{
	"requirement": "CMU-CSO-CMD",
	"provider": "CLEATUS, Inc.",
	"offering": "CLEATUS GovCloud",
	"asOf": "2026-10-22",
	"purpose": "This inventory names the cryptographic module that each service in the CLEATUS GovCloud boundary uses to protect federal customer data. It states the validation status of each module. Each row states whether its module is validated under the NIST Cryptographic Module Validation Program (CMVP). Other rows state an update stream of a validated module, a module that AWS does not publish, or a module that is not validated.",
	"scope": "The production boundary in AWS GovCloud (US), in the us-gov-west-1 Region and the us-gov-east-1 disaster recovery Region. Services that use the same module are listed together where the module and the configuration are the same.",
	"validationStatusValues": {
		"validated": "CLEATUS cites an Active CMVP certificate for the module, and the deployed configuration selects the approved mode.",
		"updateStream": "AWS states that the service uses a named module that AWS keeps under FIPS 140 validation through an update stream. AWS does not state which validated build runs. CLEATUS names the module and cites the Active certificate of its latest validated release where one exists.",
		"awsNotPublished": "AWS publishes no module name, or no CMVP certificate, for this cryptographic function. CLEATUS cannot cite a certificate from public sources and makes no validation claim for the function. The row names what is validated, such as the KMS HSM that protects the keys.",
		"notValidated": "The module has no CMVP certificate, or the deployed configuration does not select the approved mode. CLEATUS lists the item so that the gap is visible."
	},
	"validatedModules": [
		{
			"cmvpCertificate": "4884",
			"module": "AWS Key Management Service HSM",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "3",
			"cmvpStatus": "Active",
			"sunsetDate": "2029-11-17",
			"recordRetrieved": "2026-09-26",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4884",
			"approvedMode": "AWS states that the KMS HSMs operate only in the FIPS-approved mode."
		},
		{
			"cmvpCertificate": "4816",
			"module": "AWS-LC Cryptographic Module (static)",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2029-09-30",
			"recordRetrieved": "2026-09-27",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4816",
			"approvedMode": "The load balancer listeners use the AWS FIPS TLS policy ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04."
		},
		{
			"cmvpCertificate": "5314",
			"module": "AWS-LC 3 Cryptographic Module (static)",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-06-04",
			"recordRetrieved": "2026-09-27",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5314",
			"approvedMode": "AWS states that Amazon S3 server-side encryption in every mode and AWS Client VPN use AWS-LC (static)."
		},
		{
			"cmvpCertificate": "4985",
			"module": "OpenSSL FIPS Provider",
			"version": "3.1.2",
			"vendor": "The OpenSSL Project",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2030-03-10",
			"recordRetrieved": "2026-09-27",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/4985",
			"approvedMode": "Each application image builds the provider from the OpenSSL 3.1.2 source with a pinned SHA-256 digest and runs fipsinstall. The OpenSSL configuration sets default_properties to fips=yes. Node.js starts with --force-fips and stops if the provider does not load or fails its self-tests."
		},
		{
			"cmvpCertificate": "5247",
			"module": "Go Cryptographic Module",
			"version": "v1.0.0",
			"vendor": "Geomys LLC",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-04-26",
			"recordRetrieved": "2026-09-27",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5247",
			"approvedMode": "The TLS sidecars build with GOFIPS140=v1.0.0 and run with GODEBUG=fips140=on. Each process stops at start when the FIPS 140 mode is not enabled. The minimum TLS version is 1.2."
		},
		{
			"cmvpCertificate": "5298",
			"module": "AWS-LC 3 Cryptographic Module (dynamic)",
			"version": "AWS-LC FIPS 3.1.0",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-06-02",
			"recordRetrieved": "2026-10-09",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5298",
			"approvedMode": "AWS states that every AWS FIPS endpoint uses the latest release of AWS-LC (dynamic). AWS-LC 3 is the latest major release with an Active certificate."
		},
		{
			"cmvpCertificate": "5310",
			"module": "AWS Nitro Card Security Engine SSMAE",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-06-03",
			"recordRetrieved": "2026-10-09",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5310",
			"approvedMode": "AWS states that Nitro instances encrypt EBS volumes and instance store volumes with this engine, except Nitro v6 instances. The CLEATUS EC2 and SageMaker instance types (t3a, m6g, m7g, and c6i families) are not Nitro v6 instance types."
