Topic · aws-govcloud

AWS GovCloud

AWS GovCloud — the FedRAMP/CMMC-aligned AWS partition for US workloads.

RSS feed ↗

vendor
RDS PostgreSQL 18 adds post-quantum TLS key exchange
AWS puts hybrid ML-KEM on a customer-provisioned database (not a service endpoint) which means the defense supply chain can configure it directly rather than wait for transparent rollout.
Amazon RDS for PostgreSQL versions 18 and higher now support modifying the ssl_groups parameter to select post-quantum TLS cryptographic groups, including hybrid ML-KEM key exchange. This is the first PQ deployment on a database instance customers provision and configure themselves, as opposed to the transparent server-side rollouts AWS has done on KMS, ACM, and Secrets Manager endpoints. Defense contractors running RDS PostgreSQL 18 can align with NIST's PQC transition by updating a parameter in the console or CLI, no stack migration required.
SEP 24
vendor
AWS Elastic VMware Service clears FedRAMP Class C
The first VMware Cloud Foundation service to hit Class C on AWS removes the ATO barrier that kept federal VMware workloads pinned to on-prem data centers.
Amazon Elastic VMware Service (EVS) is now in scope for FedRAMP Class C (formerly the Moderate baseline) across all US commercial regions. It's the first VMware Cloud Foundation service on AWS to reach that authorization level. For defense contractors and civilian agencies still running aging on-premises VMware stacks, the news eliminates a critical procurement obstacle: workloads that require Class C no longer need a separate agency ATO. The authorization covers commercial US regions; EVS isn't yet listed for Class D (High) in GovCloud.
SEP 22
vendor
AWS Transform lands FedRAMP Class C in Ohio
Agentic migration and modernization now carries a moderate authorization, but only in a single commercial region, GovCloud High and multi-region coverage aren't on the table yet.
AWS Transform, the company's agentic migration and modernization service, is now in scope for FedRAMP Class C (formerly Moderate baseline) in the US East (Ohio) Region. Federal agencies and contractors can now use Transform for workloads subject to Class C compliance requirements. The authorization covers one region (Ohio only) which means multi-region moderate architectures will need to wait for additional regions to enter scope. No Class D (High) authorization for GovCloud was announced.
AUG 28
vendor
SageMaker MLflow adds customer-managed KMS keys
For FedRAMP and CMMC shops, the shift from AWS-managed to customer-managed keys means CloudTrail audit trails on MLflow data access are now independently verifiable.
AWS SageMaker MLflow now supports customer-managed KMS keys for encryption, giving customers control over key management and independent CloudTrail audit trails. Previously, MLflow used AWS-managed keys: encryption existed but key-access logging was invisible to the customer. For defense contractors and organizations operating under CMMC or FedRAMP, the shift turns a black-box encryption posture into something an assessor can independently verify. Constraints are standard KMS fare: symmetric keys only, same account and region as the MLflow app.
AUG 25
vendor
AWS Storage Gateway adds FIPS 140-3 PrivateLink endpoints
For years, the FIPS-PrivateLink gap forced regulated workloads to choose between validated encryption and private networking.
AWS Storage Gateway now supports FIPS 140-3 validated endpoints over AWS PrivateLink for Tape and Volume Gateway. Previously, FIPS endpoints were only reachable over the public internet, forcing regulated-workload operators to choose between FIPS-compliant encryption and private network architecture. The feature is available in eight regions including both GovCloud endpoints, with gateway software version 3.2.7 or later required. The fix closes a long-standing gap that competing cloud storage services addressed earlier, but for GovCloud tenants already running Storage Gateway, it removes a genuine operational constraint.
AUG 25
trade-press
DISA pegs Aug. 24 release for JWCC Unified Cloud Marketplace
The three-tier structure opens beyond the four incumbent hyperscalers, but DISA hasn't posted a ceiling value, and current JWCC spending sits overwhelmingly with one vendor.
DISA's August acquisition schedule sets an expected Aug. 24 final solicitation release for JWCC Unified Cloud Marketplace, the follow-on to the $9 billion Joint Warfighting Cloud Capability contract. The new vehicle splits into three tiers: hyperscalers (AWS, Microsoft, Google, Oracle) at Tier 1, everything-as-a-service at Tier 2, and emerging companies and small businesses at Tier 3. DISA hasn't posted an estimated ceiling value. Task-order data from Deltek shows the current JWCC is heavily lopsided: AWS holds $526.5 million in obligations against a $9 billion ceiling, followed by Microsoft at $221 million, Oracle at $76.9 million, and Google at $35.9 million.
