GovCloud / FedRAMP High deployment.
Federal customers run threatDefendr inside AWS GovCloud, on the IL5-eligible reference architecture, with a clean authorization boundary. This is what lives where, how it is provisioned, and the evidence it produces for your package.
The authorization boundary
BYOC draws the boundary for you: the data plane — every byte of telemetry and every key — lives inside your GovCloud account, and the managed control plane sits in the GovCloud High environment. Nothing crosses into the commercial partition.
| Inside the boundary | Managed (GovCloud High) |
|---|---|
| Event fabric, detection compute, CMK-encrypted storage, the VPC | Orchestration, detection & intel content, software updates |
| All FIPS 140-3 endpoints, in-account | Authenticated control channel — metadata only, never raw events |
Provision in GovCloud
The same data-plane module targets the GovCloud partition and FIPS endpoints. Set the partition, point at your CMK, and the module places everything in-account.
HCLmain.tf module "threatdefendr_dataplane" { source = "threatdefendr/dataplane/aws" version = "~> 2026.06" partition = "aws-us-gov" # GovCloud region = "us-gov-west-1" fips = true # FIPS 140-3 endpoints impact = "il5" kms_key_arn = aws_kms_key.gov.arn control_plane = "managed-govcloud" }
Evidence for the package
The platform produces the artifacts an assessor asks for. Control implementations map to NIST 800-53 Rev 5, and the audit log exports as immutable evidence keyed to each control.
Where to go next
- BYOC deployment — the commercial-cloud version.
- Public sector — mission-grade defense in depth.