Bedrock GovCloud configuration

This guide covers security settings for running Codex with AWS GovCloud in API mode. Review these settings before authorizing sensitive workflows.

Verification checklist · Capability reference · Codex configuration reference

Shared responsibility

AWS and your organization share responsibility for securing the cloud deployment. Review the AWS shared responsibility model and the selected services’ documentation to identify provider controls and your responsibilities. Your agency is responsible for authorizing its system’s use of those services.

For a supported deployment, Codex sends inference requests to the reviewed Amazon Bedrock endpoint using AWS authentication. ChatGPT workspace requirements and RBAC don’t apply to this API-mode path. Configure AWS identity, service access, and the workstation where Codex runs.

Your workstation configuration, including its Codex TOML policy files, governs local file access, command execution, network access, plugins, MCP tools, and browser capabilities. You’re responsible for securing workstations, credentials, repositories, local records, and any enabled third-party services. Assign owners for device policy, network controls, updates, and deployment validation.

AWS GovCloud and these settings alone don’t establish that your complete workflow meets agency requirements. Review the exact services, models, Regions, destinations, and data flows in your deployment, and document your customer responsibilities in the system security plan.

Before you begin

Confirm GovCloud support for your version of Codex.

1. Prepare AWS access

Select the approved AWS account and IAM identity, with access to the selected model and Region. Provision credentials through your organization’s approved mechanism. Keep credentials out of TOML.

For a named profile, protect its configuration, credential source, and credential helper from task writes.

2. Deploy device requirements

Deploy the reviewed Bedrock requirements.toml through system configuration or MDM before app launch or authentication. API-mode sessions do not receive ChatGPT workspace requirements or RBAC.

Use the complete requirements below as the baseline for your supported Bedrock deployment. Review the capability reference, local skills, and command access for the approved workflow.

Follow Managed configuration for system-file locations and MDM delivery. Protect the managed policy and verify its effective settings on the execution host in step 4.

Recommended requirements.toml

This configuration intentionally restricts features. It’s recommended for GovCloud unless your organization enforces other restrictions. See the configuration reference for details on each setting.

The final [windows] table applies only to Windows. Confirm support for sandbox_private_desktop in your approved runtime.

allowed_login_methods = ["api"]
allowed_sandbox_modes = ["read-only", "workspace-write"]
allowed_approvals_reviewers = ["user"]
allowed_approval_policies = [
{ granular = { sandbox_approval = false, rules = true, mcp_elicitations = false, request_permissions = false, skill_approval = true } },
]
allowed_web_search_modes = ["disabled", "cached"]
allow_browser_and_computer_use = false
allow_appshots = false
allow_remote_control = false
allow_login_shell = false
allow_managed_hooks_only = true
check_for_update_on_startup = false
mcp_servers = {}

[feedback]
enabled = false

[features]
network_proxy = true
in_app_chat = false
in_app_dictation = false
in_app_browser = false
browser_use = false
browser_use_external = false
browser_use_full_cdp_access = false
computer_use = false
in_app_updates = false
image_generation = false
memories = false
chronicle = false
external_agent_memory_import = false
guardian_approval = false
guardianv2 = false
guardian_ext = false
apps = false
enable_mcp_apps = false
plugins = false
remote_plugin = false
plugin_sharing = false
recommended_plugins = false
skill_mcp_dependency_install = false
skill_search = false
workspace_dependencies = false
hooks = false
standalone_web_search = false

[experimental_network]
enabled = true
managed_allowed_domains_only = true
domains = {}
unix_sockets = {}
allow_upstream_proxy = false
dangerously_allow_non_loopback_proxy = false
dangerously_allow_all_unix_sockets = false
allow_local_binding = false

# Application destinations

[application.network]
enabled = true

[application.network.domains]
"bedrock-mantle.us-gov-west-1.api.aws" = "allow"

# OpenAI / ChatGPT, including auth and telemetry.

"api.openai.com" = "deny"
"chat.openai.com" = "deny"
"chatgpt.com" = "deny"
"ab.chatgpt.com" = "deny"
"platform.openai.com" = "deny"
"auth.openai.com" = "deny"