AUG 16
vendor
Amazon Quick brings autonomous agents to FedRAMP Class D
Autonomous AI agents can now operate on CUI and ITAR data inside the GovCloud boundary, though the ATO-compliance workflow AWS advertises still needs each agency's own authorization.
Amazon Quick's agentic AI capabilities are now live in AWS GovCloud (US-West), putting autonomous agents inside the FedRAMP Class D boundary for the first time. Federal teams can build custom agents for procurement, grants management, and ATO compliance while data stays in the GovCloud region. GCC High connectors for Microsoft 365 and SharePoint are included. The service didn't appear on the FedRAMP services-in-scope roster as of August 7, and any agency deploying Quick agents for production ATO workflows will still need its own authorization under the shared responsibility model.
AUG 12
vendor
AWS Load Balancers Add RFC 9151 CNSA Policies
Defense contractors can now enforce NSA-grade TLS at the load-balancer layer, no custom termination required.
AWS Application Load Balancer and Network Load Balancer now support TLS security policies compliant with RFC 9151, the CNSA 1.0 cryptographic requirements defined by the NSA. Available in GovCloud and all commercial regions at no added cost. The policies come in two flavors: strict RFC 9151 enforcement, and interoperability policies that default to CNSA while accommodating non-CNSA clients during transition. For defense contractors running GovCloud workloads, this removes the friction of DIY TLS termination to meet NSA cipher mandates.
AUG 4
vendor
Amazon Managed Grafana clears FedRAMP High in GovCloud
The authorization solves an observability procurement problem, but GovCloud users still inherit a narrower Grafana feature set.
AWS says Amazon Managed Grafana is now FedRAMP High authorized in AWS GovCloud (US-East) and AWS GovCloud (US-West). Federal agencies, public-sector organizations, and enterprises with FedRAMP High requirements can use the service to visualize, query, and alert on operational metrics across AWS and hybrid environments. The authorization is real buying-path progress; the implementation still depends on GovCloud-specific service limits.
JUL 17
vendor
AWS adds Aurora DSQL to FedRAMP Moderate scope
Useful for federal database choices, but the authorization boundary still leaves the application’s controls where they always were: with the customer.
AWS says Amazon Aurora DSQL is now in scope for FedRAMP Moderate in US East (Ohio), US East (N. Virginia), and US West (Oregon). Federal agencies and contractors can use the serverless distributed SQL database for workloads subject to FedRAMP Moderate requirements. The procurement help is real; the compliance lift around data, architecture, and customer controls does not disappear.
JUL 17
vendor
AWS adds IAM Identity Center to FedRAMP Class C
The useful part is narrower than the announcement sounds: identity management is now in scope, not magically settled for every workload.
AWS says IAM Identity Center is now in scope for FedRAMP Class C in US East (Ohio), US East (N. Virginia), US West (N. California), and US West (Oregon). Agencies and contractors can use it for workforce access to AWS accounts and applications subject to FedRAMP Class C compliance. The practical change is tooling eligibility, not a shortcut around the rest of the FedRAMP control burden.
JUL 15
vendor
AWS Config adds 191 managed rules for Bedrock, SageMaker
The useful part is coverage breadth; the missing part is any mapping to the compliance frameworks teams actually report against.
AWS says AWS Config now supports 191 additional managed rules across services including Amazon Bedrock, Amazon SageMaker, ECS, EKS, RDS, Redshift, S3 and CloudTrail. Customers can deploy the rules individually or through conformance packs in regions where the corresponding services are available. The rules cover checks such as encryption, logging, public access, network security and data protection, which helps governance teams see drift but leaves framework mapping to the customer.
JUL 10
trade-press
CISA details AWS GovCloud key leak from contractor’s GitHub
CISA’s candor matters because the exposure traces to ordinary controls: repository permissions, credential scope and poorly defined intake channels.
CISA’s July 9 after-action post says it opened an internal response May 15 after internal Amazon Web Services GovCloud keys and other information appeared in a public repository. CISA says a contractor uploaded copies of a build and deployment repository to a personal GitHub account, after which the agency revoked access, rotated credentials and found no customer or mission data exposure. The remediation list points to the real lesson: public-repository uploads and reporting channels needed tighter controls.
JUL 10
vendor
AWS Security Hub adds Network Scanning for public exposure
The useful distinction is actual internet reachability versus configuration theory, assuming teams already live inside Security Hub.