		},
		{
			"cmvpCertificate": "5369",
			"module": "Amazon Linux 2023 Kernel Cryptographic API",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2029-09-22",
			"recordRetrieved": "2026-10-09",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5369",
			"approvedMode": "Validated on kernel 6.1. AWS states that kernel 6.1 is the only Amazon Linux 2023 kernel with a validated module. AWS also states that the 6.1 module keeps its validation through security updates. The module operates in the approved mode when the host boots in FIPS mode."
		},
		{
			"cmvpCertificate": "5021",
			"module": "Amazon Linux 2023 OpenSSL FIPS Provider",
			"version": "3.0.8",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2030-05-25",
			"recordRetrieved": "2026-10-18",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5021",
			"approvedMode": "Amazon Linux 2023 ships the validated provider in the openssl-fips-provider-certified package. The provider operates in the approved mode when the host boots in FIPS mode. The SonarQube host runs it on Graviton3, an environment that the certificate lists."
		},
		{
			"cmvpCertificate": "5146",
			"module": "AWS-LC Cryptographic Module (dynamic)",
			"version": "AWS-LC FIPS 1.29.1",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-01-25",
			"recordRetrieved": "2026-10-09",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5146",
			"approvedMode": "The AWS Link Encryption Module and AWS Scalable Network Crypto Modules certificates require operation with this module."
		},
		{
			"cmvpCertificate": "5256",
			"module": "AWS Link Encryption Module",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-05-04",
			"recordRetrieved": "2026-10-09",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5256",
			"approvedMode": "AWS states that it encrypts all data on the AWS global network between facilities and Regions. AWS uses AES-256 MACsec before the data leaves the facility. The certificate requires operation with AWS-LC (dynamic) certificate 5146, listed here."
		},
		{
			"cmvpCertificate": "5332",
			"module": "AWS Scalable Network Crypto Modules",
			"version": "1.1",
			"vendor": "Amazon Web Services",
			"standard": "FIPS 140-3",
			"overallLevel": "1",
			"cmvpStatus": "Active",
			"sunsetDate": "2031-06-15",
			"recordRetrieved": "2026-10-09",
			"record": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/5332",
			"approvedMode": "Used with the AWS Link Encryption Module for the same AWS global network encryption. The certificate requires operation with AWS-LC (dynamic) certificate 5146, listed here."
		}
	],
	"services": [
		{
			"service": "Public Application Load Balancers (production and disaster recovery)",
			"cryptographicUse": "TLS 1.2 and TLS 1.3 termination for every customer connection. Port 80 answers only with a 301 redirect to HTTPS and forwards no request to the application. HTTP Strict Transport Security (HSTS) keeps browsers on HTTPS.",
			"module": "AWS-LC Cryptographic Module (static)",
			"cmvpCertificate": "4816",
			"validationStatus": "validated",
			"dataProtected": "All federal customer data in transit between the customer and the application, including credentials and session tokens."
		},
		{
			"service": "Internal Application Load Balancer for the security information and event management (SIEM) dashboard",
			"cryptographicUse": "TLS 1.2 and TLS 1.3 termination under the same FIPS TLS policy.",
			"module": "AWS-LC Cryptographic Module (static)",
			"cmvpCertificate": "4816",
			"validationStatus": "validated",
			"dataProtected": "Audit records and security findings that administrators read."
		},
		{
			"service": "TLS sidecar in each application task (load balancer to task)",
			"cryptographicUse": "TLS termination inside each Amazon ECS task for traffic from the load balancer.",
			"module": "Go Cryptographic Module",
			"version": "v1.0.0",
			"cmvpCertificate": "5247",
			"validationStatus": "validated",
			"dataProtected": "All federal customer data in transit inside the virtual private cloud (VPC)."
		},
		{
			"service": "Application containers in Amazon ECS (web, API, and agent services)",
			"cryptographicUse": "Every cryptographic operation in the Node.js runtime. This includes the TLS client for Aurora, Valkey, and AWS service calls. It also includes password hashing with PBKDF2, token signing and verification, and WebAuthn verification. In GovCloud, no security function runs outside node:crypto. The next row records the legacy password check that GovCloud does not run. An MD5 checksum builds cache keys and has no security function.",
			"module": "OpenSSL FIPS Provider",
			"version": "3.1.2",
			"cmvpCertificate": "4985",
			"validationStatus": "validated",
			"dataProtected": "All federal customer data that the application processes, and customer passwords and authentication tokens."
