Lifestyle

AWS: ChatGPT Desktop App Now Usable via Amazon Bedrock in GovCloud, Aimed at High-Security Organizations

AWS says on its official blog that the ChatGPT desktop app can now use OpenAI models through Amazon Bedrock in AWS GovCloud (US). It mainly affects organizations whose security architecture requires GovCloud; AWS also cautions that this setup does not mean a workload is authorized, and organizations must still run their own review.

About 4 min read

AWS: ChatGPT Desktop App Now Usable via Amazon Bedrock in GovCloud, Aimed at High-Security Organizations
Image: Mokaair (Original editorial artwork)

What happened

AWS says on its official blog that the ChatGPT desktop app is now available on Amazon Bedrock in AWS GovCloud (US). Amazon Bedrock is the AWS service that provides access to AI models, and GovCloud (US) is an AWS cloud environment. Through two components, Work and Codex, users can access OpenAI's frontier models.

According to AWS, Work handles complex multi-step tasks and delivers results ready for review, while Codex is a coding agent for developing, testing and reviewing software. AWS also says users can reach it through the desktop app, the Codex CLI (the command-line version), and integrations with development tools such as Visual Studio Code, JetBrains and Xcode. Model inference (the process in which the model actually computes and generates responses) is sent through the Responses API on Amazon Bedrock.

How requests are routed and data is handled

AWS says the guide targets organizations whose security architecture requires model inference to use AWS GovCloud (US) identity, endpoints (the connection addresses of a service) and regional controls. Requests are sent through Amazon Bedrock Mantle in the us-gov-west-1 Region, and access can be managed with AWS IAM (Identity and Access Management) and existing GovCloud network controls.

AWS notes that for customers with data residency requirements (data must be processed within a specific region), processing stays within the selected Amazon Bedrock Region. Billing is per token (the billing unit for model usage), with no seat licenses or per-developer commitments. A configurable zero data retention (ZDR) mode is also supported; in this mode, prompts and responses are not written to persistent storage by AWS and are not shared with the model provider.

Key points from the AWS blog
ItemAWS's description
Available componentsWork (complex multi-step tasks) and Codex (coding agent)
Inference pathAmazon Bedrock Mantle in us-gov-west-1, using the Responses API
Access managementAWS IAM and existing GovCloud network controls
BillingPer token; no seat licenses or per-developer commitments
Data retentionZero data retention (ZDR) supported
Sign-in and authenticationAPI-mode sign-in; supports Bedrock API keys or the AWS SDK credential chain (including SSO, single sign-on)

Limits of a controlled deployment

AWS says the described setup uses API-mode sign-in, a managed device policy, a named AWS profile and network restrictions that allow connections only to the approved Amazon Bedrock endpoint, while disabling other external connections and network-capable features. AWS describes this as a deployment that agency security teams can test and document before approving broader use.

AWS explains that deployment needs two configuration files, config.toml and requirements.toml, and both must be in place before the app starts. requirements.toml is controlled by administrators and sets security limits that users cannot override. AWS also notes that because this setup uses AWS directly, ChatGPT workspace rules and user roles do not govern it; the main security controls are the computer's policy and the AWS identity and permissions in use.

AWS also describes how to handle problems: if a GovCloud endpoint is reported as unsupported, confirm the exact desktop or app-server version, endpoint and model with OpenAI, since simply changing the URL does not establish support. If validation checks fail, AWS recommends halting the rollout, returning affected devices to the previously approved policy and provider settings, and revoking temporary AWS credentials or API keys.

FAQ

Who is the source of this news?

The content comes from AWS's own machine learning blog. Every claim in this article is AWS's statement, not an independent third-party verification.

Who is this setup guide written for?

AWS says it is for organizations whose security architecture requires model inference to use AWS GovCloud (US) identity, endpoints and regional controls.

What if the app asks me to sign in to an OpenAI account?

AWS suggests checking that the locations and file names of requirements.toml and config.toml are exactly correct, then quitting all ChatGPT and Codex processes and restarting. Both files must be in place before the app starts.

Browse the latest news in this topic

Sources

Lifestyle