人工智能
在 AWS GovCloud (美国) 配置 ChatGPT 桌面应用与 Amazon Bedrock
ChatGPT桌面app现在可以在AWS GovCloud(美国)的Amazon Bedrock上使用，通过两个组件提供OpenAI的前沿模型的访问。 工作完成复杂，多步骤的任务并交付审查准备后的结果，Codex是用于开发，测试和审查软件的编码agent.
这种走过是针对那些安全架构需要模型推论使用AWS GovCloud(美国)身份、终点和区域控制的组织。 它通过我们-gov-West-1的Amazon Bedrock Mantle配置了Codex，用于路由模型请求，使用AWS身份和访问管理(IAM)和现有的AWS GovCloud(US)网络控制来规范访问。
Codex是用于AI动力软件开发的OpenAI编码agent. 通过GPT模型为推论提供动力，Codex 推出为复杂，长视距的开发者工作流程优化了新类智能。 您可以使用 ChatGPT 桌面应用，Codex CLI，和 IDE 集成视觉工作室代码，JetBrains，和 Xcode. 模型推论通过Amazon Bedrock上的响应API进行路由。
对于有数据居住要求的客户，处理停留在您选择的Amazon Bedrock AWS区域。 没有座位许可也没有每个开发者的承诺零数据保留(ZDR)也得到了支持。 在这种可配置模式下，不由AWS写成持久存储或与模型提供者共享的提示和响应处理。 这有助于保护敏感信息，满足严格的数据管理、隐私和安全要求。
这个帖子通过ChatGPT桌面应用的可控本地部署，在AWS GovCloud(US-West)向Amazon Bedrock发送模型推论。 配置使用API-mode的登录，管理设备政策，命名为AWS配置，以及网络限制。 这些限制只允许进入核准的Amazon Bedrock端点，同时使其他外部连接和网络辅助能力失效。 结果，一个机构安全小组在批准更广泛使用之前可以测试和记录部署情况。
使用 AWS GovCloud(美国) 并遵循此指南本身并不授权您的工作量。 贵组织仍负责对照其系统安全计划和授权程序审查选定的模式、AWS服务、区域、终点、工作站控制、储存库、证书和数据流动。
解决方案概述
您可以以两种方式使用 ChatGPT 桌面应用：
- 执行需要规划、研究、文件和完成结果的较大任务。
- 用于编辑码、运行测试和审查牵引请求等技术工作的编码。
ChatGPT桌面应用通过桌面应用或CLI运行在组织管理的计算机上。 它使用配置的AWS证书安全地将请求发送到我们-gov-West-1的Amazon Bedrock Mantle端点。 因为这个设置直接使用AWS,ChatGPT的工作空间规则和用户角色并不控制它。 主要的安全控制是计算机的政策和正在使用的AWS身份和权限。
走过去
该配置有三个主要步骤：设置认证，设置ChatGPT桌面应用程序配置文件，然后发布，初始化，验证部署。
先决条件
在使用AWS GovCloud(US)设置ChatGPT桌面应用之前，确保您的版本的ChatGPT桌面应用在AWS GovCloud(US)支持Amazon Bedrock. 您需要一个经批准的AWS GovCloud(美国)账户，一个IAM身份和经批准的证书，访问经批准的模型AWS区域，以及端点，并获得使用许可。 您还需要设置要求的.toml和config.toml文件。
步骤1：建立认证
选择经批准的AWS GovCloud(美国)账户和IAM身份或角色，并在我们-gov-West-1中访问经批准的模型。 通过您的组织批准的机制获取证书。 这种走行部使用命名的剖面编码-il5. 保存证书，无记名证，会话证，以及TOML文件中的其他秘密。
保护配置文件配置，证书来源，SSO令牌缓存，以及来自ChatGPT桌面应用任务的任何证书助手，同时允许经批准的认证工具维护和刷新证书。
ChatGPT桌面应用支持两个Amazon Bedrock认证路径：Amazon Bedrock API键或AWS SDK认证链。 AWS SSO通过AWS IAM身份中心在证书链路径内得到支持。
该应用首先检查其环境中的AWS BEARER TOKEN BEDROK. 对于桌面使用，可通过Windows上的%USERPROFILE%.codex\.env或~/.codex/.env在Linux和macOS上提供这个变量。 出现时，无记名符号优先于基于配置的认证。
