{"slug": "how-to-run-codex-with-gpt-5-6-on-amazon-bedrock", "title": "How to run Codex with GPT-5.6 on Amazon Bedrock", "summary": "AWS released OpenAI's GPT-5.6 on Amazon Bedrock, and a developer shows how to configure the Codex CLI to use these models through the Bedrock API. The setup requires the AWS CLI with proper permissions, and the Codex CLI has a built-in Bedrock provider that can be configured with region and model settings.", "body_md": "A few days ago, AWS released OpenAI's [GPT-5.6](https://openai.com/index/gpt-5-6/?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el) on [Amazon Bedrock](https://aws.amazon.com/bedrock/?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el), and I'm going to show you how to configure the Codex CLI so you can use these models directly through the Bedrock API, with the credentials you already have.\n\nDepending on your configuration, Codex might already work with GPT models on Bedrock - out of the box. Try this:\n\n```\ncodex \\\n  -c model_providers.amazon-bedrock.aws.region=\"us-east-1\" \\\n  -c model_provider=\"amazon-bedrock\" \\\n  -c model=\"openai.gpt-5.6-terra\"\n```\n\nIf this starts the Codex CLI and responds to your prompts, you're ready to go! And if you don't want to pass `-c`\n\nflags every time, add the following two lines to the top of `~/.codex/config.toml`\n\n:\n\n```\nmodel_providers.amazon-bedrock.aws.region = \"us-east-1\"\nmodel_provider = \"amazon-bedrock\"\n```\n\nIf it *didn't* work, or if you want to use a Bedrock API Key instead of the traditional AWS credentials, read on.\n\nOtherwise, have fun! And drop a comment about which one you like better: Codex with GPT-5.6 Sol, or Claude Code with Fable?\n\nThe [Codex CLI](https://learn.chatgpt.com/docs/codex/cli?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el#getting-started) ships with a built-in Bedrock provider. To be able to use it, you need the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el), installed and configured with the required permissions.\n\nThe examples in this post use\n\n`export`\n\nto set environment variables, which works on macOS and Linux. On Windows, replace it with`set`\n\nin the Command Prompt or`$env:`\n\nin PowerShell.\n\n**Test the AWS CLI**\n\n```\naws sts get-caller-identity --output=yaml\n```\n\nIf the AWS CLI is installed, it should return the following information (press `q`\n\nto return to the shell):\n\n```\nAccount: [Your Account ID]\nArn: [Your User or Role ARN]\nUserId: [Your User ID]\n```\n\nIn case of an error, follow the [AWS CLI quickstart](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el) or [troubleshooting guide](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el).\n\n**Check your permissions**\n\nYour AWS configuration needs permission to call `bedrock-mantle`\n\n, the Bedrock endpoint that serves various models using the OpenAI-compatible Responses and Chat Completions APIs. The quickest way to get access is to [attach](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el) the AWS-managed policy **AmazonBedrockLimitedAccess** (`arn:aws:iam::aws:policy/AmazonBedrockLimitedAccess`\n\n) to the user or role you want to use. It covers both the classic `bedrock-runtime`\n\nAPI and `bedrock-mantle`\n\n, including bearer-token calls.\n\n**Test Codex**\n\nMake sure you have [installed the Codex CLI](https://learn.chatgpt.com/docs/codex/cli?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el#getting-started), then run:\n\n```\ncodex exec \\\n  --skip-git-repo-check \\\n  -c model_providers.amazon-bedrock.aws.region=\"us-east-1\" \\\n  -c model_provider=\"amazon-bedrock\" \\\n  \"Hello\"\n```\n\nThe\n\n`--skip-git-repo-check`\n\nflag is there because outside a git repository or trusted folder,`codex exec`\n\nrefuses to run. When running the command inside a git repo, you can omit the line.