GovCloud fips endpoint - email-smtp-fips/secretsmanager-fips.us-gov-east-1 are available?

Hi Ike,
Thank you for bringing up this important question about FIPS endpoints in AWS GovCloud! It’s essential to clear up the confusion, and I’m here to guide you through it with a clear and actionable explanation.

---

Clarifying the Issue

You’ve observed conflicting information about FIPS-enabled endpoints for AWS GovCloud (US-East-1). Here’s the breakdown:

Documented endpoints (from AWS compliance page):

• secretsmanager-fips.us-gov-east-1.amazonaws.com
• email-smtp-fips.us-gov-east-1.amazonaws.com

Accessible endpoints (actual endpoints in use):

• secretsmanager.us-gov-east-1.amazonaws.com
• email-smtp.us-gov-east-1.amazonaws.com

This discrepancy raises a key concern: Are the accessible endpoints FIPS-compliant, or does AWS need to update the documentation to reflect the correct configuration?

---

Key Terms

• FIPS (Federal Information Processing Standards): Standards ensuring secure communication and encryption, required for U.S. government data.
• GovCloud: AWS regions designed to meet stringent compliance needs for government workloads.
• Endpoints: Specific URLs that serve as entry points to AWS services. In the context of FIPS compliance, these endpoints ensure encrypted communication using FIPS-approved cryptographic standards.
• TLS (Transport Layer Security): A cryptographic protocol used to encrypt data in transit. FIPS compliance ensures that only approved TLS configurations are used.
• AWS Compliance Program: AWS provides various compliance frameworks, including FIPS, to help customers meet regulatory and security requirements for their workloads.

---

The Solution (Our Recipe)

Steps at a Glance:

1. Check AWS Documentation for Accuracy
2. Test Endpoint Compliance with Tools
3. Contact AWS Support for Final Confirmation

---

Step-by-Step Guide:

1. Check AWS Documentation for Accuracy
   AWS updates their compliance and endpoint documentation periodically. Compare the available endpoints with the latest AWS FIPS documentation. Ensure you’re referencing the section specifically for GovCloud (US-East-1).

---

2. Test Endpoint Compliance with Tools
   Use openssl or a similar tool to check if the endpoints negotiate FIPS-approved TLS ciphers. For example:

   openssl s_client -connect secretsmanager.us-gov-east-1.amazonaws.com:443

   Analyze the cipher suite to ensure it complies with FIPS standards.

---

3. Contact AWS Support for Final Confirmation
   If testing does not conclusively prove compliance or the discrepancy persists, create an AWS Support ticket. Ask specifically whether the accessible endpoints (secretsmanager.us-gov-east-1.amazonaws.com and email-smtp.us-gov-east-1.amazonaws.com) meet FIPS compliance standards.

---

Closing Thoughts

Ensuring your endpoints are FIPS-compliant is critical for secure operations within AWS GovCloud. While AWS documentation is a reliable resource, confirming endpoint compliance through testing or direct AWS Support engagement ensures you’re meeting regulatory standards.

---

Let me know if you need further help.

---

Cheers, Aaron 😊