如果没有无记名符号，该应用程序会回到标准的AWS SDK证书链。 链路可以从~/.aws/证书和相关剖面设置读取AWS证书，从~/.aws/配置。 在 Windows 上，相应的默认路径是 %USERPROFILE%.aws\creditifics 和 %USERPROFILE%.aws\config。 链条还支持SSO配置。 对于SSO，它使用AWS配置文件中的配置设置和缓存的SSO会话来获取临时角色证书。 这些证书不需要手动存储在AWS证书文件中。 见OpenAI的Bedrock认证文档和AWS IAM身份中心认证提供者文档。
第2步：设置 ChatGPT 桌面应用程序配置文件
您必须创建两个 ChatGPT 桌面应用程序配置文件：config.toml 和 request.toml。
重要：在应用程序为发布之前需要设置配置文件。 下表显示文件位置。
从要求.toml文件开始。 required.toml是一个管理员控制的规则文件。 它设定了用户不能超越的安全限制，例如限制允许使用哪些许可级别，工具，或设置 ChatGPT 桌面应用。
支持的AWS GovCloud(美国)Amazon Bedrock部署使用以下基准。 [windows]部分仅适用于Windows，沙盒 private desktop必须支持经批准的运行时间。
下一个，配置配置 config.toml 文件。 config.toml告诉ChatGPT桌面应用如何操作，包括使用哪个模型提供者(amazon-bedrock)，选择哪个模型，以及权限或上下文限制等设置。
将模型ID和命名配置文件(例如代码x-il5)替换为核准的值。
步骤3：发布，初始化并核实
从ChatGPT网站下载应用程序并安装。 安装后让应用程序关闭。 如果它自动打开，或者如果应用程序之前是发布，则完全退出ChatGPT并结束任何遗留的ChatGPT或Codex进程。
确保要求.toml和config.toml在第一个应用发布前就位。
启动应用程序以装入要求.toml和config.toml设置。 确保它作为模型提供者显示 amazon-bedrock.
在 Codex CLI 中，您应该看到一个 /status 标签，它看起来像：
在ChatGPT桌面应用中，也可以确认amazon-bedrock为模型提供者。
解决问题
应用程序提示 OpenAI 账户。 验证要求.toml和config.toml使用上表中显示的确切位置和文件名称，终止所有ChatGPT和Codex进程，并重新启动。 文件必须先于app 发布。
AWS GovCloud(美国)端点报告为不支持。 确认精确的桌面或应用服务器发布，端点，以及OpenAI的模型。 仅更改 URL 不建立支持。
错误的AWS身份被使用。 检查有效的证书来源和命名配置。 请检查date=中的日期值 (帮助) Amazon Bedrock API密钥是否优先于配置。
缺少能力限制。 重启后检查全部有效要求。 只有API的登录设置没有应用能力政策。
倒转和清理
如果验证检查失败，请停止推出。 将受影响的设备返回到先前批准的策略和提供者设置，然后重新启动 ChatGPT 桌面应用程序。 撤销任何临时的AWS证书或API密钥，确认这些设备不能再连接到Amazon Bedrock. 保存测试记录，并清楚地记录失败后再尝试。
结论
ChatGPT桌面应用在AWS GovCloud(美国)的Amazon Bedrock上，为您提供了使用OpenAI边疆模型和编码协助的控制方式。 推论留在AWS GovCloud(美国)地区。 通过验证配置，确认核准的AWS身份和端点，并验证安全控制，可以自信地准备部署供更广泛的使用。 这种办法支持创新，同时使部署决定与每个组织的安全、授权和数据处理要求保持一致。
准备在AWS GovCloud(美国)的Amazon Bedrock上用 Codex 探索ChatGPT桌面应用吗？开始控制部署验证你的安全控制与你的安全小组合作准备更广泛的领养
相关资源
- Bedrock AWS GovCloud(美国)配置 – ChatGPT桌面应用设备，提供商，网络，验证，以及故障排除指导。
- Amazon Bedrock – AWS区域的回应API，端点行为，认证，以及响应API的权限。
- AWS GovCloud(美国) 遵章程序与客户授权考虑。
-OpenAI的Bedrock认证文档 — Amazon Bedrock API密钥和AWS SDK证书链认证，包括SSO.
