Federal posture
How the modules carry federal security controls, run unchanged in AWS GovCloud, and fit into a customer owned account.
Federal agencies hold cloud systems to written security controls. FedRAMP, the government program that authorizes cloud services, draws those controls from a catalog with IDs such as SC-13 (use approved cryptography) and AU-11 (keep audit records). In this repository, "federal posture" means the module settings that meet those controls, with the control ID written next to the setting in the code.
One codebase, two AWS partitions
AWS GovCloud (US) is a separate AWS partition. Its resource names (ARNs) start with arn:aws-us-gov: instead of arn:aws:, and IAM policies that hardcode arn:aws: fail there.
- ecs-service, bastion, and openobserve build IAM policy ARNs from
data.aws_partition, so the same code produces correct ARNs in both partitions. - The other modules build no partition specific ARNs. rum is the only module without the govcloud badge, because Kaizen has not confirmed that CloudWatch RUM is offered in GovCloud.
- The ecs-service test suite plans against a mocked
aws-us-govpartition and aus-gov-west-1Cloud Map ARN.
Apps built on Taproot already run this way. ginkgo and the GovCloud stack of saplings deploy to Kaizen's own AWS GovCloud account in us-gov-west-1 on these modules, and both set the FIPS 140-3 TLS policy on their load balancer.
Controls referenced in the code
This table lists every FedRAMP control ID that the module code cites, with the setting that carries it.
| Control | Module | Setting | Federal setting |
|---|---|---|---|
| AU-11Audit record retention | ecs-service | log_retention_days | 90FedRAMP AU-11, as set in examples/federal. |
| redis | log_retention_days | 90FedRAMP AU-11, as set in examples/federal. | |
| openobserve | log_retention_days | 90 or moreFedRAMP AU-11. | |
| SC-8Transmission confidentiality and integrity | s3-bucket | enforce_tls_requests_only | trueFedRAMP SC-8. Also satisfies AWS Config rule s3-bucket-ssl-requests-only. |
| SC-13Cryptographic protection | ecs-service | log_group_kms_key_arn | customer managed KMS key ARNFedRAMP SC-13. |
| ecr | kms_key_arn | customer managed KMS key ARNFedRAMP SC-13. | |
| rds-postgres | kms_key_id | customer managed KMS key ARNFedRAMP SC-13. | |
| redis | kms_key_id | customer managed KMS key ARNFedRAMP SC-13. | |
| s3-bucket | kms_key_id | customer managed KMS key ARNFedRAMP SC-13. | |
| networking | kms_key_arn | customer managed KMS key ARNFedRAMP SC-13. Encrypts the flow log group. | |
| openobserve | s3_kms_key_arn | customer managed KMS key ARNFedRAMP SC-13 and SC-28. | |
| SC-28Protection of information at rest | openobserve | s3_kms_key_arn | customer managed KMS key ARNFedRAMP SC-13 and SC-28. |
On by default, opt in for federal
Most protections are on for every app. The federal ones are opt in, because they need a key or a policy that each stack owns. Each entry in the right column is a setting in the app's module calls.
| On by default in every stack | Opt in for a federal stack |
|---|---|
RDS storage encryption and TLS only connections (rds.force_ssl = 1) | Customer managed keys: kms_key_id, kms_key_arn, log_group_kms_key_arn (SC-13) |
| Redis encryption at rest and TLS required in transit | S3 policy that denies requests without TLS: enforce_tls_requests_only (SC-8) |
| S3 public access blocked, versioning on, AES256 encryption | FIPS 140-3 TLS on the load balancer: ssl_policy = "ELBSecurityPolicy-TLS13-1-2-FIPS-2023-04" |
| ECR scan on push | App log retention of 90 days: log_retention_days = 90 (AU-11) |
| ECS tasks with no public IP, reachable only from the load balancer | Container hardening: readonly_root_filesystem, container_user, drop_all_capabilities |
| VPC flow logs for all traffic, kept 90 days | RDS log export and DDL audit logging: enabled_cloudwatch_logs_exports, enable_audit_logging |
| Deletion protection on the load balancer and database | Redis slow and engine logs: enable_slow_log, enable_engine_log |
| Bastion with no SSH, IMDSv2 required, FIPS crypto policy, CMK encrypted disk | Load balancer access logs: access_logs_bucket |
openobserve is the exception: it ships with the FIPS TLS policy, a required customer managed key for logs, vendor telemetry off, and 90 day retention as its defaults.
The federal example collects these overrides in one federal map in locals.tf, so a reviewer can read what "federal" means for a stack in one place.
Deploying into a customer owned account
Federal customers often own the AWS account and its authorization boundary. Kaizen deploys the app inside that boundary without creating resources the customer controls.
Bring your own cluster. Set create_cluster = false and existing_cluster_name on ecs-cluster. The module looks up the customer's cluster instead of creating one.
Bring your own IAM roles. Pass execution_role_arn and task_role_arn to ecs-service when Kaizen cannot create IAM roles. The module then creates no roles and refuses settings that would try to grant permissions to the supplied roles.
Bring your own keys. Create or receive one customer managed KMS key and pass it to every kms_* input. The customer controls the key and its rotation.
Bring your own network. Look up the customer's VPC and subnets by tag instead of calling networking. For a VPC with no internet egress, the networking module accepts create_nat_gateway = false, and the stack adds the VPC endpoints it needs.
What this is not
These modules are not a FedRAMP authorization, and using them does not grant an Authority to Operate (ATO). The control IDs on this page are references written in code comments, not an audited mapping. Authorization work happens for each system, with the agency, and covers far more than infrastructure code. Account level services such as CloudTrail, AWS Config, GuardDuty, and Security Hub live in each account's baseline stack, not in these modules.