AWS states that agencies must issue their own ATO for systems that incorporate certified AWS services. This article covers how to verify current scope, where shared responsibility draws the line, how to define your boundary, and how to prepare for ongoing monitoring.
Key Takeaways
- Scope varies by service, region, and certification class, so check AWS's live service matrix.
- GovCloud supports regulated workloads but does not make your application compliant.
- AWS provides inherited infrastructure controls; you own application, identity, data, and process controls.
- Readiness continues after authorization through monitoring, incident reporting, and POA&M upkeep.
What FedRAMP Compliance Means for AWS
FedRAMP is the standardized federal approach to assessing and authorizing cloud products and services that handle unclassified government information. It builds on NIST SP 800-53, and agencies still make their own risk decisions.
Four terms get mixed up constantly:
- Cloud service offering: the AWS environment and services inside its certification boundary
- AWS authorization: AWS's certification, which supports reuse (historically called a P-ATO for the JAB route)
- Agency ATO: an agency authorizing official's acceptance of risk for a specific system
- Your system boundary: your workload, data flows, and integrations on top of AWS
Impact levels
FedRAMP's published Rev5 baselines map to potential impact under NIST FIPS 199:
| Baseline | Impact if confidentiality, integrity, or availability is lost | Published control count |
|---|---|---|
| Low | Limited adverse effect | 156 |
| Moderate | Serious adverse effect | 323 |
| High | Severe or catastrophic adverse effect | 410 |
Those counts come from FedRAMP's 2023 Rev5 transition materials. FedRAMP's 2026 consolidated rules also introduce Classes A through D and use "certification" terminology.
AWS now labels its commercial boundary Class C (formerly Moderate) and GovCloud Class D (formerly High). Check which terminology your agency sponsor uses.
Which AWS Services Are in FedRAMP Scope?
Read the official scope by region and impact level
Start with AWS's FedRAMP Services in Scope page and the FedRAMP Marketplace entries. AWS maintains separate certifications:
- Commercial Class C: US East (N. Virginia), US East (Ohio), US West (Oregon), US West (N. California)
- GovCloud Class D: AWS GovCloud (US-East) and (US-West)
A service authorized in one boundary is not automatically authorized in the other. The matrix is also not a regional feature-availability chart. As of October 27, 2026, AWS's FedRAMP scope page listed a last update of October 15, 2026. The list changes, so re-check it before every design decision.
Common service categories to evaluate
In that matrix, these services carry checkmarks in both commercial and GovCloud columns:
| Category | Examples |
|---|---|
| Compute and containers | Amazon EC2, Amazon EKS |
| Serverless | AWS Lambda |
| Storage | Amazon S3 |
| Encryption | AWS KMS |
| Logging and monitoring | AWS CloudTrail, AWS Config, Amazon CloudWatch |
| Threat detection and edge | Amazon GuardDuty, AWS WAF, AWS Security Hub (listed as Security Hub CSPM) |
| Identity | Amazon Cognito |
Details matter. Amazon RDS appears as engine-specific rows (Db2, MariaDB, MySQL, Oracle, Postgres, SQL Server), and Aurora has separate rows. Amazon Macie shows a checkmark in the commercial column but a blank cell for GovCloud. That blank is a scope fact, not a statement about general availability.
A service list is not an authorization decision
A checkmark does not validate your architecture, code, IAM policies, data flows, third-party integrations, procedures, or evidence. Evaluate the whole system rather than picking services from a list in isolation.
How AWS Shared Responsibility Affects Your FedRAMP Boundary
AWS describes its role as security "of" the cloud and yours as security "in" the cloud. The split shifts by service:
- EC2: you manage guest OS patches, installed applications, and security-group configuration
- S3 and DynamoDB: AWS manages infrastructure and platform; you manage data, classification, encryption options, and IAM permissions
AWS also directs customers to run a control-versus-inheritance analysis using its FedRAMP package and service-specific configuration guidance. Commercial customers and partners can get the FedRAMP Partner Package through AWS Artifact or their account manager.
Defining the boundary
Map everything that touches federal data:
- AWS accounts and regions
- Workloads, APIs, and administrators
- Endpoints, contractors, and external integrations
FedRAMP's boundary guidance addresses leveraged services and requires data-flow and interconnection diagrams, so produce both diagrams.
Controls that stay with you
- Least-privilege IAM and multifactor authentication
- Secure configuration, vulnerability scanning, and patching
- Logging and alert review
- Incident response, backup, and contingency planning
- Personnel security and training
Encryption and FIPS
A validated module alone is not enough. FedRAMP's January 2025 cryptographic policy addresses module selection and updates, and NIST moves FIPS 140-2 modules to its Historical list after September 21, 2026.
AWS publishes service-specific FIPS endpoints. Confirm the endpoint, module, and validation status for each service you use instead of assuming a region covers it.