		},
		{
			"service": "Legacy password hash verification in the application",
			"cryptographicUse": "None in GovCloud. The GovCloud application verifies only PBKDF2 password hashes, under the OpenSSL FIPS Provider in the application row. It does not verify the scrypt and bcrypt hashes that were stored before the move to PBKDF2. A legacy hash fails like a wrong password, and the user resets the password. The reset writes a PBKDF2 hash.",
			"module": "OpenSSL FIPS Provider 3.1.2 for the PBKDF2 check, the only password check that runs. The legacy verifiers, pure JavaScript scrypt (@noble/hashes) and bcrypt (bcryptjs), are not CMVP modules, and the GovCloud application does not load them. In packages/auth/src/password.ts, CLEATUS_MODE=govcloud returns before the legacy module loads. On 2026-10-22, CLEATUS confirmed that every production web and API service runs a task definition with CLEATUS_MODE=govcloud and an image from release v2026.10.22-fips-release (image tag govcloud-b5531964584a): cleatus-web:71 and cleatus-api:69 in us-gov-west-1, and cleatus-web-dr:61 and cleatus-api-dr:60 in us-gov-east-1. EVD-CRYPTO-MODULES collects this state on each run, in results.application_services.",
			"cmvpCertificate": "4985",
			"validationStatus": "validated",
			"dataProtected": "Passwords of users whose stored hash is still in a legacy format. The legacy hashes stay stored until the user resets the password, but no GovCloud code verifies them. These users cannot sign in until they reset the password, and the reset stores a PBKDF2 hash."
		},
		{
			"service": "Writer sandbox tasks in Amazon ECS (in-task agent server)",
			"cryptographicUse": "HTTPS server inside each writer sandbox task for traffic from the web tasks. The server uses a private certificate authority.",
			"module": "OpenSSL FIPS Provider 3.1.2. The deployed image (cleatus-writer-sandbox, release v2026.10.22-fips-release, task definition cleatus-prod-writer-sandbox:63) builds the provider and sets NODE_OPTIONS=--force-fips, so Node.js stops at start unless the provider loads and passes its self-tests. On 2026-10-22, a task on that definition started the agent server, which logged that it was listening over HTTPS, on X86_64 with Fargate FIPS-140 mode on.",
			"cmvpCertificate": "4985",
			"validationStatus": "validated",
			"dataProtected": "Proposal working files and commands in transit inside the VPC. These can include federal customer data."
		},
		{
			"service": "Database tools and evidence collection tasks in Amazon ECS (database bootstrap, public data load and export, account port, customer sync load, and evidence fetchers)",
			"cryptographicUse": "TLS client connections to Aurora and to AWS service endpoints, and database password authentication.",
			"module": "The OpenSSL library bundled with Node.js and the Debian OpenSSL library used by Python and the AWS CLI, without a FIPS provider selected. The migration tool pgroll uses the Go standard library cryptography without the Go FIPS 140 mode. Fargate FIPS-140 mode puts the task kernel in FIPS mode but does not change these user-space libraries. CLEATUS tracks loading the OpenSSL FIPS Provider in these images, as in the application images.",
			"cmvpCertificate": null,
			"validationStatus": "notValidated",
			"dataProtected": "Database credentials, public data, and customer account data that the loaders move. The account port and customer sync loads can include federal customer data."
		},
		{
			"service": "Amazon ECS on AWS Fargate task ephemeral storage (application and writer sandbox tasks)",
			"cryptographicUse": "Encryption of each task's ephemeral storage under the customer managed KMS key of the cluster. Fargate FIPS-140 mode is on in both production Regions, and every task runs on X86_64, so each task kernel boots in FIPS mode.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not name the module that encrypts Fargate ephemeral storage, including in Fargate FIPS-140 mode.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Temporary task files, including proposal working files in the writer sandbox. These files can include federal customer data."
		},
		{
			"service": "AWS Key Management Service (KMS)",
			"cryptographicUse": "Generation, storage, and use of the customer managed keys and AWS managed keys that protect data at rest. KMS keys wrap the data keys that the storage services in this list use.",
			"module": "AWS Key Management Service HSM",
			"cmvpCertificate": "4884",
			"validationStatus": "validated",
			"dataProtected": "The encryption keys for all federal customer data at rest."
		},
		{
			"service": "Amazon Aurora PostgreSQL storage, snapshots, and backups",
			"cryptographicUse": "Storage encryption under a customer managed KMS key.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that performs Aurora storage encryption. The AWS FIPS compliance page names the at-rest modules for Amazon S3, DynamoDB, Amazon EBS, and EC2 instance storage only.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "The primary database of federal customer data."
