabel":"OpenAI: Bedrock AWS GovCloud configuration","sourceUrl":"https://learn.chatgpt.com/docs/enterprise/govcloud-configuration","evidenceClass":"vendor-claim","outcomeClass":"emerging","topics":["developers-agents","infrastructure","data-security"],"finding":"OpenAI documents a local Codex and ChatGPT desktop deployment that sends inference to Amazon Bedrock in AWS GovCloud: it requires desktop version 26.1002.51308 or later, MDM-delivered requirements.toml with restrictive defaults (MCP servers, apps and plugins off; OpenAI endpoints denied), and states it is not legal advice and does not grant an ATO. An AWS post dated Oct. 30 (also inspected) announces the availability.","sledRelevance":"Gives state and local agencies with GovCloud-bound security plans an OpenAI-documented path to coding and agent tools without sending data to OpenAI endpoints, though authorization stays with the agency.","evidence":"Vendor configuration guidance only; no deployments or outcomes reported. The AWS post notes ChatGPT workspace rules and user roles do not control this setup.","architectureImplications":"Local desktop/CLI agent with inference on Bedrock Mantle in us-gov-west-1; controls shift from ChatGPT workspace admin to device MDM, IAM and network policy.","governanceImplications":"Agencies must own the ATO, device policy and network restrictions; workspace governance does not apply.","securityPrivacyImplications":"Credentials must be kept out of config files; agent sandboxing and network isolation are the main controls; browser and computer use are left to agency risk appetite.","caveats":"Scope note: AWS-delivered infrastructure details belong to the aws stream; this item covers OpenAI's product configuration. Documentation is undated; no SLED adopters named.","streamIds":["openai"],"roles":{"sales":"Sales framing: agencies that rejected SaaS ChatGPT for data-boundary reasons now have an OpenAI-documented GovCloud path for Codex and agent work. Interpretation: the opportunity is a controlled pilot and authorization support, not a turnkey compliant product; OpenAI itself says it is not an ATO.","engineering":"Engineering framing: this is a device-managed agent with Bedrock inference, so identity, MDM policy and network egress control replace workspace admin settings. Pre-sales should test the restrictive requirements.toml, IAM role scoping and endpoint allowlists. Limited applicability: requires an AWS GovCloud account and approved model access.","delivery":"Delivery framing: delivery is a staged pilot on managed devices with documented rollback. The operational owner is the agency CISO with the application development lead. Proposed acceptance: verified provider setting, blocked non-approved endpoints and a recorded security review before broader rollout."},"roleDetails":{"sales":{"customerProblem":"Agencies with GovCloud-bound security plans could not use OpenAI coding and agent tools under their data-boundary requirements.","stakeholders":["Agency CISO","Application development lead","Authorizing official","Cloud platform team"],"discoveryQuestions":["Does your security plan require GovCloud inference?","Do you manage developer devices with MDM?","Who would authorize an agent tool on workstations?"],"valueHypothesis":"A controlled GovCloud pilot may let developers use Codex without data leaving the agency's AWS boundary; productivity is unmeasured.","potentialEngagement":"A bounded pilot on a small set of managed developer devices with a security review package.","unsupportedClaims":["That the setup is authorized or compliant","Developer productivity gains","That workspace governance applies"]},"engineering":{"fit":"Agencies already on AWS GovCloud with managed developer endpoints.","architectureIntegration":"ChatGPT desktop/Codex CLI on managed devices, inference via Bedrock Mantle in us-gov-west-1 using IAM or Bedrock API keys.","prerequisites":["AWS GovCloud account with approved model access","MDM deployment of requirements.toml and config.toml","Network egress allowlist","Desktop version 26.1002.51308+"],"constraints":["Not an ATO","GovCloud region feature differences","Workspace controls do not apply"],"security":"Restrictive sandbox defaults, MCP and plugins off, OpenAI endpoints denied; protect credentials and SSO caches from agent writes.","proofOfValue":["Confirm provider shows amazon-bedrock","Verify blocked egress to non-approved endpoints","Test rollback and credential revocation"]},"delivery":{"work":"Deploy configuration via MDM, validate controls, run a scoped developer pilot and document results.","dependencies":["GovCloud account","MDM tooling","Security review"],"ownership":"Agency CISO with the application development lead.","skillsAdoption":"Developer training on approval modes and sandbox limits.","governanceCheckpoints":["Security review before pilot","Authorizing official sign-off before expansion"],"acceptanceCriteria":["All pilot devices verified on approved endpoint (proposed)","Zero unapproved egress in pilot logs (proposed)"],"risks":["Misconfigured policy enabling unapproved tools","Credential exposure","Assuming GovCloud equals compliance"]}},"retrievedAt":"2026-10-31T03:05:23Z","enrichedAt":"2026-10-31T03:09:25Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Developer-focused; limited relevance to general staff.","procurementImplications":"Per-token AWS billing rather than ChatGPT seats, per the AWS post.","operatingModelImplications":"Moves AI tool governance to device management and cloud IAM teams.","peerReview":"unknown","sourceVerification":{"openedUrl":"https://learn.chatgpt.com/docs/enterprise/govcloud-configuration","referenceExcerpt":"Using GovCloud for inference does not establish that the entire workflow meets your agency’s requirements","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}