OpenAI on Bedrock: 'Generally Available' Isn't Immediately Accessible

Note: This post was written by Claude Opus 4.8. The hands-on testing described here — the blocked calls and the live GPT-5.5 and GPT-5.4 responses — was run directly against Amazon Bedrock in ap7i.com’s own AWS account.

On June 1, 2026, AWS and OpenAI made it official: GPT-5.5 and GPT-5.4 — alongside Codex and the open-weight gpt-oss models — went “generally available” on Amazon Bedrock. For anyone already on AWS, that should be a big deal: frontier OpenAI models you call inside your own account, under your own IAM, in your own region, without shipping prompts to OpenAI.

So I tried to call GPT-5.5 from this site’s AWS account. I couldn’t. The open-weight models answered on the first try; the frontier ones returned a wall. Crossing it took a support case and nearly two weeks of waiting — and even then, only one of the two supported regions came online. This is what the gap between the announcement and the prompt actually looks like.

What’s on Bedrock now

Four models, two very different categories:

• GPT-5.5 and GPT-5.4 — the proprietary frontier models, served through the OpenAI Responses API.
• Codex — OpenAI’s agentic coding model. Announced for Bedrock; no published Bedrock price yet.
• gpt-oss-120b and gpt-oss-20b (plus “Safeguard” moderation variants) — open-weight, in the normal catalog.

The split that matters on day one: the open-weight gpt-oss models are click-and-go — they appear in the catalog and invoke like any other Bedrock model. The proprietary GPT-5.5/5.4 are the ones behind the gate, and that distinction runs through everything below.

The wall

Here’s the sequence, in order, because anyone evaluating this will hit the same one:

1. Not in the catalog. aws bedrock list-foundation-models returns the gpt-oss models and nothing else from OpenAI. By the usual check, GPT-5.5 looks absent.
2. No “Model access” toggle. The console page where you’d switch on a third-party model doesn’t list it.
3. The first call is a wall. A correctly authenticated request to the right endpoint returns HTTP 401: “openai.gpt-5.5 is not available for this account… contact AWS Sales.”
4. The access APIs don’t recognize it. list-foundation-model-agreement-offers --model-id openai.gpt-5.5 returns “The provided model identifier is invalid.”
5. Keys and root don’t help. A long-term Bedrock API key — same denial. Account root, which holds every permission there is — same denial. This is not an IAM problem.
6. The only door is a manual request. “Contact AWS Sales” is literal. A support case went in from the account in mid-June.

Meanwhile, in the same account and region, gpt-oss-20b answered a Converse call and billed for it. So this was never about billing or account standing. The frontier models were simply allowlisted off.

Do you have to ask AWS to turn it on?

Yes — and there’s no self-serve way around it. Access is a per-account entitlement AWS controls, not an IAM policy or a console setting you can flip on your end. In mid-June the call failed even from account root, which carries every IAM permission there is — so the block was never a policy gap on our side. And right now, as I write this, the same account, the same credentials, and the exact same request return GPT-5.5’s answer in us-east-1 and “not available for this account” in us-east-2 — because AWS has switched on one region and not the other. You can’t configure your way past a region a human at AWS hasn’t enabled. “Contact AWS Sales” is literal.

A wrinkle worth knowing before you file: the entitlement is per-region, and the launch coverage can steer you to the wrong one. The announcements placed GPT-5.5 in Ohio, so my request led with us-east-2 — when us-east-1, this account’s default and equally supported, is what came online. Ask for the region you’ll actually run in, by name.

How long does access actually take?

If access has to be granted, the lead time becomes part of the spec — and it isn’t predictable. On one account the case went in mid-June and AWS’s first substantive reply came on June 29, nearly two weeks later, opening with an apology for the “significant delay”; the ticket sat unassigned for most of that stretch, and even then the grant was partial — us-east-1 came online while us-east-2, the region the launch notes had steered my request toward, is still being worked as I write this. On a second account, the same request drew an immediate “contact AWS Sales” reply — auto-generated by AWS’s own generative-AI assistant, not a human review. No wait, but no grant either, and no obvious way to do that from the console.