		},
		{
			"service": "Amazon Aurora PostgreSQL transport",
			"cryptographicUse": "Forced TLS. TLS 1.2 is both the minimum and the maximum version. The cipher list contains only ECDHE-RSA suites with AES-GCM.",
			"module": "Client side: OpenSSL FIPS Provider 3.1.2. Server side: AWS-LC. The Aurora PostgreSQL release notes state that version 17.4 and later enable support for FIPS-validated cryptography from AWS-LC. The production cluster runs a later 17.x version. AWS does not name the AWS-LC certificate or build that the engine uses.",
			"cmvpCertificate": "4985 (client side). Server side: AWS-LC, certificate not named by AWS.",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Federal customer data in transit between the application and the database."
		},
		{
			"service": "Amazon ElastiCache for Valkey",
			"cryptographicUse": "At-rest encryption under a customer managed KMS key. In-transit encryption is required, with an authentication token.",
			"module": "At rest: AWS Key Management Service HSM for key protection. In transit: OpenSSL FIPS Provider 3.1.2 on the client side. AWS publishes no module for the ElastiCache at-rest encryption or for the server side of the in-transit TLS. The ElastiCache FIPS endpoints cover only the management API, not the cache connections.",
			"cmvpCertificate": "4884 (key protection), 4985 (client side)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Session state and cached application data, which can include federal customer data."
		},
		{
			"service": "Amazon S3 buckets with SSE-KMS (application documents, backups, model artifacts, audit logs, and security findings)",
			"cryptographicUse": "Server-side encryption with customer managed KMS keys. Some buckets also use S3 Bucket Keys.",
			"module": "AWS-LC 3 Cryptographic Module (static) for object encryption. AWS Key Management Service HSM for key protection. AWS states that S3 uses the latest FIPS-tested release of AWS-LC (static) and does not name the release. AWS-LC 3 (static) is the latest release with an Active certificate.",
			"cmvpCertificate": "5314, 4884",
			"validationStatus": "updateStream",
			"dataProtected": "Federal customer documents and uploads, database backups, embedding model artifacts, CloudTrail logs, and security findings."
		},
		{
			"service": "Amazon S3 buckets with SSE-S3 (container image layers in Amazon ECR, load balancer access logs, and S3 server access logs)",
			"cryptographicUse": "Server-side encryption with AES-256 and AWS managed keys.",
			"module": "AWS-LC 3 Cryptographic Module (static). AWS states that S3 uses the latest FIPS-tested release of AWS-LC (static) and does not name the release. AWS-LC 3 (static) is the latest release with an Active certificate.",
			"cmvpCertificate": "5314",
			"validationStatus": "updateStream",
			"dataProtected": "Application container images and access logs. These stores hold no federal customer data."
		},
		{
			"service": "AWS Backup vaults (production and disaster recovery Regions)",
			"cryptographicUse": "Each vault encrypts recovery points under its own customer managed KMS key. Copies go to the vault in the disaster recovery Region.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that encrypts recovery points in a backup vault.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Backups of the database and other stores that hold federal customer data."
		},
		{
			"service": "Cross-Region replication to the disaster recovery Region (Aurora Global Database and S3 replication)",
			"cryptographicUse": "AWS replicates the database and the replicated buckets to the disaster recovery Region. The destination encrypts each copy under its own customer managed KMS key.",
			"module": "AWS Link Encryption Module and AWS Scalable Network Crypto Modules for the traffic between Regions. AWS states that all data on the AWS global network is encrypted with AES-256 MACsec before it leaves AWS facilities. AWS also states that some of these edge devices use FIPS modules from other vendors, which AWS does not name. Both certificates require operation with AWS-LC (dynamic) certificate 5146. At the destination, the KMS HSM protects the keys and the S3 row covers the replicated objects.",
			"cmvpCertificate": "5256, 5332, and 5146 (network encryption, AWS modules only), 4884 (key protection at the destination)",
			"validationStatus": "updateStream",
			"dataProtected": "Federal customer data in transit between AWS Regions."
		},
		{
			"service": "AWS Lambda functions that CLEATUS manages in Terraform (cron relay, public data ingest, customer sync, sandbox reapers, secret rotation, redeploy, and age monitoring, alert and security forwarders, idle account and VPN session controls, the database audit bootstrap, and the SonarQube functions)",
			"cryptographicUse": "TLS client calls to AWS APIs, to the application, and to the alert webhook. Hashes that the functions compute. Lambda encrypts the environment variables of each function with KMS.",
			"module": "Client side: Amazon Linux 2023 OpenSSL FIPS Provider 3.0.8, from a Lambda layer that every function loads. The layer configuration activates only the FIPS and base providers and sets default_properties to fips=yes. A provider that does not load stops the function: Python has no TLS ciphers, and Node.js runs with --force-fips. Service side: each function sets AWS_USE_FIPS_ENDPOINT, so the SDK calls the FIPS endpoint of each service, which uses AWS-LC (dynamic). KMS protects the environment variable keys.",
			"cmvpCertificate": "5021 (client side), 5298 (service side, the latest validated release of AWS-LC (dynamic)), 4884 (environment variable key protection)",
			"validationStatus": "updateStream",
			"dataProtected": "Cron triggers, public data, operational alerts, credentials during secret rotation, and database audit configuration. These functions do not store federal customer data."