# FedRAMP OpenAI endpoints are also outside this Bedrock profile.

"gov.api.openai.com" = "deny"
"gov.chatgpt.com" = "deny"
"sdfedpreastus2.oaiusercontent.com" = "deny"

# Crash reporting and distribution.

"o33249.ingest.us.sentry.io" = "deny"
"persistent.oaistatic.com" = "deny"
"oaisidekickupdates.blob.core.windows.net" = "deny"

# Windows only

[windows]
allowed_sandbox_implementations = ["elevated"]
sandbox_private_desktop = true

3. Configure provider routing and network controls

Set the provider, model, Region, and endpoint in config.toml or managed defaults, separately from requirements.toml. Users can change provider defaults unless managed policy constrains them.

Recommended config.toml

For a confirmed Mantle deployment in us-gov-west-1, replace the model ID and profile with approved values. If the approved endpoint or Region differs, update the URL, Region, and network policy together.

These defaults set the inference route, match the managed approval policy, and turn off optional diagnostics and data sharing. Users can change defaults within the managed requirements. Keep AWS credentials outside the TOML file. The final [windows] table applies only to Windows and must match your approved runtime.

model = "REPLACE_WITH_APPROVED_MODEL_ID"
model_provider = "amazon-bedrock"
forced_login_method = "api"
approval_policy = { granular = { sandbox_approval = false, rules = true, mcp_elicitations = false, request_permissions = false, skill_approval = true } }
approvals_reviewer = "user"
sandbox_mode = "workspace-write"
web_search = "cached"
allow_login_shell = false
check_for_update_on_startup = false

[model_providers.amazon-bedrock]
base_url = "https://bedrock-mantle.us-gov-west-1.api.aws/openai/v1"
wire_api = "responses"
requires_openai_auth = false
supports_websockets = false
supports_standalone_web_search = false

[model_providers.amazon-bedrock.aws]
region = "us-gov-west-1"
profile = "codex-il5"

[sandbox_workspace_write]
network_access = false

[features]
network_proxy = true

[analytics]
enabled = false

[feedback]
enabled = false

[otel]
exporter = "none"
trace_exporter = "none"
metrics_exporter = "none"
log_user_prompt = false

[memories]
generate_memories = false
use_memories = false

[skills.bundled]
enabled = false

[apps._default]
enabled = false

# Windows only

[windows]
sandbox = "elevated"

AWS authentication is still required when requires_openai_auth = false. Bedrock Runtime and bearer-token gateways need their own approved provider and authentication configuration; do not reuse this Mantle URL or signing service.

Apply network controls

Apply the reviewed application and device network policies, plus the separate policy for agent commands. Cover inference, credential acquisition and refresh, telemetry, storage, and updates. Routing inference through Bedrock doesn’t make all desktop traffic AWS-only.

Application network policy covers supported application and bundled app-server requests. It’s separate from agent-sandbox controls and isn’t an operating-system firewall. Native updater traffic, Git, SSH, external apps, credential helpers, and subprocess networking require separate controls.

The example selects cached search in us-gov-west-1. Check regional availability in the AWS Bedrock web search documentation, and use cached search only when the deployment owner approves the service. Otherwise, set web_search = "disabled".

4. Verify the deployment

1. Restart the app. On the execution host, confirm effective requirements, AWS identity, provider, model, Region, and endpoint.

2. Run an approved workflow with example data.

3. Confirm required capability restrictions take effect. Test conflicting user settings, invalid or expired credentials, and routing failures; content must not fall back to an unapproved destination.

Record the desktop and app-server versions, effective configuration, results, and rollback procedure. Resolve failed or blocked checks before expanding access.

Troubleshoot common problems

Reference: Bedrock capability restrictions

These settings describe the initial Bedrock deployment profile. Apply the complete policy supplied for your supported release, including AWS network controls. Local automation and real-time voice require additional controls: in_app_local_automation and realtime_conversation are not set in the baseline above. Review these restrictions for your deployment.

The values below are managed requirements, not user defaults. Setting a feature to true does not bypass account, workspace, provider, or operating-system restrictions. Omitting a requirement leaves normal configuration and availability checks in place.

Additional deployment controls