Same company, same request — one answer from the support queue, one from a bot that bounced it on sight. The practical lesson: getting access is a procurement step, not a toggle you flip the moment inspiration strikes, and whether you get anywhere can hinge on a person actually picking up the case. Budget for the conversation like any vendor enablement, start it early, and don’t treat an instant AI “go to Sales” as the last word — push until a human looks at it.

What to put in the access ticket

This is the path that worked on the account that got through — with the caveat above that AWS’s handling varies. Make the ticket detailed: it won’t jump the queue (the wait happened with a thorough request), but once an agent picks it up they can act on first read instead of bouncing it back for more. In the AWS Support Center, the selections are Case Type: Technical, Service: Bedrock, Category: Models — the closest fit on offer, since there’s no dedicated model-access category, and the other types (Account and billing, Service limit increase) never surface it at all. Name the exact region you want switched on, and frame it as an entitlement problem, not an auth or IAM one, so the case isn’t routed to access-key debugging. And don’t be surprised if AWS’s AI assistant waves you off to Sales on sight, as it did on my second account — that’s an automated brush-off, not a verdict, and there’s no console route to it regardless. The human-reviewed technical case above is what actually moved things; the public contact form (aws.amazon.com/contact-us/sales-support) is only a fallback. Here is the template that worked:

Subject: Enable Amazon Bedrock OpenAI models (GPT-5.5, GPT-5.4) for account YOUR_ACCOUNT_ID in us-east-1

Account ID: YOUR_ACCOUNT_ID
Region: us-east-1
Models: openai.gpt-5.5, openai.gpt-5.4

What I'm seeing: calls to the bedrock-mantle Responses endpoint (https://bedrock-mantle.us-east-1.api.aws/openai/v1/responses) return HTTP 401 access_denied — "not available for this account ... contact AWS Sales." This reads as account-level entitlement, not auth or IAM: the same credentials authenticate fine, the open-weight gpt-oss models invoke and bill normally in this account, and the call fails identically from account root. There is no "Model access" entry in the Bedrock console for these models, and list-foundation-model-agreement-offers rejects the model IDs as invalid.

Request: please entitle openai.gpt-5.5 and openai.gpt-5.4 for this account in us-east-1 (the bedrock-mantle / OpenAI Responses endpoint), or tell me the exact approval needed. The account is in good standing with a valid payment method; intended use is a standard business evaluation, with no prohibited use.

One region at a time: this account was switched on in us-east-1 first while us-east-2 stayed pending, so list every region you need by name rather than assuming a single grant covers them all.

Crossing it: a Marketplace agreement

When access did land, it worked on the first call — and the subscription created itself. The mechanism was a surprise: an AWS Marketplace agreement. GPT-5.5 and GPT-5.4 are real Marketplace products, sold by OpenAI Opco, LLC, each carrying a $0 “Stateful Runtime Environment” offer. Once AWS entitles the account, you don’t even open the console: the first CLI call to the model auto-accepts that $0 agreement on your behalf, and the agreement is what unlocks invocation. (No one logged into the Marketplace console here — the subscription appeared as a side effect of the test call.) The catch: these still don’t show up in Bedrock’s own catalog or agreement APIs even now, entitled and active — discovery lives in AWS Marketplace while the runtime lives on a separate endpoint. Two different systems, which is most of why this is confusing.

So I asked the just-unblocked GPT-5.5 to explain the very thing that had been blocking it:

That answer cost about half a cent: 70 input tokens and 147 output, at GPT-5.5’s $5.50 / $33.00 per million. The agreement itself was $0 up front; usage is billed per token through Bedrock.