AWS introduced Network Scanning in Security Hub to probe resources from the internet and identify public IP addresses, virtual machines, load balancers, reachable ports and detected services across AWS and Azure environments. Each reachable port generates a Security Hub finding with evidence. For security teams, the value is narrower than the announcement sounds: better confirmation of exposed services inside AWS’s existing findings workflow.
JUL 9
vendor
AWS adds AI DDQ answers to Artifact
This may cut questionnaire drudgery, but it answers for AWS’s control evidence, not the customer’s implementation choices.
AWS added Assurance Assistant to AWS Artifact, generating citation-backed answers to security and compliance questions and bulk-processing XLSX questionnaires, including CAIQ, SIG and custom DDQs. Third-party risk managers, compliance officers, security engineers and auditors get AWS-sourced responses from SOC reports, ISO certifications and C5 packages. The useful boundary is also the obvious one: AWS documentation can support AWS-side claims, not finish the customer’s compliance narrative.
JUL 2
vendor
Amazon Managed Service for Prometheus gains FedRAMP High, DoD IL-4/5
The useful change is authorization scope: teams already standardizing on Prometheus get one less compliance exception to explain.
AWS says Amazon Managed Service for Prometheus is now authorized for Federal Risk and Authorization Management Program High and Department of Defense Cloud Computing Security Requirements Guide Impact Levels 4 and 5 in AWS GovCloud (US). That matters for federal agencies, public-sector organizations and enterprises that need compliant monitoring and alerting for sensitive workloads. It does not change Prometheus itself; it changes whether procurement and authorization packages can tolerate the managed service.
JUL 1
trade-press
AWS launches Secret Cloud for Industry for classified contractor workloads
The operative limit is in the word provisional: contractors may get faster environments while governance still follows existing DCSA lanes.
Amazon Web Services announced AWS Secret Cloud for Industry, a cloud offering for cleared U.S. defense contractors, research institutions and other National Industrial Security Program organizations running contractor-owned classified workloads up to Secret. Nextgov reports ASCI holds provisional Department of Defense Impact Level 6 authorization and is designed to cut classified environment provisioning from months to days. Northrop Grumman is the first contractor to deploy workloads on it.
JUN 30
vendor
AWS says Kiro clears FedRAMP High, DoD IL 4/5
The authorization lowers a procurement barrier; it does not make AI-generated code or connected enterprise data magically compliant.
AWS says Kiro is now authorized for FedRAMP High and Department of Defense Cloud Computing Security Requirements Guide Impact Levels 4 and 5 in AWS GovCloud (US) Regions. Federal agencies, public-sector organizations and enterprises with those requirements can now consider the agentic AI development platform for sensitive workloads. The Monday work is still ordinary risk management: decide what Kiro connects to, what data it touches and who reviews the code it produces.
JUN 26
vendor
AWS says OpenAI, NVIDIA Bedrock models gained FedRAMP High, IL-4/5 approval
The authorization expands the model menu inside GovCloud, but agencies still own the application-level control story.
AWS says OpenAI GPT, OpenAI GPT OSS and NVIDIA Nemotron models on Amazon Bedrock are now FedRAMP High and Department of Defense Cloud Computing Security Requirements Guide Impact Level 4 and 5 approved in AWS GovCloud (US). The affected buyers are federal agencies, public-sector organizations and enterprises with those workload requirements. The useful change is model choice inside an approved GovCloud service boundary, not a compliance pass for the customer’s own application.
JUN 26
vendor
AWS previews GuardDuty AI investigations in 10 regions
The useful part is not the AI label; it is whether GuardDuty can show enough evidence for analysts to trust suppression or containment.
AWS launched a preview of AI-powered investigations in Amazon GuardDuty across 10 commercial AWS Regions, with access through the console, CLI, API and AWS MCP Server. The feature analyzes GuardDuty findings, account context, related activity from the prior 90 days, affected resources and threat indicators, then returns confidence-scored dispositions, MITRE ATT&CK technique classifications, evidence and recommended suppression, containment or remediation. AWS did not list AWS GovCloud (US) among the preview regions.
JUN 24
vendor
Amazon Cognito adds customer-managed KMS keys for user pools
The feature gives Cognito teams a stronger audit story while leaving the hard compliance boundary decisions untouched.