- AWS IAM身份中心认证提供者文件 – SSO配置和临时AWS证书。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Artificial Intelligence
Configure the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US)
The ChatGPT desktop app is now available on Amazon Bedrock in AWS GovCloud (US), providing access to OpenAI’s frontier models through two components. Work completes complex, multi-step tasks and delivers review-ready results, and Codex is a coding agent for developing, testing, and reviewing software.
This walkthrough is intended for organizations whose security architecture requires model inference to use AWS GovCloud (US) identities, endpoints, and Regional controls. It configures Codex to route model requests through Amazon Bedrock Mantle in us-gov-west-1, where access can be governed using AWS Identity and Access Management (IAM) and existing AWS GovCloud (US) network controls.
Codex is the OpenAI coding agent for AI-powered software development. With GPT models powering inference, Codex introduces a new class of intelligence optimized for complex, long-horizon developer workflows. You can use the ChatGPT desktop app, the Codex CLI, and IDE integrations with Visual Studio Code, JetBrains, and Xcode. Model inference is routed through the Responses API on Amazon Bedrock.
For customers with data residency requirements, processing stays within the Amazon Bedrock AWS Region that you select. You pay per token with no seat licenses and no per-developer commitments. Zero data retention (ZDR) is also supported. In this configurable mode, prompts and responses are processed without being written to durable storage by AWS or shared with model providers. This helps you protect sensitive information and meet stringent data-governance, privacy, and security requirements.
This post walks through a controlled local deployment of the ChatGPT desktop app that sends model inference to Amazon Bedrock in AWS GovCloud (US-West). The configuration uses API-mode sign-in, a managed device policy, a named AWS profile, and network restrictions. These restrictions allow access only to the approved Amazon Bedrock endpoint while disabling other external connections and network-enabled capabilities. The result is a deployment that an agency security team can test and document before approving broader use.
Using AWS GovCloud (US) and following this guide do not, by themselves, authorize your workload. Your organization remains responsible for reviewing the selected model, AWS services, Region, endpoint, workstation controls, repositories, credentials, and data flows against its system security plan and authorization process.
Solution overview
You can use the ChatGPT desktop app in two ways:
- Work for larger tasks that need planning, research, files, and a finished result.
- Codex for technical work such as editing code, running tests, and reviewing pull requests.
The ChatGPT desktop app runs on an organization-managed computer through the desktop app or CLI. It uses the configured AWS credentials to securely send requests to the Amazon Bedrock Mantle endpoint in us-gov-west-1. Because this setup uses AWS directly, ChatGPT workspace rules and user roles don’t control it. The main security controls are the computer’s policies and the AWS identity and permissions being used.
Walkthrough
The configuration has three main steps: set up authentication, set up the ChatGPT desktop app configuration files, and then launch, initialize, and verify the deployment.
Prerequisites
Before setting up the ChatGPT desktop app with AWS GovCloud (US), make sure your version of the ChatGPT desktop app supports Amazon Bedrock in AWS GovCloud (US). You need an approved AWS GovCloud (US) account, an IAM identity and approved credentials, access to the approved model, AWS Region, and endpoint, and permission to use them. You also need to set up the requirements.toml and config.toml files.
Step 1: Set up authentication
Select the approved AWS GovCloud (US) account and IAM identity or role with access to the approved model in us-gov-west-1. Obtain credentials through your organization’s approved mechanism. This walkthrough uses the named profile codex-il5. Keep credentials, bearer tokens, session tokens, and other secrets out of TOML files.
Protect the profile configuration, credential source, SSO token cache, and any credential helper from ChatGPT desktop app task writes, while allowing approved authentication tools to maintain and refresh credentials.
The ChatGPT desktop app supports two Amazon Bedrock authentication pathways: an Amazon Bedrock API key or the AWS SDK credential chain. AWS SSO through AWS IAM Identity Center is supported within the credential-chain pathway.
The app first checks for AWS_BEARER_TOKEN_BEDROCK in its environment. For desktop use, this variable can be supplied through %USERPROFILE%\.codex\.env on Windows or ~/.codex/.env on Linux and macOS. When present, the bearer token takes precedence over profile-based authentication.
