A few days ago, AWS released OpenAI's , and I'm going to show you how to configure the Codex CLI so you can use these models directly through the Bedrock API, with the credentials you already have.
Depending on your configuration, Codex might already work with GPT models on Bedrock - out of the box. Try this:
codex \
-c model_providers.amazon-bedrock.aws.region="us-east-1" \
-c model_provider="amazon-bedrock" \
-c model="openai.gpt-5.6-terra"
If this starts the Codex CLI and responds to your prompts, you're ready to go! And if you don't want to pass -c flags every time, add the following two lines to the top of ~/.codex/config.toml:
model_providers.amazon-bedrock.aws.region = "us-east-1"
model_provider = "amazon-bedrock"
If it didn't work, or if you want to use a Bedrock API Key instead of the traditional AWS credentials, read on.
Otherwise, have fun! And drop a comment about which one you like better: Codex with GPT-5.6 Sol, or Claude Code with Fable?
Setup with local AWS credentials
The , installed and configured with the required permissions.
The examples in this post use
exportto set environment variables, which works on macOS and Linux. On Windows, replace it withsetin the Command Prompt or$env:in PowerShell.
Test the AWS CLI
aws sts get-caller-identity --output=yaml
If the AWS CLI is installed, it should return the following information (press q to return to the shell):
Account: [Your Account ID]
Arn: [Your User or Role ARN]
UserId: [Your User ID]
In case of an error, follow the .
Check your permissions
Your AWS configuration needs permission to call bedrock-mantle, the Bedrock endpoint that serves various models using the OpenAI-compatible Responses and Chat Completions APIs. The quickest way to get access is to , then run:
codex exec \
--skip-git-repo-check \
-c model_providers.amazon-bedrock.aws.region="us-east-1" \
-c model_provider="amazon-bedrock" \
"Hello"
The
--skip-git-repo-checkflag is there because outside a git repository or trusted folder,codex execrefuses to run. When running the command inside a git repo, you can omit the line.
If this returns a model response like the one below, you've successfully talked to a GPT model on Bedrock.
OpenAI Codex v0.144.5
--------
...
model: openai.gpt-5.5
provider: amazon-bedrock
...
--------
user
Hello
codex
Hello. What would you like to work on?
tokens used
9,580
The 9,580 tokens for a one-word prompt show that Codex sends its own system prompt and tool definitions with the request, which amounts to ~9,400-9,500 tokens of overhead before your content. Keep it in mind when you estimate costs and context budget.
The provider line confirms you're talking to Bedrock rather than to OpenAI directly, and the model line shows the model it used. In this example that's GPT-5.5, Codex's default at the time of writing.
To use a different model, configure it as part of the command:
codex exec \
--skip-git-repo-check \
-c model_providers.amazon-bedrock.aws.region="us-east-1" \
-c model_provider="amazon-bedrock" \
-c model="openai.gpt-5.6-terra" \
"Hello"
If codex exec fails with a permission error, go back one step and check that the AmazonBedrockLimitedAccess policy is attached. For everything else, see the gotchas at the end of this post.
Setup with a Bedrock API Key
You don't need the AWS credential chain to talk to Bedrock. You can use a Bedrock API Key as a plain bearer token, which is the way to go on a machine where the AWS CLI isn't installed or configured, like a CI runner or a fresh container. There are two ways to generate one: the Amazon Bedrock console, which requires no setup at all, and the aws-bedrock-token-generator library for the command line.
Option 1: the AWS Management Console
- Open the , shows the current region table. Check it there before you configure anything.
From the command line - With
AWS_BEARER_TOKEN_BEDROCKset, ask thebedrock-mantleModels API what a region actually hosts. Set the region you want to check:
export AWS_REGION=us-east-1
Then, with jq:
curl -s "https://bedrock-mantle.$AWS_REGION.api.aws/v1/models" \
-H "Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK" \
| jq -r '.data[].id' | sort
Depending on the region, you'll see dozens of models from various providers:
anthropic.claude-fable-5
anthropic.claude-haiku-4-5
...
openai.gpt-5.6-luna
openai.gpt-5.6-sol
openai.gpt-5.6-terra
...
If you don't have jq installed, grep works as a fallback:
curl -s "https://bedrock-mantle.$AWS_REGION.api.aws/v1/models" \
-H "Authorization: Bearer $AWS_BEARER_TOKEN_BEDROCK" \
| grep "gpt-5.6"
In this case, a match prints the whole response, since the body is a single line of JSON. If you get an empty result, the models you grep for aren't available in the selected region.