		},
		{
			"service": "AWS Lambda functions that CLEATUS does not manage in Terraform (AWS hosted Secrets Manager rotation functions for the database and SonarQube credentials, and seven compliance automation functions that the managed service provider created)",
			"cryptographicUse": "TLS client calls to AWS APIs and to the database during credential rotation. Report generation and alert delivery for compliance automation.",
			"module": "The OpenSSL library in the AWS managed Lambda runtimes, without a FIPS provider selected. The AWS hosted rotation template offers no layer or environment setting. CLEATUS tracks moving these functions onto the FIPS provider layer.",
			"cmvpCertificate": null,
			"validationStatus": "notValidated",
			"dataProtected": "Database and SonarQube credentials in transit during rotation, and compliance reports. These functions do not store federal customer data."
		},
		{
			"service": "Amazon SNS alert topics",
			"cryptographicUse": "Encryption at rest under KMS keys.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that encrypts SNS messages at rest.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Security alerts. These hold no federal customer data."
		},
		{
			"service": "Amazon SQS queues (SIEM findings queue and its dead-letter queue)",
			"cryptographicUse": "Encryption at rest with SSE-SQS, the server-side encryption that SQS manages. The policy of the findings queue denies requests that do not use TLS. The dead-letter queue has no queue policy, and only principals in the CLEATUS account can reach it.",
			"module": "AWS does not publish the module that performs SSE-SQS. SSE-SQS uses keys that SQS owns, not KMS keys.",
			"cmvpCertificate": null,
			"validationStatus": "awsNotPublished",
			"dataProtected": "Notifications of new security findings objects in the SIEM findings bucket. These hold no federal customer data."
		},
		{
			"service": "AWS Systems Manager Parameter Store parameters",
			"cryptographicUse": "None. Every parameter is the String or StringList type. Parameter Store does not encrypt these types under a KMS key. No parameter is the SecureString type, and CLEATUS keeps secrets in Secrets Manager.",
			"module": "None. AWS publishes no module for the storage of String and StringList parameters. The parameters hold Client VPN idle-session counters, the CloudWatch agent configuration for the SIEM host, the IDs of the current hardened images, and an Amazon Inspector setting.",
			"cmvpCertificate": null,
			"validationStatus": "notValidated",
			"dataProtected": "Operational configuration and counters. These hold no federal customer data, no secrets, and no credentials."
		},
		{
			"service": "AWS CodeBuild projects (Terraform plan and apply, SonarQube analysis, and dynamic application security testing)",
			"cryptographicUse": "Encryption of build data at rest under KMS keys. The SonarQube project uses a customer managed KMS key. The other projects use the AWS managed key aws/s3. No project writes build artifacts. This row covers data at rest only.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that encrypts CodeBuild data at rest.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Build logs and caches for infrastructure deployment, code analysis, and security testing. These builds do not process federal customer data."
		},
		{
			"service": "AWS CloudTrail",
			"cryptographicUse": "One multi-Region trail writes its log files to an S3 bucket under a customer managed KMS key. Log file validation signs a digest file for each hour of log files.",
			"module": "Log files: the S3 SSE-KMS row, AWS-LC 3 Cryptographic Module (static) for object encryption and the AWS Key Management Service HSM for key protection. Digest signing: AWS does not publish the module that signs the digest files.",
			"cmvpCertificate": "5314, 4884 (log file encryption)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Audit records of management API calls and of object access in the customer data buckets."
		},
		{
			"service": "Amazon Data Firehose (SIEM findings delivery stream)",
			"cryptographicUse": "Server-side encryption of buffered records with an AWS owned KMS key. The stream delivers to the SIEM findings bucket in Amazon S3.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that encrypts the Firehose buffer. At the destination, the S3 SSE-KMS row covers the delivered objects.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Security findings on the way to the SIEM. These hold no federal customer data."
