Codex on AWS Bedrock: what it changes for AI coding workflows (and what it doesn't)
On June 1, 2026, OpenAI's GPT-5.5, GPT-5.4, and Codex went generally available on Amazon Bedrock, about a month after OpenAI and AWS announced an expanded partnership (AWS News Blog, OpenAI). The headlines read like a model launch. It is not one. The model is the same Codex roughly four million people already use every week. What changed is where it runs, and for a team that ships software, the location is the whole story.
The one-line version
Before, using Codex meant sending your code to OpenAI's API. Now you can point the Codex CLI and IDE plugins at an endpoint inside your own AWS account, authenticate with the credentials your org already manages, and keep the request inside the Bedrock Region you pick. Same agent, different blast radius for compliance and billing.
What actually changed
Authentication moves to AWS. Codex on Bedrock accepts an Amazon Bedrock API key or the standard AWS SDK credential chain. If AWS_BEARER_TOKEN_BEDROCK is set it wins; otherwise the SDK chain resolves it the same way every other AWS call does. For a team that already runs IAM, this means no second identity system to provision and revoke.
Data stays in your Region. AWS states that all processing stays within the Bedrock Region you select, with the usual IAM, VPC isolation, and encryption applied (About Amazon). GPT-5.5 launched in US East (Ohio); GPT-5.4 is in US East (Ohio) and US West (Oregon). That residency line is the reason a regulated shop can put this in front of its security review at all.
Billing folds into your AWS bill. Pricing is per token, with no seat licenses and no per-developer commitment. Usage flows through the same account you already reconcile, which removes one of the quiet blockers to adopting a coding agent at scale: a separate vendor invoice that procurement has to approve every renewal.
The surface is the real Codex. You still get the Codex App, the Codex CLI, and IDE integrations for VS Code, JetBrains, and Xcode. Under the hood the calls go through the Responses API using the OpenAI SDK pointed at Bedrock endpoints. Your developers' day does not change; the plumbing behind it does.
What did not change
This is not a smarter Codex. The coding ability, the failure modes, the tendency to confidently rewrite a file you did not ask it to touch, all of that is identical to the first-party product. If Codex was not winning your evals last week on raw quality, Bedrock does not move that needle. The upgrade is procurement and governance, not capability.
It also does not make AWS the only place these agents live. Anthropic's models have run on Bedrock for a long time, and Claude Code can target a Bedrock endpoint the same way. So the honest framing is not "OpenAI came to AWS, so switch." It is "both major coding agents now run inside the same compliance boundary, so the decision goes back to fit."
How I would decide
If you are an individual or a small team with no data-residency mandate, this announcement changes nothing for you. Keep using whatever agent wins your day, billed directly. The Bedrock path adds an IAM layer and an AWS Region constraint you do not need.
If you are inside a company that already standardizes on AWS and has a security team that says no to new data processors, this is the unlock. The pitch to that team is short: no new vendor, no new identity provider, data stays in-Region, billing is on the existing contract. That is a much easier review than "we want to send the monorepo to a SaaS we have not vetted."
And if you are choosing between coding agents rather than cloud-routing one, the location is now a wash, so go back to the things that have always mattered: which agent handles your codebase's size, which one's autonomous multi-step mode you trust, and which one your developers reach for without being told. I wrote a longer decision tree on that in Cursor vs Claude Code vs Aider, and the model-quality side in what changed with Claude Opus 4.8.
The part nobody puts in the press release
Routing a coding agent through Bedrock does not cap your spend by itself. Per-token billing with no seat license is friendlier for procurement and meaner for a runaway agent that loops on a large repo. The cost discipline still has to come from you: scoping what the agent sees, watching token burn, and pruning context. That work is identical whether the tokens are billed by OpenAI, Anthropic, or AWS. If anything, folding the bill into a big AWS invoice makes the line item easier to lose track of, so the habits I described in how to cut your Claude Code bill apply here too.
Bottom line
Codex on Bedrock is a distribution and governance move, and a smart one. It puts a popular coding agent inside the account, the identity system, and the compliance Region a lot of enterprises already live in. It does not change what the agent can do, and it does not end the agent comparison. If you are at a regulated AWS shop, it removed your best excuse not to pilot one. If you are not, the decision still comes down to which agent earns its place in your editor.