\n\nIf this returns a model response like the one below, you've successfully talked to a GPT model on Bedrock.\n\n```\nOpenAI Codex v0.144.5\n--------\n...\nmodel: openai.gpt-5.5\nprovider: amazon-bedrock\n...\n--------\nuser\nHello\ncodex\nHello. What would you like to work on?\ntokens used\n9,580\n```\n\nThe 9,580 tokens for a one-word prompt show that Codex sends its own system prompt and tool definitions with the request, which amounts to ~9,400-9,500 tokens of overhead before your content. Keep it in mind when you estimate costs and context budget.\n\nThe `provider`\n\nline confirms you're talking to Bedrock rather than to OpenAI directly, and the `model`\n\nline shows the model it used. In this example that's GPT-5.5, Codex's default at the time of writing.\n\nTo use a different model, configure it as part of the command:\n\n```\ncodex exec \\\n  --skip-git-repo-check \\\n  -c model_providers.amazon-bedrock.aws.region=\"us-east-1\" \\\n  -c model_provider=\"amazon-bedrock\" \\\n  -c model=\"openai.gpt-5.6-terra\" \\\n  \"Hello\"\n```\n\nIf `codex exec`\n\nfails with a permission error, go back one step and check that the **AmazonBedrockLimitedAccess** policy is attached. For everything else, see the gotchas at the end of this post.\n\nYou don't need the AWS credential chain to talk to Bedrock. You can use a Bedrock API Key as a plain bearer token, which is the way to go on a machine where the AWS CLI isn't installed or configured, like a CI runner or a fresh container. There are two ways to generate one: the Amazon Bedrock console, which requires no setup at all, and the `aws-bedrock-token-generator`\n\nlibrary for the command line.\n\n`AWS_BEARER_TOKEN_BEDROCK`\n\nenvironment variable:\n\n```\n   export AWS_BEARER_TOKEN_BEDROCK=\"bedrock-api-key-...\"\n```\n\nImportant:The key is scoped to the AWS Region you're currently in, so switch regions in the console first if necessary. The key expires when your console session expires, with a maximum of 12 hours.\n\nAWS provides the `aws-bedrock-token-generator`\n\nlibrary for Python and JavaScript, which derives a bearer token from the credentials your AWS CLI is configured with. This option requires the AWS CLI, installed and configured (test it with `aws sts get-caller-identity`\n\nas shown above).\n\n**Python:**\n\nInstall the token generator for Python with `pip`\n\n:\n\n```\npip install aws-bedrock-token-generator\n```\n\nThen generate a key and store it in `AWS_BEARER_TOKEN_BEDROCK`\n\n:\n\n```\nexport AWS_REGION=us-east-1\nexport AWS_BEARER_TOKEN_BEDROCK=$(python3 << 'EOF'\nfrom aws_bedrock_token_generator import provide_token\nprint(provide_token())\nEOF\n)\n```\n\n**JavaScript:**\n\nInstall the token generator for JavaScript with `npm`\n\n:\n\n```\nnpm install @aws/bedrock-token-generator\n```\n\nThen generate a key and store it in `AWS_BEARER_TOKEN_BEDROCK`\n\n:\n\n```\nexport AWS_REGION=us-east-1\nexport AWS_BEARER_TOKEN_BEDROCK=$(node --input-type=module << 'EOF'\nimport { getTokenProvider } from '@aws/bedrock-token-generator';\nconsole.log(await getTokenProvider()());\nEOF\n)\n```\n\nBoth the Python and JavaScript token generators use the default credential provider chain, so they pick up whatever profile or session your AWS CLI is using. The key is scoped to a single AWS Region, and it expires when the underlying credentials expire, capped at 12 hours.\n\nSince generating a token is computationally inexpensive and free of charge, you can call `provide_token()`\n\nbefore each request instead of caching it.\n\nThe key is a bearer token you can use directly against the `bedrock-mantle`\n\nAPI, even before Codex enters the picture. Here's GPT-5.6 Luna via the OpenAI-compatible Responses API:\n\n```\ncurl -X POST \\\n  \"https://bedrock-mantle.