		},
		{
			"service": "Amazon ECS Exec sessions (web, API, and FORGE services, and the web and API services in the disaster recovery Region)",
			"cryptographicUse": "Administrator shell sessions into running tasks through AWS Systems Manager Session Manager. The session channel uses TLS. The cluster adds a second encryption layer for session data with a customer managed KMS key. Session output goes to a CloudWatch log group under the same key.",
			"module": "Session data key: AWS Key Management Service HSM. Session channel: the Session Manager agent in the task and the Systems Manager message service. AWS publishes no module for either end of the channel. Session logs: the CloudWatch Logs row.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Administrator commands and their output inside the application tasks. These can include federal customer data."
		},
		{
			"service": "VPC flow logs",
			"cryptographicUse": "Flow logs go to an Amazon S3 bucket with SSE-KMS. The bucket uses a customer managed KMS key and an S3 Bucket Key.",
			"module": "AWS-LC 3 Cryptographic Module (static) for object encryption. AWS Key Management Service HSM for key protection. AWS states that S3 uses the latest FIPS-tested release of AWS-LC (static) and does not name the release. AWS-LC 3 (static) is the latest release with an Active certificate.",
			"cmvpCertificate": "5314, 4884",
			"validationStatus": "updateStream",
			"dataProtected": "Network flow records. These hold no federal customer data."
		},
		{
			"service": "AWS Secrets Manager",
			"cryptographicUse": "Encryption of each secret under a KMS key.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that encrypts secret values in Secrets Manager.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Database credentials, API keys, and other application secrets."
		},
		{
			"service": "Amazon CloudWatch Logs",
			"cryptographicUse": "Log group encryption under customer managed KMS keys.",
			"module": "AWS Key Management Service HSM for key protection. AWS does not publish the module that encrypts log data in CloudWatch Logs.",
			"cmvpCertificate": "4884 (key protection)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Application logs, audit logs, database audit logs, VPN connection logs, and Amazon Bedrock invocation logs. Invocation logs can contain federal customer data."
		},
		{
			"service": "Amazon Bedrock",
			"cryptographicUse": "Model invocation over TLS to the regional FIPS endpoint, bedrock-runtime-fips.",
			"module": "Client side: OpenSSL FIPS Provider 3.1.2. Service side: AWS-LC (dynamic), which AWS states that every FIPS endpoint uses in its latest release.",
			"cmvpCertificate": "4985 (client side), 5298 (service side, the latest validated release of AWS-LC (dynamic))",
			"validationStatus": "updateStream",
			"dataProtected": "Prompts and responses that contain federal customer data and solicitation content."
		},
		{
			"service": "Amazon Textract and Amazon SES",
			"cryptographicUse": "API calls over TLS to the regional FIPS endpoints. The SES client sets useFipsEndpoint in every Region (packages/email/src/ses-client.ts). The Textract client sets it in every us-gov- Region (packages/models/src/document/convert-with-textract.ts). CloudTrail records the host that each caller asks for. On 2026-10-18, the 50 most recent Textract calls from the application task roles (the newest on 2026-10-15) all reached textract-fips.us-gov-west-1.amazonaws.com over TLS 1.3. CloudTrail records no SES SendEmail event, so for SES the evidence is the client code and the SES_REGION of each running task. EVD-CRYPTO-MODULES collects both on each run, in results.fips_endpoint_calls and results.application_services.",
			"module": "Client side: OpenSSL FIPS Provider 3.1.2. Service side: AWS-LC (dynamic), which AWS states that every FIPS endpoint uses in its latest release.",
			"cmvpCertificate": "4985 (client side), 5298 (service side, the latest validated release of AWS-LC (dynamic))",
			"validationStatus": "updateStream",
			"dataProtected": "Customer documents sent for text extraction, and outbound email content."
		},
		{
			"service": "Amazon SageMaker embedding endpoints",
			"cryptographicUse": "Inference calls over TLS through an interface VPC endpoint. AWS lists the standard SageMaker Runtime host in AWS GovCloud (US) as a FIPS endpoint. Model artifacts are stored in S3 with SSE-KMS. The instance storage uses the default AWS encryption, without a customer managed key.",
			"module": "Client side: OpenSSL FIPS Provider 3.1.2. Service side: AWS-LC (dynamic) at the FIPS endpoint. Model artifacts: the S3 SSE-KMS row. Instance storage: AWS Nitro Card Security Engine SSMAE, per AWS.",
			"cmvpCertificate": "4985 (client side), 5298 (service side), 5314 and 4884 (model artifacts), 5310 (instance storage)",
			"validationStatus": "updateStream",
			"dataProtected": "Search text that the application sends for embedding, which can include federal customer data."