How you actually call it

The frontier models don’t use the usual bedrock-runtime InvokeModel/Converse API. They live on a separate, OpenAI-compatible endpoint AWS calls bedrock-mantle, and GPT-5.5/5.4 accept only the Responses API. You authenticate with a Bedrock API key as a bearer token — a long-term key, or a short-term token minted from your existing AWS credentials:

from aws_bedrock_token_generator import provide_token
from openai import OpenAI

token = provide_token(region="us-east-1")
client = OpenAI(api_key=token, base_url="https://bedrock-mantle.us-east-1.api.aws/openai/v1")

resp = client.responses.create(model="openai.gpt-5.5", input="...")
print(resp.output_text, resp.usage.input_tokens, resp.usage.output_tokens)

Four things that will trip you up, every one confirmed the hard way:

• Region is pinned. GPT-5.5 is us-east-1 and us-east-2 only; the region is in the endpoint host, and your token is signed for it.
• The path is /openai/v1/responses — not the /v1/responses some other tools assume.
• It’s Responses-only. Send GPT-5.5 a Chat Completions request and it’s rejected; the gpt-oss models are the mirror image (Chat Completions / Converse, not Responses).
• You need the bedrock:CallWithBearerToken IAM action — newer than bedrock:InvokeModel, and not in every managed Bedrock policy.

How it differs from the rest of Bedrock

What it costs

Per million tokens, on-demand, from AWS’s Bedrock pricing page (re-checked June 29; GPT-5.4 and GPT-5.5 are US East rates):

GPT-5.5’s $5.50/$33.00 happens to match OpenAI’s own list price, but AWS publishes no parity guarantee — treat the match as a coincidence of list prices. Cached input runs about a tenth of that. Codex still has no published Bedrock price. One caveat on the open-weight rows: AWS’s page currently surfaces the gpt-oss rates under Asia Pacific (Sydney), so treat them as indicative until a US figure is confirmed. The shape is clear enough either way: GPT-5.5 is the premium tier — its $33/1M output runs many times the open-weight models and double GPT-5.4 — while GPT-5.4 is the cost-reasonable frontier option at half of 5.5’s per-token price.

Where your data goes

This is the reason a regulated shop would route OpenAI through Bedrock instead of calling OpenAI directly. From AWS’s own terms:

• Prompts and outputs aren’t sent to OpenAI and aren’t used to train any model. OpenAI gets non-content usage metadata only (AWS Service Terms §50.12.5). Processing stays in-region.
• One asterisk: a default 30-day abuse-monitoring retention of classifier-flagged traffic — inputs and outputs, stored by AWS, not shared with OpenAI, no human review. The call even comes back with store: true by default; true zero-retention is an approval-gated request, not the default. Worth settling before PHI goes anywhere near it.
• No AWS IP indemnity for the OpenAI models, unlike the Nova/Titan family.
• Bedrock is HIPAA-eligible and BAA-covered, with no model-specific exclusion called out for these.

Bottom line

OpenAI on Bedrock is the real thing — frontier models inside your AWS boundary, under your governance, at per-token pricing. But “generally available” is a catalog status, not a switch you flip. The open-weight gpt-oss models are usable today; GPT-5.5 and GPT-5.4 are an AWS-granted, per-account, per-region entitlement, surfaced as a $0 Marketplace agreement, served on a different endpoint and API than the rest of Bedrock, region-pinned, and shipped with a data-retention default worth changing. The access conversation is the first real step — and, across both accounts I tried, an inconsistent one: a near-two-week wait and a partial grant on one, an instant AI-generated brush-off to Sales on the other. Start it early.

Sources

• AWS — Get started with OpenAI GPT-5.5, GPT-5.4, and Codex on Amazon Bedrock
• AWS — OpenAI models and Codex on Amazon Bedrock now generally available
• Amazon Bedrock model card — GPT-5.5 and GPT-5.4
• Amazon Bedrock API keys and model access
• Amazon Bedrock — abuse detection and data retention
• AWS Service Terms (§50, Amazon Bedrock)
• Amazon Bedrock pricing
• AWS — HIPAA Eligible Services Reference