Build a control-ownership matrix
Use one table that lists each control, what AWS provides, what you implement, what evidence is required, and which duties fall to vendors. It becomes the backbone of your Customer Responsibility Matrix.
What Your Organization Must Do Beyond AWS Services
Establish the system boundary and target authorization
Classify the information you will process, pick the matching impact level, choose compatible regions and services, and document the architecture before building. Then run an inventory exercise covering:
- AWS accounts, resources, and data stores
- User roles and APIs
- Third-party services and Marketplace products
- Development environments
- Anything that falls outside the boundary
Implement technical and administrative controls
Policies and procedures are required for access control, audit and accountability, configuration management, incident response, and risk assessment. You also need documented coverage for system integrity, contingency planning, awareness training, and communications protection.
AWS tools can support implementation, with clear limits:
- AWS Config conformance packs: map to a subset of FedRAMP Moderate controls
- AWS Audit Manager: collects evidence against NIST SP 800-53 Rev5 but doesn't guarantee audit results
- Security Hub CSPM: automates checks for a subset of requirements
Manual and procedural controls remain. Tooling doesn't replace documented processes or accountable people.
Prepare documentation and assessment evidence
Expect to produce:
- System Security Plan (architecture, boundary, data flows, control implementation)
- Customer Responsibility Matrix
- Diagrams, inventories, policies, scan results, and incident records
- Plan of Action and Milestones (POA&M) for known weaknesses
A FedRAMP-recognized 3PAO independently plans and performs the assessment and reports findings. AWS doesn't fill that role, and remediation is yours. A 3PAO's Readiness Assessment Report only validates readiness; it is not the full security assessment.
Maintain compliance after authorization
Ongoing duties include:
- Vulnerability scanning
- Log review
- Configuration assessment
- Annual assessment
- Incident reporting
- POA&M tracking
Requirements are being phased in under the 2026 rules, so confirm the version that applies to you:
- Incident reporting (from January 1, 2027): initial deadlines depend on class and PAIN rating, from 1 hour to 1 business day for Class C and 15 minutes to 1 hour for Class D
- Class C significant changes: adaptive changes need notice within 10 business days after implementation; transformative changes need notice 30 business days before
- Class C ongoing reporting: every three months, applicable from April 2, 2027
Adding a service, changing regions, altering a data flow, or introducing a new integration may trigger review and updated documentation.
How to Assess AWS FedRAMP Readiness and Get Expert Support
Use this practical sequence to gauge AWS FedRAMP readiness:
- Inventory systems, data flows, and the authorization boundary
- Select the target FedRAMP baseline or impact class
- Compare current controls against the required baseline
- Prioritize gaps by risk and agency expectations
- Document the architecture and shared-responsibility split
- Remediate technical and process gaps
- Prepare assessment evidence packages
- Coordinate the assessment with a 3PAO
No single typical price or timeline applies. Effort depends on boundary size, documentation maturity, remediation scope, and agency review.
Choosing a support provider
Evaluate providers on:
- FedRAMP and AWS delivery experience
- Clear control-ownership guidance
- Documentation quality and evidence discipline
- 3PAO assessment coordination
- Continuous monitoring capability
- A firm line between readiness support and authorization authority
DeepSeas can support the governance, risk, and compliance side of this work. GRC engagements are led by hands-on practitioners, including ISO Lead Auditor-certified specialists.
Coverage typically includes:
- Gap assessments
- Policy and control development
- Continuous controls monitoring
- Prioritized roadmaps from the strategic advisory team
24/7 managed detection and response and incident response services can also back monitoring and response duties. DeepSeas supports readiness; authorization decisions rest with the agency and FedRAMP.
Frequently Asked Questions
Which AWS services are FedRAMP approved?
Authorization applies to specific service offerings within AWS's commercial or GovCloud boundary. Check the current AWS Services in Scope page and FedRAMP Marketplace rather than relying on a static list.
What is FedRAMP compliance?
FedRAMP is the federal process for assessing, authorizing, and continuously monitoring cloud services. AWS certifies its offering, you document your system, a 3PAO assesses it, and an agency authorizing official issues the ATO.
Is GovCloud the same as FedRAMP?
No. GovCloud is a set of isolated AWS regions for regulated workloads, while FedRAMP is a certification and oversight program. Using GovCloud doesn't authorize your application.
Does running on AWS make my application FedRAMP compliant?
No. AWS covers inherited infrastructure controls, but you must secure and document your application, configurations, users, data, and integrations. Agencies still issue their own ATO.
How can I verify whether an AWS service is in FedRAMP scope?
Check the AWS Services in Scope matrix and the matching FedRAMP Marketplace record for the exact service, boundary, and status. Then validate it against your full system boundary.
