# Configuring the ChatGPT desktop app with Amazon Bedrock in AWS GovCloud (US) - Source: MechNext — https://mechnext.eu/ru/article/59-configuring-the-chatgpt-desktop-app-with-amazon-bedrock-in-aws-govcloud-us - Published: 2026-11-02 - Updated: 2026-11-02 - Category: Industry News - Language: ru (Markdown in other languages: ?lang=en, ?lang=de, ?lang=sk, ?lang=pl, ?lang=zh) > The walkthrough describes a controlled local ChatGPT desktop deployment that routes model requests through Amazon Bedrock Mantle in us-gov-west-1 using AWS GovCloud (US) identities, endpoints, and Regional controls. The ChatGPT desktop app is available on Amazon Bedrock in AWS GovCloud (US), with model inference routed through the Responses API on Amazon Bedrock. The published walkthrough focuses on a controlled local Codex deployment that sends model requests through Amazon Bedrock Mantle in `us-gov-west-1`, using AWS GovCloud (US) identities, endpoints, and Regional controls. This arrangement is more than an endpoint selection. It combines API-mode sign-in, a managed device policy, a named AWS profile, administrator-enforced rules, operational settings, and network restrictions. In the controlled design, the network permits only the approved Amazon Bedrock endpoint. Other external connections and network-enabled capabilities are disabled. ### Prerequisites and configuration roles Before starting, the deployment needs a compatible version of the ChatGPT desktop app and an approved AWS GovCloud (US) account. It also requires an authorized IAM identity and credentials, access to the approved model, Region, and endpoint, and the two configuration files `requirements.toml` and `config.toml`. The files serve different purposes. `requirements.toml` is an administrator-controlled rules file that imposes security limits users cannot override. `config.toml` defines operational settings, including the `amazon-bedrock` provider, model, permissions, and context limits. Keeping these responsibilities distinct makes it possible to identify which boundaries are mandatory and which values describe how the application operates within them. ### A three-stage deployment The configuration has three main stages: configure authentication; create the ChatGPT desktop app configuration files; and launch, initialize, and verify the deployment. The sequence matters because both TOML files must be installed before the application launches. The application therefore starts with the intended rules and operational settings already in place. #### 1. Choose and verify authentication The desktop app supports Amazon Bedrock authentication through either an Amazon Bedrock API key or the AWS SDK credential chain. AWS IAM Identity Center SSO is supported through the credential-chain pathway. The chosen method determines where the application looks for credentials and which established AWS credential sources can participate. Credential precedence is an important part of validation. The app first checks for `AWS_BEARER_TOKEN_BEDROCK`. A bearer token supplied through the platform-specific `.codex/.env` file takes precedence over profile-based authentication. Consequently, the presence of a named AWS profile does not by itself show that the profile is the active credential source when a higher-priority token is also available. If no bearer token is available, the app falls back to the standard AWS SDK credential chain. That chain can use AWS credential and configuration files as well as SSO profiles and cached SSO sessions. A deployment review should therefore consider the actual credential sources available to the application under this order, rather than looking only at the intended profile. #### 2. Apply rules and operational settings After authentication is prepared, the two configuration files define the controlled environment. The administrator-owned rules constrain what users may change, while the operational configuration selects Amazon Bedrock and establishes model, permission, and context settings. The accompanying network policy allows the approved Amazon Bedrock endpoint and disables other external connections and network-enabled capabilities. This separation provides a useful review structure. Authentication answers how the application obtains authority to make a request. `requirements.toml` answers which non-overridable limits govern the local application. `config.toml` answers which provider and operating parameters it uses. Network restrictions then define which external destination remains reachable. #### 3. Launch and confirm the provider Once both files are installed, the application can be launched and initialized. Successful setup can be checked by confirming that `amazon-bedrock` appears as the model provider in the Codex CLI status view or in the ChatGPT desktop app settings. This check connects the prepared files to the provider identity displayed by the running application. ### Failure handling is part of the rollout If validation fails, the rollout should stop. Affected devices should be restored to their previously approved policy and provider settings. Temporary AWS credentials or API keys should be revoked, and loss of Amazon Bedrock connectivity should be confirmed. The failure should then be documented before another attempt begins. Together, these steps return the device to a known approved position and prevent a retry from proceeding on top of an uncertain partial configuration. ### Technical configuration is not authorization Using AWS GovCloud (US) and following the guide do not by themselves authorize a workload. The organization remains responsible for reviewing the deployment against its own security plan and authorization process. Confirmation of the provider, credential path, configuration files, and restricted connectivity is therefore a technical validation step, not a substitute for the organization’s review or approval.