AWS added customer-managed AWS Key Management Service (KMS) keys for Amazon Cognito user pool data at rest, with AWS-owned keys still the default. Cognito Essentials and Plus customers can apply a key to new or existing user pools, manage lifecycle and permissions in KMS, and audit key use in AWS CloudTrail. For contractors using Cognito in federal workloads, the useful artifact is evidence of key control; the remaining work is the KMS policy and lifecycle model.
JUN 24
vendor
AWS maps egress controls to AI-agent exfiltration risk
AWS gives the scary agent story a boring network answer: decide where workloads can resolve, connect, and leak.
Amazon Web Services (AWS) published guidance for reducing data exfiltration by routing internet-bound traffic from spoke virtual private clouds (VPCs) through AWS Transit Gateway, AWS Network Firewall, VPC endpoints and endpoint policies, and Route 53 Resolver DNS Firewall. It is aimed at teams running multi-account AWS workloads, including AI agents with tool, API, or code-interpreter access. The useful warning is operational: outbound access left open for dependencies is still outbound access left open for attackers.
JUN 22
vendor
AWS lets EKS route control plane egress through customer VPCs
The useful compliance move is architectural control, not a new authorization badge AWS can hand to an assessor.
AWS added customer-routed control plane egress for Amazon Elastic Kubernetes Service, letting outbound Kubernetes API server traffic run through a customer Amazon VPC. The feature covers admission webhook callbacks, OpenID Connect provider lookups, and aggregate API server requests. Platform teams can set `controlPlaneEgressMode` to `CUSTOMER_ROUTED` and use the `eks:controlPlaneEgressMode` IAM condition key in AWS Organizations Service Control Policies. AWS says it is available at no extra charge in every AWS Region where EKS is available.
JUN 19
vendor
AWS ships Spring 2026 SOC reports in OSCAL
Machine-readable assurance only helps if customers can trust the mapping, not just admire the JSON package in Artifact.
AWS released its Spring 2026 System and Organization Controls 1 and 2 reports in Open Security Controls Assessment Language format through AWS Artifact, alongside the PDF reports. The package covers 188 services for April 1, 2025 through March 31, 2026. AWS says it is the first major cloud provider to offer key compliance reports to customers in NIST’s machine-readable OSCAL format, a useful claim for automation teams but still vendor-stated.
JUN 18
vendor
AWS expands Bedrock automated reasoning checks to Sydney
The useful part is mathematical checking against stated rules; the hard part remains writing rules regulators and auditors will accept.
AWS made Automated Reasoning checks in Amazon Bedrock Guardrails available in the Asia Pacific (Sydney) Region, adding to three U.S. and three European regions. AWS says the feature uses formal verification to validate large language model outputs, detect hallucinations and policy compliance problems, and deliver up to 99% accuracy in detecting correct responses. Regulated finance, healthcare and legal teams get another regional deployment option, but the assurance still depends on the business rules they encode.
JUN 18
trade-press
OpenAI plans early-July IL5 ChatGPT launch on GenAI.mil
At more than 3 million potential users, model access becomes a budget, workflow, and controlled unclassified information governance problem.
NextGov reports that OpenAI strategic delivery lead Mohammed Husain said ChatGPT is expected to go live on GenAI.mil in early July, certified for controlled unclassified information (CUI) and Department of Defense Impact Level 5 (IL5). The rollout would reach more than 3 million defense civilian and military personnel. The constraint Husain named was token economics: cost per completed task is becoming part of the control plan.
JUN 16
vendor
AWS Management Console Private Access drops internet requirement for supported consoles
The useful part is narrower than the marketing line: endpoint-only administration still depends on which service consoles AWS supports.
AWS now lets customers reach supported AWS Management Console pages from virtual private clouds without internet connectivity, routing console traffic through AWS PrivateLink VPC endpoints. Government, defense, healthcare and financial-services users with isolated networks get a cleaner path for console administration. The limit is in the word “supported”: teams still have to check service-console coverage before treating this as an air-gap design answer.
JUN 16
trade-press
DHS awards AWS $2.6B Cumulus cloud contract
Centralized buying may cut waste, but DHS redacted the baseline spend needed to judge the bargain.
FedScoop reports, citing contract documents, that the Department of Homeland Security awarded Amazon Web Services a nearly $2.6 billion single-award indefinite delivery, indefinite quantity contract under Cumulus. The agencywide vehicle shifts DHS components from component-by-component cloud buying to department-level cloud service provider contracts, with Oracle Cloud Infrastructure, Google Cloud and Microsoft Azure expected next quarter. DHS expects at least $142 million in first-year savings, but redacted current cloud spend, making the discount math hard to audit.
JUN 15