# Use OpenAI Codex CLI with Amazon Bedrock Models - Pay As You Go

> OpenAI Codex CLI on Amazon Bedrock Models: Why Bother? Here’s why Codex plus the Amazon...

- Author: Gabriel Koo (AWS Community Builder)
- Published: 2025-08-27
- Topics: vibecoding, genai, aws
- HTML: https://gabrielkoo.com/blog/use-openai-codex-cli-with-amazon-bedrock-models-pay-as-you-go-48eb/
- Original canonical URL: https://dev.to/aws-builders/use-openai-codex-cli-with-amazon-bedrock-models-pay-as-you-go-48eb

**NEW** (2026 Jan) Newer versions of Codex uses `/v1/responses` API by default and dropped support for chat completions endpoint. You'll need to add `wire_api = "responses"` to your existing config to use the new endpoint instead: <https://docs.aws.amazon.com/bedrock/latest/userguide/bedrock-mantle.html>.

## OpenAI Codex CLI on Amazon Bedrock Models: Why Bother?

Here’s why Codex plus the Amazon Bedrock models make sense under some cases:

1. **Pay as you go**: No fixed cost—just pay for Bedrock tokens and Lambda invocations. No monthly minimum while Amazon Q Developer CLI  has a free-tier quota, you must upgrade to the $19 USD/month paid plan if you have breached it, which *still* enforces usage caps.
2. **Use your own fine-tuned models**: Swap model endpoints easily; the gateway can even route to your own Amazon Bedrock fine-tunes (e.g. Nova) without friction.
3. **Transparent logging**: Codex’s request/response logs give you full visibility — a plus for debugging and cost tracking.
4. **No AWS IAM/Identity required - Perfect for Headless Workloads**: You only need your Bedrock Access Gateway API key; no need to log into your AWS identities with an inconvenient console authentication with your AWS Identity Center user/Builder ID (great for CI/CD and ephemeral cloud instances).
5. **Regional flexibility**: Yes, you could use [Claude Code with Amazon Bedrock](https://docs.anthropic.com/en/docs/claude-code/amazon-bedrock), but then I live in Hong Kong where Claude model usage is not allowed. 
6. **Amazon Nova Micro: Price King**: For pure simple text LLM tasks, swapping Sonnet 4 for Nova Micro cuts costs by a factor of 85 — Comparing between Nova Micro and Sonnet 4.
7. If you have a bunch of AWS Credits from AWS events - you're cover with your usages with `gpt-oss` / Nova family of models!

## Setup: Codex CLI + Bedrock Gateway

(UPDATE: Deprecated after Codex v0.80.0 https://github.com/openai/codex/discussions/7782)

Get your Lambda Gateway Function URL and API Key after deployment. (Check my earlier article for a step-by-step guide to get it running on Lambda via AWS SAM: <https://dev.to/aws-builders/use-amazon-bedrock-models-via-an-openai-api-compatible-serverless-endpoint-now-without-fixed-cost-5hf5>)

Here's a no-brainer if you want to skip my article and deploy it right away: 

```bash
(
  cd /tmp && \
  git clone --depth=1 https://github.com/gabrielkoo/bedrock-access-  gateway-function-url && \
  cd bedrock-access-gateway-function-url && \
  ./prepare_source.sh && \
  sam build && \
  sam deploy --guided
)
```

Now [install Codex](https://github.com/openai/codex?tab=readme-ov-file#installing-and-running-codex-cli):

```bash
npm i -g @openai/codex
```

Configure Codex like so:

```toml
# ~/.codex/config.toml
profile = 'bedrock'

[profiles.bedrock]
model = 'openai.gpt-oss-120b-1:0'
# OR
# model = 'us.amazon.nova-premier-v1:0'
model_provider = 'bedrock'
model_reasoning_effort = "low"
# NEW! Newer versions of Codex uses /v1/responses API by default.
wire_api = "chat"

[model_providers.bedrock]
name = 'bedrock'
base_url = 'https://RANDOM_HASH_HERE.lambda-url.AWS_REGION.on.aws/api/v1'
env_key = 'CODEX_OPENAI_API_KEY'
```

Alternatively, if you want to stick to only `gpt-oss` models but not e.g. Claude/Nova families of models, you can use the latest official OpenAI compatible endpoint with an Amazon Bedrock API Key instead - there will be no need to host the Bedrock Access Gateway:

```toml
...
web_search = "disabled"

[model_providers.bedrock]
name = "AmazonBedrock"
base_url = "https://bedrock-mantle.us-west-1.api.aws/v1"
env_key = "ENV_KEY_FOR_YOUR_BEDROCK_API_KEY"

...

[profiles.gpt-oss]
# NOTE: The model ID is truncated if you use the responses API.
model = "openai.gpt-oss-120b"

```

Query the LLM:

```bash
codex --profile bedrock "What is my public IP address?"
```

![Codex with Bedrock model in action](/assets/img/f87b08972878.png)


## Model Support

Note that not all Bedrock models work over the gateway. Models must support **tool calls**.

**GPT OSS (20b/120b)**: Optimzied with Codex
**Nova family (Premier, Pro, Lite, Micro):** All tested and working.
**Claude, Llama, Mistral, Command R:** Working, subject to regional restrictions (e.g. Hong Kong).

## Amazon Q Developer CLI vs Codex CLI on Bedrock

Amazon Q Developer CLI is indeed **officially supported in Hong Kong** — but after your free usage ([50 agentic chats/month](https://aws.amazon.com/q/developer/pricing/)), you'll need the $19/month paid plan, and may hit quotas even then.

Codex CLI via Amazon Bedrock gives *unmetered usage* (subject to whatever quotas you have on Amazon Bedrock itself and Lambda), no AWS login required - you just need to prepare the API key that you defined your self when you deployed the Bedrock Access Gateway.

## Why Don't I Just Use the new OpenAI Compatible Endpoint?

Refer to my other blog article [AWS Launches OpenAI-Compatible API for Bedrock (and I Did Some Tests!)](https://dev.to/aws-builders/aws-launches-openai-compatible-api-for-bedrock-and-i-did-some-tests-49cd), the new OpenAI compatible Amazon Bedrock API endpoint supports `gpt-oss` 20b as well as 120b out of the box, other models like Nova or Claude are not supported.

So with my solution of wrapping the calls via a Bedrock Access Gateway, you can switch to other models whenever you want according your choice.

## Summary

Codex CLI + Amazon Bedrock (via OpenAI-compatible gateway) gives developers a way to use pay-as-you-go agentic CLI Agents, swap fine-tuned models easily, and avoid region/pricing issues present in other AWS or Anthropic toolings. For minimal cost, Nova Micro is unbeatable for text workloads. And yes, my serverless gateway solution is the backbone — but more about that in [my previous blog](https://dev.to/aws-builders/use-amazon-bedrock-models-via-an-openai-api-compatible-serverless-endpoint-now-without-fixed-cost-5hf5)!