Note: The
bedrock-mantlein these URLs is the newer of Bedrock's two inference endpoints. The classicbedrock-runtimeendpoint servesInvokeModelandConverse, whilebedrock-mantleserves the OpenAI-compatible Responses and Chat Completions APIs. The GPT-5.6 models run exclusively on mantle, which explains a surprise I had when I initially tried to find them:aws bedrock list-foundation-modelsdoesn't list them (see the gotchas below).
Choose your model
The three GPT-5.6 models are genuinely different products rather than size tiers of one model.
| Sol | Terra | Luna | |
|---|---|---|---|
| Model ID | openai.gpt-5.6-sol | openai.gpt-5.6-terra | openai.gpt-5.6-luna |
| Best for | coding, security, research | everyday production work | high-volume, low-latency |
Sol is the flagship, built for frontier reasoning and agentic coding. Terra is the balanced model for everyday production work, and the one I'd try first for most Codex sessions. Luna is built for classification, summarization, and routing, which makes it a good fit for codex exec in a pipeline.
In the interactive CLI, switching is one command:
› /model
Select Model and Effort
› 1. openai.gpt-5.5
2. openai.gpt-5.4
3. openai.gpt-5.6-sol
4. openai.gpt-5.6-terra
5. openai.gpt-5.6-luna
A short note on cost and context: output pricing drops significantly across the family (Sol $33, Terra $16.50, Luna $6.60 per million output tokens, with input pricing scaling the same way, per the covers provider configuration in more detail, and the , with specialized tools, skills, and knowledge for AWS, available as a native Codex plugin:
codex plugin marketplace add aws/agent-toolkit-for-aws
codex plugin add aws-core --marketplace agent-toolkit-for-aws
Now go run with it and have fun! And drop a comment about which one you like better: Codex with GPT-5.6 Sol, or Claude Code with Fable?
Troubleshooting
aws bedrock list-foundation-models won't show the GPT-5.6 models
They're served by the bedrock-mantle endpoint, which the AWS CLI doesn't cover. Only OpenAI's OSS models show up on bedrock-runtime. Use the Models API call above to see what a region actually hosts.
A region where the model isn't available returns a 404
The body reads The model 'openai.gpt-5.6-sol' does not exist. Dropping the openai. prefix from the model ID produces the identical error (The model 'gpt-5.6-sol' does not exist), so check both before assuming an access problem.
The token generator library needs working AWS credentials
Without them, provide_token() raises RuntimeError: No AWS credentials found. Check your environment or credential provider. The library only derives keys, it doesn't authenticate you.
Run aws sts get-caller-identity first; if that fails, troubleshoot your AWS CLI configuration.
Valid credentials can still lack Bedrock permissions
If your calls fail with an AccessDeniedException even though aws sts get-caller-identity works, your user or role is missing Bedrock permissions. Attach the AWS-managed policy AmazonBedrockLimitedAccess (arn:aws:iam::aws:policy/AmazonBedrockLimitedAccess) to the user or role. It covers both the bedrock-runtime and bedrock-mantle APIs, including bearer-token calls.
The token generator needs an explicit AWS Region
provide_token() raises ValueError: Region must be provided or set via the AWS_REGION environment variable. unless AWS_REGION is set or you pass the region as an argument. It doesn't fall back to the region in your CLI profile the way most AWS SDK calls do, which is why the examples above set AWS_REGION explicitly.
API keys are region-scoped too
A short-term key generated for one region doesn't work against another region's endpoint. Generate it for the region you picked from the availability table.
In Codex, auth failures look like network problems first
With a missing, expired, or invalid key, Codex doesn't report the cause up front. It retries five times (ERROR: Reconnecting... 1/5 through 5/5) before printing the real error.
An invalid or expired key ends in unexpected status 401 Unauthorized: Invalid bearer token with the endpoint URL; no key and no other AWS credentials ends in stream disconnected before completion: failed to load AWS credentials: the credential provider was not enabled, whether or not the AWS CLI is even installed.
When you see the reconnect counter, check AWS_BEARER_TOKEN_BEDROCK before suspecting your network. Short-term keys expire after 12 hours at most, so a session that worked this morning can fail after lunch.
SOCIAL SHARE CARD GENERATOR