OpenAI on Amazon Bedrock: GPT-5.5, Codex & AWS Adoption

GPT-5.5, GPT-5.4, and Codex are available on Amazon Bedrock for companies that want OpenAI capability without separating generative AI from the AWS governance they already use. The value is practical: centralized procurement, AWS identity, regional control, audit logging, private networking, spend management, and data policies in the same environment where many workloads already run.

This guide focuses on the adoption work before rollout: Region, credentials, audit, cost, data policy, repository boundaries, and where Managed Agents still belong as a future capability.

Updated: June 2, 2026.

OpenAI on Bedrock: what is available now

According to AWS, GPT-5.5 and GPT-5.4 can be called through the Responses API on Bedrock at the same per-token rate as direct OpenAI usage with no additional fees. Codex on Bedrock also uses pay-per-token pricing, with no seat licenses or per-developer commitments, and usage counts toward existing AWS commitments.

Status by capability

Capability	Availability	How to verify	Production caveat
GPT-5.5 and GPT-5.4 on Amazon Bedrock	Available on Amazon Bedrock. The models are OpenAI options in Bedrock and are called through the Responses API.	Confirm region, Bedrock catalog availability, quota, exact model, endpoint, terms, budget, and a real invocation.	General availability still requires regional validation, data policy, logging, cost, and network controls.
Codex on Amazon Bedrock	General availability. Works through the Codex App, Codex CLI, and IDE integrations with VS Code, JetBrains, and Xcode, with inference routed through Bedrock.	Validate Codex version, model_provider = "amazon-bedrock", model, region, AWS credentials, allowed repositories, and approval workflow.	Do not release against sensitive monorepos before permissions, budget, human review, logs, and data policy are defined.
Amazon Bedrock Managed Agents powered by OpenAI	Announced as a coming next step. AWS describes agents with their own identity, action auditability, and inference on Bedrock, but still points teams to an interest form.	Track availability, region, AgentCore, identity, tools, logs, quotas, support, and terms.	Do not design production assuming Managed Agents already replace Bedrock Agents, AgentCore, or your own agent architecture.
Daybreak, cyber models, and Codex Security on Bedrock	Future direction mentioned by AWS, not general availability.	Watch official announcements and documentation before planning architecture.	Treat as roadmap, not as a dependency for current projects.
ChatGPT, direct OpenAI API, and OpenAI-hosted features	Still separate paths from Bedrock.	Review procurement, authentication, data handling, retention, logs, regions, and required native features.	Do not confuse ChatGPT sign-in or OPENAI_API_KEY with the Codex Bedrock provider.

Which path should you use?

Path	Use it when	Watch out for
OpenAI models on Amazon Bedrock	You want GPT-5.5 or GPT-5.4 inside IAM, VPC/PrivateLink, KMS, CloudTrail, procurement, and AWS commitments.	Validate region and quotas before migrating applications that depend on low latency or high volume.
Codex on Amazon Bedrock	You want engineering teams to use Codex through AWS authentication, billing, and regional residency.	Code governance still needs to cover repositories, sensitive data, tool actions, and human review.
ChatGPT Enterprise/Team or direct OpenAI API	You need OpenAI-hosted surfaces, native features not yet available on Bedrock, or human workflows in ChatGPT.	The data path, logs, billing, and enterprise controls may differ from Bedrock.
Managed Agents powered by OpenAI	You want long-running agents with identity, audit, and managed execution once the service is available.	For now, plan it as a future option and keep pilots on Bedrock models, local Codex, or your own agent architecture.

Configure Codex with Amazon Bedrock

The current Codex documentation describes the amazon-bedrock provider. In this mode, Codex runs locally and sends model requests to Bedrock. The OpenAI-hosted Responses API is not in the request path, and authentication is AWS-native: Bedrock API key or the AWS SDK credential chain.

Minimal ~/.codex/config.toml configuration:

model_provider = "amazon-bedrock"

When you want to pin the model, use the provider-supported ID:

model = "openai.gpt-5.5"
model_provider = "amazon-bedrock"

Codex also documents openai.gpt-5.4 as a supported ID. Before choosing the default, confirm regional model availability and run a short task against a low-risk repository.

Authentication: Bedrock API key or AWS SDK

Codex checks first for a Bedrock API key, then the AWS SDK credential chain. For API-key authentication, set the region explicitly:

export AWS_BEARER_TOKEN_BEDROCK=
export AWS_REGION=us-east-2

For organizations using SSO, prefer temporary credentials through an AWS profile:

aws configure sso --profile codex-bedrock
aws sso login --profile codex-bedrock
export AWS_PROFILE=codex-bedrock

Desktop apps and IDE extensions may not inherit shell environment variables. For those surfaces, place required values in ~/.codex/.env and restart the app or extension.

Surfaces and feature limits

Codex on Bedrock is a strong path for local engineering workflows. It does not turn every OpenAI-hosted feature into a Bedrock feature.