$AWS_REGION.api.aws/openai/v1/responses\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK\" \\\n  -d '{\n    \"model\": \"openai.gpt-5.6-luna\",\n    \"input\": \"Hello\",\n    \"max_output_tokens\": 512\n  }'\n```\n\nThe same key works with the Bedrock Runtime API, and with every other model your permissions allow:\n\n```\ncurl -X POST \\\n  \"https://bedrock-runtime.$AWS_REGION.amazonaws.com/model/us.anthropic.claude-sonnet-5/converse\" \\\n  -H \"Content-Type: application/json\" \\\n  -H \"Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK\" \\\n  -d '{\n    \"messages\": [\n      {\"role\": \"user\", \"content\": [{\"text\": \"Hello\"}]}\n    ]\n  }'\n```\n\nWith `AWS_REGION`\n\nset and the key stored in `AWS_BEARER_TOKEN_BEDROCK`\n\n, you can point Codex at Bedrock directly. The two environment variables along with two `-c`\n\nflags are the whole setup:\n\n```\nexport AWS_REGION=us-east-1\nexport AWS_BEARER_TOKEN_BEDROCK=\"bedrock-api-key-...\"\n\ncodex exec \\\n  --skip-git-repo-check \\\n  -c model_provider=\"amazon-bedrock\" \\\n  -c model=\"openai.gpt-5.6-luna\" \\\n  \"say pong\"\n```\n\nBoth variables are standard AWS names rather than Codex inventions, so there's nothing to wire up: Codex checks `AWS_BEARER_TOKEN_BEDROCK`\n\nbefore falling back to the SDK credential chain, and `AWS_REGION`\n\ntells it which region's endpoint to call. This works on a machine with no AWS CLI and no Codex configuration at all.\n\nAt the time of writing, the GPT-5.6 models don't run in every AWS Region, and they don't all run in the same ones. Everything in this post is region-scoped, API keys included, so pick your region from this table and use it consistently:\n\n| Model | Model ID | Regions |\n|---|---|---|\n| Sol | `openai.gpt-5.6-sol` |\nus-east-1, us-east-2 |\n| Terra | `openai.gpt-5.6-terra` |\nus-east-1, us-east-2, us-west-2 |\n| Luna | `openai.gpt-5.6-luna` |\nus-east-1, us-east-2, us-west-2 |\n\nAll three models are available in `us-east-1`\n\nand `us-east-2`\n\n, which makes either of them an easy default while you're getting started. Asking a region that doesn't have your model returns an HTTP 404, e.g. `The model 'openai.gpt-5.6-sol' does not exist`\n\n.\n\nOver time, the models will likely be rolled out to additional regions. You can check model availability...\n\n**Via the model cards** - Each model's page in the Amazon Bedrock documentation for [GPT-5.6 Sol](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el#model-card-openai-gpt-56-sol-regional-availability), [Terra](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-terra.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el#model-card-openai-gpt-56-terra-regional-availability), and [Luna](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-luna.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el#model-card-openai-gpt-56-luna-regional-availability) shows the current region table. Check it there before you configure anything.\n\n**From the command line** - With `AWS_BEARER_TOKEN_BEDROCK`\n\nset, ask the `bedrock-mantle`\n\nModels API what a region actually hosts. Set the region you want to check:\n\n```\n  export AWS_REGION=us-east-1\n```\n\nThen, with `jq`\n\n:\n\n```\n  curl -s \"https://bedrock-mantle.$AWS_REGION.api.aws/v1/models\" \\\n       -H \"Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK\" \\\n  | jq -r '.data[].id' | sort\n```\n\nDepending on the region, you'll see dozens of models from various providers:\n\n```\n  anthropic.claude-fable-5\n  anthropic.claude-haiku-4-5\n  ...\n  openai.gpt-5.6-luna\n  openai.gpt-5.6-sol\n  openai.gpt-5.6-terra\n  ...\n```\n\nIf you don't have `jq`\n\ninstalled, `grep`\n\nworks as a fallback:\n\n```\n  curl -s \"https://bedrock-mantle.