Using Codex on Amazon Bedrock

The generative AI coding agent Codex can now use Amazon Bedrock as a model provider. Unlike the existing Bedrock Runtime, Codex accesses GPT-5.6 models through the OpenAI-compatible Responses API of Bedrock Mantle, which creates significant differences in authentication and cost handling.

The InvokeModel API or bedrock:InvokeModel permissions used in existing bedrock-runtime examples do not apply to Codex integration. Codex requires the bedrock-mantle:CreateInference permission and the bedrock-mantle.<region>.api.aws endpoint, so copying existing configurations will result in errors.

The GPT-5.6 models are segmented by use case, such as sol, terra, and luna, and are currently supported only in specific regions like us-east-1. The Seoul region (ap-northeast-2) is not yet included in the support list. The context window for each model is up to 1M tokens, and the region setting must match the PrivateLink endpoint.

Authentication supports Bedrock API key or the AWS SDK credential chain. For production environments, IAM roles or SSO with expiring credentials are recommended, but note that the AWS_BEARER_TOKEN_BEDROCK environment variable takes precedence. In CI environments, it is safer to use short-lived credentials such as OIDC or workload roles.