Capability	State with the Bedrock provider
Local Codex CLI	Supported
Local Codex App	Supported
IDE extensions	Supported, including VS Code, JetBrains, and Xcode per the AWS announcement
Locally configured MCP servers and connectors	Supported
Fast Mode	Not available on Bedrock in the current Codex documentation
Codex cloud agents, review, security, and hosted web agents	Not available through this local provider
Hosted first-party plugin directory	Not available
Image generation and voice transcription	Not available

AWS account strategy for pilots

Start with an isolated account or sandbox OU. The AWS account boundary remains one of the simplest ways to control billing, permissions, CloudTrail, Service Control Policies, budgets, and blast radius.

Model	When to use it	Minimum controls
New AWS account	Technical lab, startup, or validation without an existing landing zone.	Root MFA, alternate contacts, IAM Identity Center, monthly budget, and alerts before first use.
AWS Organizations member account	Company with Organizations, Control Tower, or a landing zone.	Sandbox or AI OU, centralized CloudTrail, regional/model SCPs, budgets, and separate permission sets.
AI platform account	Bedrock will serve multiple teams and applications.	Projects by application, cost tags, clear owner, IAM review, and promotion path to production.
Existing production account	Only after the path and controls are validated.	Change management, endpoint policies, CloudTrail, rollback, service budget, and compliance review.

Region, residency, US and Canada

AWS says Codex inference stays in the selected Region. That matters for data residency, but it does not replace validation. Before allowing real data, check the Bedrock regions page, your account catalog, quotas, endpoint, PrivateLink, and applicable terms.

For US teams, choose the region by model availability, latency, compliance, and operational proximity. For Canadian organizations, document whether a pilot may use a US region with low-risk data or must wait for an approved region. Keep sensitive data out of the pilot until the required model, endpoint, quota, and network path are approved.

Cost, audit, and private networking

• Cost: Codex on Bedrock is billed per token, not per seat. Create an account budget, an Amazon Bedrock service-filtered budget, and shared alerts before rollout.
• Attribution: use separate accounts, tags, Projects, and cost reports to separate experiment, development, and production usage.
• Audit: enable centralized CloudTrail and review Bedrock events from day one.
• Network: evaluate VPC endpoints and PrivateLink for bedrock, bedrock-runtime, and bedrock-mantle when traffic must stay private.
• Data: start with low-risk repositories and tasks before allowing personal, customer, or production data.

Rollout checklist

• Chosen model: openai.gpt-5.5 or openai.gpt-5.4, with region validated.
• Codex updated and amazon-bedrock provider confirmed in /status.
• Credentials selected: Bedrock API key or AWS SSO/AWS profile with temporary credentials.
• AWS account or sandbox OU created with budgets, alerts, and CloudTrail.
• Repository policy, sensitive-data policy, human approval, and tool-use policy approved.
• PrivateLink, endpoint policies, SCPs, and KMS evaluated based on risk.
• First task run against a low-risk repository, with cost and logs reviewed.
• Operational owner, rollback, and support process defined before expanding to more developers.

FAQ

Is GPT-5.5 available on Amazon Bedrock?

Yes. AWS announced on June 1, 2026 that GPT-5.5 and GPT-5.4 are generally available on Amazon Bedrock. Still confirm region, catalog availability, quotas, and terms in your account.

Is Codex available on AWS?

Yes. Codex on Amazon Bedrock is generally available through the Codex App, Codex CLI, and IDE integrations. Inference is routed through Bedrock and stays in the selected Region.

Does Codex on Bedrock use ChatGPT login?

No. With the amazon-bedrock provider, Codex uses AWS-native authentication: Bedrock API key or the AWS SDK credential chain. Do not use ChatGPT sign-in or OPENAI_API_KEY for this path.

Are Managed Agents powered by OpenAI production-ready?

Not in the current announcement. AWS describes Managed Agents as a coming next step and points teams to an interest form. Plan it as a future option, not an immediate production dependency.

Is gpt-oss on Bedrock the same as GPT-5.5?

No. gpt-oss is an open-weight family with its own IDs and capabilities. GPT-5.5 and GPT-5.4 are the frontier models highlighted in the general availability announcement.

Do we need PrivateLink?

Not every pilot needs it, but regulated environments should evaluate PrivateLink and endpoint policies early, especially when prompts include code, personal data, or customer data.

How Elevata helps

This work takes more than a config.toml file. Elevata helps platform, security, and engineering teams validate OpenAI on Amazon Bedrock: account and OU design, IAM/SCP, Codex rollout, Mantle vs Runtime, PrivateLink, CloudTrail, Budgets, Projects, observability, residency, and developer governance.

If you want to release Codex, GPT-5.5, or OpenAI workflows on AWS without losing control of cost and security, validate AWS readiness with Elevata.