$AWS_REGION.api.aws/v1/models\" \\\n       -H \"Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK\" \\\n  | grep \"gpt-5.6\"\n```\n\nIn this case, a match prints the whole response, since the body is a single line of JSON. If you get an empty result, the models you grep for aren't available in the selected region.\n\nNote: The\n\n`bedrock-mantle`\n\nin these URLs is the newer of Bedrock's two inference endpoints. The classic`bedrock-runtime`\n\nendpoint serves`InvokeModel`\n\nand`Converse`\n\n, while`bedrock-mantle`\n\nserves the OpenAI-compatible Responses and Chat Completions APIs. The GPT-5.6 models run exclusively on mantle, which explains a surprise I had when I initially tried to find them:`aws bedrock list-foundation-models`\n\ndoesn't list them (see the gotchas below).\n\nThe three GPT-5.6 models are genuinely different products rather than size tiers of one model.\n\n| Sol | Terra | Luna | |\n|---|---|---|---|\n| Model ID | `openai.gpt-5.6-sol` |\n`openai.gpt-5.6-terra` |\n`openai.gpt-5.6-luna` |\n| Best for | coding, security, research | everyday production work | high-volume, low-latency |\n\nSol is the flagship, built for frontier reasoning and agentic coding. Terra is the balanced model for everyday production work, and the one I'd try first for most Codex sessions. Luna is built for classification, summarization, and routing, which makes it a good fit for `codex exec`\n\nin a pipeline.\n\nIn the interactive CLI, switching is one command:\n\n```\n› /model\n\nSelect Model and Effort\n\n› 1. openai.gpt-5.5\n  2. openai.gpt-5.4\n  3. openai.gpt-5.6-sol\n  4. openai.gpt-5.6-terra\n  5. openai.gpt-5.6-luna\n```\n\nA short note on cost and context: output pricing drops significantly across the family (Sol $33, Terra $16.50, Luna $6.60 per million output tokens, with input pricing scaling the same way, per the [Bedrock pricing page](https://aws.amazon.com/bedrock/pricing/?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el)), and all three share a 272K context window. Remember that Codex's own overhead of roughly ~9,400-9,500 tokens rides along on every request.\n\nThe following two lines make every Codex session use Bedrock automatically:\n\n```\nmodel_providers.amazon-bedrock.aws.region = \"us-east-1\"\nmodel_provider = \"amazon-bedrock\"\n```\n\nTo pin a model as well, add a third line:\n\n```\nmodel = \"openai.gpt-5.6-terra\"\n```\n\nWrite these as flat dotted keys at the top of `~/.codex/config.toml`\n\n, before any entries with a `[...]`\n\nheader.\n\nAuthentication stays exactly as before: the API key in `AWS_BEARER_TOKEN_BEDROCK`\n\n, or your AWS credential chain. With the region defined in the config file, you don't even need to set `AWS_REGION`\n\n.\n\nStart with Terra and see how it handles your actual work before you decide the flagship merits paying roughly double the price. The [Codex and Bedrock guide](https://learn.chatgpt.com/docs/amazon-bedrock?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el) covers provider configuration in more detail, and the [model cards](https://docs.aws.amazon.com/bedrock/latest/userguide/model-card-openai-gpt-56-sol.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el) hold the current region tables, which are the first thing to check when a model 404s on you.\n\nAnd if you want to use Codex for work with AWS, don't forget to install the new [Agent Toolkit for AWS](https://docs.aws.amazon.com/agent-toolkit/latest/userguide/what-is-agent-toolkit.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el), with specialized tools, skills, and knowledge for AWS, available as a native Codex plugin:\n\n```\ncodex plugin marketplace add aws/agent-toolkit-for-aws\ncodex plugin add aws-core --marketplace agent-toolkit-for-aws\n```\n\nNow go run with it and have fun! And drop a comment about which one you like better: Codex with GPT-5.6 Sol, or Claude Code with Fable?