		},
		{
			"service": "Other AWS API calls from the application (KMS, Secrets Manager, CloudWatch, Amazon ECR, Amazon ECS, and Amazon S3)",
			"cryptographicUse": "TLS to AWS service endpoints through interface and gateway VPC endpoints. Each request is signed with AWS Signature Version 4.",
			"module": "Client side: OpenSSL FIPS Provider 3.1.2 for the application's own calls. The Fargate agent makes the image pulls, secret reads, and log delivery for each task. Fargate FIPS-140 mode is on, so the agent pulls images and reads secrets through the FIPS endpoints of Amazon ECR and Secrets Manager, which each VPC reaches through interface endpoints. CloudWatch Logs has no separate FIPS endpoint in AWS GovCloud (US), so log delivery uses the standard Logs interface endpoint. AWS names no module for the agent's client side. Service side: AWS-LC (dynamic) at each FIPS endpoint. Amazon ECS calls select the ECS FIPS endpoint, and the application S3 clients select the S3 FIPS endpoint through the S3 gateway endpoint.",
			"cmvpCertificate": "4985 (application client side), 5298 (service side, the latest validated release of AWS-LC (dynamic))",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Encryption key requests, secrets, logs, container images, and stored objects in transit."
		},
		{
			"service": "AWS Client VPN for administrators",
			"cryptographicUse": "TLS 1.2 and TLS 1.3 control channel and an AES-256-GCM data channel, over OpenVPN on UDP port 443. The server certificate is an ACM certificate with an RSA-2048 key and a SHA-256 RSA signature, valid until 2027-04-11. Users sign in through SAML federation. Sessions end after 8 hours. Connection logs go to a CloudWatch log group under a customer managed KMS key. The API returns no TLS version or cipher setting: AWS fixes them for the service. EVD-CRYPTO-MODULES collects these settings on each run, in results.client_vpn.",
			"module": "AWS-LC (static) for the server-side encryption, per AWS. AWS does not state which AWS-LC (static) release Client VPN uses. AWS-LC 3 (static) is the latest release with an Active certificate.",
			"cmvpCertificate": "5314 (latest validated AWS-LC static release)",
			"validationStatus": "updateStream",
			"dataProtected": "Administrator sessions into the production VPC."
		},
		{
			"service": "AWS IAM Identity Center workforce sign-in",
			"cryptographicUse": "Console and command line sign-in through the IAM Identity Center AWS access portal, with multifactor authentication. The command line obtains tokens from the IAM Identity Center OIDC service.",
			"module": "AWS lists FIPS endpoints in AWS GovCloud (US) for the IAM Identity Center API and its OIDC service. Those endpoints use AWS-LC (dynamic). The AWS access portal and portal sign-in hosts are not on the AWS FIPS endpoint list. AWS names no module for them.",
			"cmvpCertificate": "5298 (OIDC and API endpoints only)",
			"validationStatus": "awsNotPublished",
			"dataProtected": "Workforce credentials and session tokens for administrative access."
		},
		{
			"service": "SIEM server host",
			"cryptographicUse": "Encrypted Amazon EBS volume under a KMS key. Agent-to-server channel encryption in the SIEM software. Host operating system cryptography.",
			"module": "Volume keys: AWS Key Management Service HSM. Volume encryption: AWS Nitro Card Security Engine SSMAE, per AWS. SIEM agent channel: AES in the SIEM software. The SIEM vendor publishes no CMVP certificate and no FIPS mode for this channel. Host operating system: an Amazon Linux 2023 kernel line other than 6.1. AWS states that only kernel 6.1 has a validated module.",
			"cmvpCertificate": "5310 (volume encryption), 4884 (key protection)",
			"validationStatus": "notValidated",
			"dataProtected": "Audit records and security findings for the boundary."
		},
		{
			"service": "SonarQube code analysis host",
			"cryptographicUse": "TLS for SonarQube ingress and for the connection to its database, in a sidecar. Encrypted Amazon EBS root volume. The host kernel and system crypto policy boot in FIPS mode.",
			"module": "TLS: Go Cryptographic Module v1.0.0. Volume keys: AWS Key Management Service HSM. Volume encryption: AWS Nitro Card Security Engine SSMAE, per AWS. Host kernel: Amazon Linux 2023 kernel 6.1 in FIPS mode, on the validated 6.1 update stream. Host user-space OpenSSL: Amazon Linux 2023 OpenSSL FIPS Provider 3.0.8. On 2026-10-18, the Systems Manager inventory of the host (i-0356ccfb40588d967, m7g.xlarge, Graviton3, launched 2026-10-11) listed openssl-fips-provider-certified and openssl-fips-provider-certified-so 3.0.8-1.amzn2023.0.1 and kernel 6.1.188. The launch template user data installs that exact package, fails the setup if the install fails, enables FIPS mode when the kernel does not report it, and reboots before SonarQube serves traffic. The host image is the STIG-hardened Amazon Linux 2023 image, which boots in FIPS mode. The SIEM agent on this host belongs to the SIEM row.",
			"cmvpCertificate": "5247 (TLS), 5310 (volume encryption), 4884 (key protection), 5369 (kernel), 5021 (user-space OpenSSL)",
			"validationStatus": "validated",
			"dataProtected": "Source code analysis results. This host holds no federal customer data."
