AWS GovCloud (US) is an isolated AWS Region designed to help US government agencies and highly regulated organizations meet their compliance needs, including the International Traffic in Arms Regulations (ITAR) and Federal Risk and Authorization Management Program (FedRAMP). AWS GovCloud (US) makes it safe and easy to move sensitive data and regulated IT workloads to the cloud, through its adherence to numerous compliance and regulatory requirements. Join us to learn about AWS GovCloud (US) and how AWS can do the heavy lifting for your government agency or regulated enterprise.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Is AWS GovCloud Right for your
Regulated Workload?
D a v i d C r u l e y , M a n a g e r , W W P S S p e c i a l i s t s T e a m , A W S
T o m G e r d e s , V P I n f o r m a t i o n T e c h n o l o g y , J o h n s o n C o n t r o l s F e d e r a l
S y s t e m s
S t e v e P o r t e r , I I S E n g i n e e r i n g F e l l o w , R a y t h e o n
W P S 2 0 5
N o v e m b e r 2 7 , 2 0 1 7

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS Global Infrastructure
16
Regions
43
Availability
Zones
3
AWS GovCloud (US-East)

3. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
First Myth of GovCloud
=!=
It is NOT just for Govies!

4. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Who Uses AWS GovCloud?
U.S. Government
Federal, state, and local
Consulting firms and
systems integrators
Technology firms
and ISVs
Education
institutions
Research
organizations
Regulated industries
(Aerospace, Defense, Energy,
Manufacturing, Health care)
Nonprofit
organizations
Managed-service
providers

5. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Fit for Controlled Unclassified Information (CUI)
Many customers use GovCloud for all categories of CUI
Agriculture Copyright Critical infrastructure
Export control Financial Immigration
Intelligence Law enforcement Legal
Nuclear Patent Privacy (PII)
Proprietary (IP) Statistical (census) Tax
Transportation

6. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
The Unique Compliance Posture of GovCloud
International Traffic and
Arms Regulation
DOD Cloud Security Req’s
Guide IL 2,4 and 5
SP 800-53 (rev 4)
SP 800-171
CJIS
Federal Information
Processing Standard Pub
Defense Federal
Acquisition Regulation
Supplement
IRS—1075
(Section 6103 (p))
FedRAMP
Moderate and High

7. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
…And Features Compliance in Other AWS Regions
Family Educational
Rights and Privacy Act
International Organization
for Standardization
AICPA Service Organization
Control Reports
Payment Card Industry
Data Security Standard
Export Administration
Regulation
Health Insurance Portability
and Accountability Act

8. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
To GovCloud or Not to GovCloud
or

9. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Do You Have Requirements For…
“Community cloud” with
vetted account holders
Managed by U.S.
citizens on U.S. soil

10. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DOD Cloud Security Req’s
Guide IL 2
FedRAMP
Moderate
Payment Card Industry
Data Security Standard
Health Insurance Portability
and Accountability Act
OR
Select region based on customer preference or integration requirements
IRS—1075
(Section 6103 (p))
Do You Have Requirements For…

11. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DOD Cloud Security Req’s
Guide IL 4 or 5
FedRAMP High
GovCloud is the only region certified for workloads with these requirements
International Traffic and
Arms Regulation
CJIS
Defense Federal
Acquisition Regulation
Supplement
Do You Have Requirements For…

12. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
o GovCloud, in many ways, is just another region
o Services within region operate the same as commercial regions
o Same security posture as commercial regions
o GovCloud has technical differences
o VPN endpoints are FIPS Validated Hardware and operate differently
than commercial region software-based VPNs
o Service endpoints are also FIPS Validated
o Service parity can impact architecture (no Route 53, for example)
A Few Technical Considerations

13. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
o Cross-region copy functionality
disabled by design (AMI,
Amazon S3 buckets…)
o Separate IAM credentials
prevent cross-region
functionality (RDS,
DynamoDB…)
o Separate IAM credential
boundary prevents native
service integration with
commercial regions (SNS,
SQS…)
GovCloud is an Isolated Region

14. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Do the systems reside in GovCloud, U.S. commercial regions, or both?
Do You Have Integration Requirements?

15. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
o GovCloud only or commercial only
o Simple…deploy in the same region…
o GovCloud and commercial
o Deploy in commercial AND GovCloud
o Will require maintaining multiple instances of your app
o Multiple ATOs—one for GovCloud and one for commercial
o Deploy in commercial OR GovCloud
o Simplifies management to a single instance, but…
o Be careful of compliance boundaries
o GovCloud is an isolated region which complicates AWS service
integration across regions (app-level integration generally ok)
Integration Requirements (Continued)

16. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS GovCloud as a Strategic Differentiator
U.S. government
shared services
Improve compliance management
[+] Addressable marketNarrow competitionShorten ATO timeline

17. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Customer Use Cases
Johnson Controls Federal Systems
Tom Gerdes—VP, Information Technology

18. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
JCI and Tyco
Foreign Ownership,
Control or Influence
(FOCI)
New Technology
Requirements
• Merger completed on
September 6, 2016
• Global diversified
technology and multi-
industrial leader in
buildings and power
solution markets
• Headquartered in
Cork, Ireland
• Merged company
considered under
FOCI based on
ownership structure
• Established new
mitigated entity to
continue serving
government
customers
• Independent
infrastructure,
applications and
cybersecurity
solutions
• Increased
compliance
requirements
The Backstory

19. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
COMPLIANCE SPEED SCALE ACCESS
Why AWS GovCloud?

20. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AMAZON ELASTIC
COMPUTE CLOUD
AMAZON SIMPLE
STORAGE SERVICE/
AMAZON GLACIER
AMAZON RELATIONAL
DATABASE SERVICE
AWS DIRECT CONNECT
AMAZON SIMPLE
NOTIFICATION
SERVICE
AWS CERTIFICATE
MANAGER
AWS CLOUDTRAIL
AND AMAZON
CLOUDWATCH
ELASTIC LOAD
BALANCING
AWS Asset Usage in Virtual Private Cloud

21. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
COMPLIANCE
• ITAR and
FedRAMP
• Integrating logs
with
cybersecurity
Security
Information
Event
Management
platform
• Disaster
recovery and
data archiving
SPEED
• Initiate to go-live
in two months
• Improved
application
performance
SCALE
• Deltek
Costpoint, Shop
Floor Time, Time
& Expense, and
RFgen solutions
migrated (Dev
and Prod)
• Time clock
hardware and
RF scanner
connectivity
ACCESS
• Direct
connection to
data center
• Improved remote
and mobile
access with
external URL
• AD-
authenticated
single sign on
Where We Are

22. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Customer Use Cases
Raytheon
Steve Porter—IIS Engineering Fellow

23. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Use case: Improve product quality with automated software test processes and
infrastructure as code
• Mission test environments are large and complex
• Testing mission code often required 30-40 nodes, including storage and network
• Functional and Integration testing is not using clean test environments
• Test environment deployments are slow, not repeatable or consistent
Solution: GovCloud-enabled Continuous Automation
• Use code to rapidly instantiate large test environments on GovCloud
• Create workloads that deploy the same on AWS as they do on VMWare and bare metal
• Create a continuous integration pipeline that builds environments, automatically tests code
changes, then destroys the environment (Ephemeral Test)
• Create an automated management process that continuously cleans up GovCloud artifacts
based on tagging metadata
Mission-like Test Environments

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Continuous Automation improves product quality
• Repeatability
• The system is deployed the same way every time
• The deployment code is exercised many times each day at scale
• Consistency
• Each deployment converges to the same desired state
• Consistency is highly desirable for security controls and configurations
• Velocity (Speed with purpose)
• Accelerates the development process and increases overall product quality
• Consider the whole development pipeline system—seek out the next slow thing
Velocity Killers
• Snowflake configurations
• Multiple environments, persistent and stale environments
Continuous Automation
Velocity will be achieved through consistency and repeatability

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GovCloud Mission-like Environments in Minutes
App Server
App Server
App Server
App Server
LB
App Server
App Server
App Server
App Server
LB
Active Dir
PKI
Chef Srv SOA
NFS Server
DB1
DB2
Net Router
Mission 1
Mission 2
Workstation
Workstation
Mission 3
Mission 3
VPC
Infrastructure as Code
Terraform
Chef
AMI Repo
Test
Results

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GovCloud Enabled DevOps Results
GovCloud enables consistent, repeatable environments at high velocity
Pipeline
Process
Normal
Process
Build
Compile SW Change
Unit Test
Sanity Test SW Changes
Packaging
Package Component
Once for Deliver
Staging
Pull Package & Supporting
Components from CM
Deployment
Provision AWS Services &
Install Applications
Functional Test
Execute Component
Functional Test Suite
DevOps
Process
Build Unit Test Package & Deploy Functional Test
Less Than
30 minutes
Less Than
30 minutes
Less Than
1 Hour
80 hours & Not Clean Environment8 hours Not done every
build
Not done every
build
Clean Environment Every time; Less Than
1 Hour
AWS GovCloud
Every change validated early in the development cycle
Multiple changes validated late in the development cycle

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Developers are in Control
• Developers control which products and versions are deployed to
configure their test environment
• Infrastructure and platform products maintain a library of version-
controlled AMIs for quick launch
• Service costs are controlled by a mapping of AWS instance types to node
types
• Terraform code is dynamically generated based on environment resource
requirements
• Each test environment is idempotent and ephemeral
• Resource tagging is key to controlling environment resources
Approved for Public Release
This document does not contain technology or technical data controlled under either the U.S. International Traffic in Arms Regulations or the U.S. Export Administration Regulations.

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!