\n\n`aws bedrock list-foundation-models`\n\nwon't show the GPT-5.6 models\n\nThey're served by the `bedrock-mantle`\n\nendpoint, which the AWS CLI doesn't cover. Only OpenAI's OSS models show up on `bedrock-runtime`\n\n. Use the Models API call above to see what a region actually hosts.\n\n**A region where the model isn't available returns a 404**\n\nThe body reads `The model 'openai.gpt-5.6-sol' does not exist`\n\n. Dropping the `openai.`\n\nprefix from the model ID produces the identical error (`The model 'gpt-5.6-sol' does not exist`\n\n), so check both before assuming an access problem.\n\n**The token generator library needs working AWS credentials**\n\nWithout them, `provide_token()`\n\nraises `RuntimeError: No AWS credentials found. Check your environment or credential provider.`\n\nThe library only derives keys, it doesn't authenticate you.\n\nRun `aws sts get-caller-identity`\n\nfirst; if that fails, [troubleshoot your AWS CLI configuration](https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-troubleshooting.html?trk=ef8ca202-7071-4ec3-aff2-78ef3bddfabf&sc_channel=el).\n\n**Valid credentials can still lack Bedrock permissions**\n\nIf your calls fail with an AccessDeniedException even though `aws sts get-caller-identity`\n\nworks, your user or role is missing Bedrock permissions. Attach the AWS-managed policy **AmazonBedrockLimitedAccess** (`arn:aws:iam::aws:policy/AmazonBedrockLimitedAccess`\n\n) to the user or role. It covers both the `bedrock-runtime`\n\nand `bedrock-mantle`\n\nAPIs, including bearer-token calls.\n\n**The token generator needs an explicit AWS Region**\n\n`provide_token()`\n\nraises `ValueError: Region must be provided or set via the AWS_REGION environment variable.`\n\nunless `AWS_REGION`\n\nis set or you pass the region as an argument. It doesn't fall back to the region in your CLI profile the way most AWS SDK calls do, which is why the examples above set `AWS_REGION`\n\nexplicitly.\n\n**API keys are region-scoped too**\n\nA short-term key generated for one region doesn't work against another region's endpoint. Generate it for the region you picked from the availability table.\n\n**In Codex, auth failures look like network problems first**\n\nWith a missing, expired, or invalid key, Codex doesn't report the cause up front. It retries five times (`ERROR: Reconnecting... 1/5`\n\nthrough `5/5`\n\n) before printing the real error.\n\nAn invalid or expired key ends in `unexpected status 401 Unauthorized: Invalid bearer token`\n\nwith the endpoint URL; no key and no other AWS credentials ends in `stream disconnected before completion: failed to load AWS credentials: the credential provider was not enabled`\n\n, whether or not the AWS CLI is even installed.\n\nWhen you see the reconnect counter, check `AWS_BEARER_TOKEN_BEDROCK`\n\nbefore suspecting your network. Short-term keys expire after 12 hours at most, so a session that worked this morning can fail after lunch.", "url": "https://wpnews.pro/news/how-to-run-codex-with-gpt-5-6-on-amazon-bedrock", "canonical_source": "https://dev.to/aws/how-to-run-codex-with-gpt-56-on-amazon-bedrock-12f4", "published_at": "2026-07-17 14:39:53+00:00", "updated_at": "2026-07-17 15:00:02.080970+00:00", "lang": "en", "topics": ["large-language-models", "ai-infrastructure", "developer-tools"], "entities": ["AWS", "OpenAI", "GPT-5.6", "Amazon Bedrock", "Codex CLI", "Codex"], "alternates": {"html": "https://wpnews.pro/news/how-to-run-codex-with-gpt-5-6-on-amazon-bedrock", "markdown": "https://wpnews.pro/news/how-to-run-codex-with-gpt-5-6-on-amazon-bedrock.md", "text": "https://wpnews.pro/news/how-to-run-codex-with-gpt-5-6-on-amazon-bedrock.txt", "jsonld": "https://wpnews.pro/news/how-to-run-codex-with-gpt-5-6-on-amazon-bedrock.jsonld"}}