		},
		{
			"service": "SonarQube account reconciliation (Google Workspace directory read)",
			"cryptographicUse": "RSA signature of the domain-wide delegation token that authenticates the read-only directory query.",
			"module": "An RSA signature computed in pure Python in the reconciliation function, outside any cryptographic module. The TLS connection itself uses the Lambda FIPS provider layer. CLEATUS tracks moving the signature into AWS KMS, which can hold an imported RSA key.",
			"cmvpCertificate": null,
			"validationStatus": "notValidated",
			"dataProtected": "The service account credential for a read-only directory query. No federal customer data."
		}
	],
	"awsNotPublished": [
		"Bulk encryption at rest in Aurora storage, ElastiCache, AWS Backup vaults, Secrets Manager, CloudWatch Logs, Amazon SNS, Amazon Data Firehose, and AWS CodeBuild. AWS names the KMS HSM (certificate 4884) for key protection in each, but publishes no module for the bulk encryption.",
		"The AWS-LC certificate and build in the Aurora PostgreSQL engine. AWS names AWS-LC for the server side of the database TLS but not the certificate.",
		"The server side of the ElastiCache in-transit TLS.",
		"The AWS access portal and portal sign-in hosts for IAM Identity Center. They are not on the AWS FIPS endpoint list.",
		"SSE-SQS encryption in Amazon SQS, which uses keys that SQS owns rather than KMS keys.",
		"The CloudTrail digest signing for log file validation.",
		"Both ends of the ECS Exec session channel: the Session Manager agent in the task and the Systems Manager message service."
	],
	"notValidated": [
		"The SIEM agent-to-server channel uses AES in the SIEM software, which has no CMVP certificate. The SIEM host runs a kernel line that has no validated Amazon Linux 2023 module.",
		"AWS Systems Manager Parameter Store holds String and StringList parameters, which are not encrypted under a KMS key. They hold no federal customer data and no secrets.",
		"The AWS hosted Secrets Manager rotation functions and seven compliance automation functions that the managed service provider created use the managed runtime OpenSSL without a FIPS provider selected.",
		"The database tools and evidence collection images run Node.js, Python, the AWS CLI, and pgroll without a FIPS provider or FIPS mode selected.",
		"The SonarQube account reconciliation function signs its directory delegation token with RSA in pure Python."
	],
	"sources": [
		{
			"title": "NIST CMVP certificate records 4884, 4816, 5314, 4985, 5247, 5298, 5146, 5310, 5369, 5256, 5332, and 5021",
			"url": "https://csrc.nist.gov/projects/cryptographic-module-validation-program/validated-modules"
		},
		{
			"title": "AWS FIPS 140-3 compliance page: the module for each service, the FIPS endpoints by service, and the AWS update stream approach",
			"url": "https://aws.amazon.com/compliance/fips/"
		},
		{
			"title": "Amazon Aurora PostgreSQL release notes (17.4: FIPS-validated cryptography from AWS-LC)",
			"url": "https://docs.aws.amazon.com/AmazonRDS/latest/AuroraPostgreSQLReleaseNotes/AuroraPostgreSQL.Updates.html"
		},
		{
			"title": "AWS Fargate FIPS-140 mode: off by default, AWS GovCloud (US) only, X86_64 tasks only",
			"url": "https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-fips-compliance.html"
		},
		{
			"title": "Amazon Linux 2023 FAQs: validated modules, kernel 6.1 as the only validated kernel, and the certified OpenSSL provider package",
			"url": "https://aws.amazon.com/linux/amazon-linux-2023/faqs/"
		},
		{
			"title": "AWS GovCloud (US) endpoints: use the FIPS endpoints for FIPS 140-3 compliance",
			"url": "https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/using-govcloud-endpoints.html"
		}
	],
	"contact": "security@cleat.ai"
}