If no bearer token is available, the app falls back to the standard AWS SDK credential chain. The chain can read AWS credentials from ~/.aws/credentials and related profile settings from ~/.aws/config. On Windows, the corresponding default paths are %USERPROFILE%\.aws\credentials and %USERPROFILE%\.aws\config. The chain also supports SSO profiles. For SSO, it uses the profile settings in the AWS config file and the cached SSO session to obtain temporary role credentials. These credentials don’t need to be manually stored in the AWS credentials file. See OpenAI’s Bedrock authentication documentation and the AWS IAM Identity Center credential provider documentation.
Step 2: Set up ChatGPT desktop app configuration files
You must create two ChatGPT desktop app configuration files: config.toml and requirements.toml.
Important: the configuration files need to be set up before the application is launched. The following table shows the file locations.
Start from the requirements.toml file. requirements.toml is an administrator-controlled rules file. It sets security limits that users can’t override, for example, restricting which permission levels, tools, or settings the ChatGPT desktop app is allowed to use.
Use the following baseline for the supported AWS GovCloud (US) Amazon Bedrock deployment. The [windows] section applies only to Windows, and sandbox_private_desktop must be supported by the approved runtime.
Next, configure the config.toml file. config.toml tells the ChatGPT desktop app how to operate, including which model provider to use (amazon-bedrock), which model to select, and settings such as permissions or context limits.
Replace the model ID and named profile (for example, codex-il5) with approved values.
Step 3: Launch, initialize, and verify
Download the app from the ChatGPT site and install it. Leave the app closed after installation. If it opens automatically or if the app has been launched previously, fully exit ChatGPT and end any lingering ChatGPT or Codex processes.
Make sure requirements.toml and config.toml are in place before the first app launch.
Start the app to load the requirements.toml and config.toml settings. Make sure it shows amazon-bedrock as the model provider.
In the Codex CLI, you should see a /status tab that looks like this:
In the ChatGPT desktop app, you can also confirm amazon-bedrock as the model provider.
Troubleshooting
The application prompts for an OpenAI account. Verify that requirements.toml and config.toml use the exact locations and file names shown in the preceding table, terminate all ChatGPT and Codex processes, and relaunch. The files must precede app launch.
AWS GovCloud (US) endpoint is reported as unsupported. Confirm the exact desktop or app-server release, endpoint, and model with OpenAI. Changing the URL alone does not establish support.
The wrong AWS identity is used. Inspect the effective credential source and named profile. Check whether an Amazon Bedrock API key takes precedence over the profile.
Capability restrictions are missing. Inspect the full effective requirements after restart. The API-only sign-in setting doesn’t apply the capability policy.
Rollback and cleanup
If a validation check fails, stop the rollout. Return the affected devices to the previously approved policy and provider settings, then restart the ChatGPT desktop app. Revoke any temporary AWS credentials or API keys, and confirm that those devices can no longer connect to Amazon Bedrock. Keep a record of the test and clearly document what failed before trying again.
Conclusion
The ChatGPT desktop app on Amazon Bedrock in AWS GovCloud (US) gives you a controlled way to use OpenAI frontier models and coding assistance. Inference stays in the AWS GovCloud (US) Regions. By validating the configuration, confirming the approved AWS identity and endpoint, and verifying security controls, you can confidently prepare the deployment for broader use. This approach supports innovation while aligning deployment decisions with each organization’s security, authorization, and data-handling requirements.
Ready to explore the ChatGPT desktop app with Codex on Amazon Bedrock in AWS GovCloud (US)? Start with a controlled deployment, validate your security controls, and work with your security team to prepare for broader adoption.
Related resources
- Bedrock AWS GovCloud (US) configuration – ChatGPT desktop app device, provider, network, verification, and troubleshooting guidance.
- Responses API on Amazon Bedrock – AWS Regions, endpoint behavior, authentication, and permissions for the Responses API.
- AWS GovCloud (US) compliance – Compliance programs and customer authorization considerations.
- OpenAI’s Bedrock authentication documentation – Amazon Bedrock API key and AWS SDK credential-chain authentication, including SSO.
- AWS IAM Identity Center credential provider documentation – SSO profile configuration and temporary AWS credentials.
Auto-fetched and translated by AI Atlas. All rights belong to the original author.