CLEATUS Trust Center

Providers SHOULD promptly and automatically acknowledge the receipt of messages received from FedRAMP in their FedRAMP Security Inbox.

Providers MUST complete the required actions in Emergency or Emergency Test designated messages sent by FedRAMP within the timeframe included in the message.

Providers MUST route Emergency designated messages sent by FedRAMP to a senior security official for their awareness.

AWS GovCloud (US) is an AWS Region designed to allow US government agencies and customers supporting the US government to move more sensitive workloads into the cloud. In addition to complying with FedRAMP requirements, the AWS GovCloud (US) framework adheres to U.S. International Traffic in Arms Regulations (ITAR) regulations. Additional information is available at http://aws.amazon.com/govcloud-us/. Federal agencies interested in collaborative continuous monitoring with AWS should reach out to: aws-collaborative-conmon@amazon.com

Outbound HTTPS call from cleatus-api to the Have I Been Pwned Pwned Passwords range API each time a user sets or changes a password. The application sends only the first five hexadecimal characters of the SHA-1 digest of the password, with response padding enabled, and matches the returned suffixes inside the boundary. No password, CUI, or user identifier leaves the boundary.

Build-time software supply chain dependency. The GitHub Actions image build workflows run on GitHub-hosted runners outside the authorization boundary and fetch public JavaScript packages from the npm public registry (registry.npmjs.org). No component inside the boundary connects to the registry, and no CLEATUS, customer, or federal data is sent to it. Dependency versions are pinned in a committed lockfile with integrity hashes verified at install. Amazon Inspector scans the built images in Amazon ECR, and production tasks pull images only from in-boundary Amazon ECR.

Inbound transfer of allowlisted public procurement data from the CLEATUS commercial environment into the GovCloud S3 bucket cleatus-prod-public-data-ingest, followed by the in-boundary loader. The producer is a scheduled GitHub Actions workflow on the protected master branch; it runs on a GitHub-hosted ubuntu-24.04 runner at 06:30 and 18:30 UTC (twice daily) and an authorized operator can also start it manually. Each run reads the commercial production database read replica and exports only the tables and rows in the reviewed public-data allowlist (public solicitation records, agency hierarchy and government points of contact, contractor and award market data, FAR content, and reference tables); customer content is excluded by table and by row filter, and no CUI is carried on this path. The runner authenticates by OpenID Connect only: it assumes the IAM role cleatus-prod-github-actions-public-data-export, whose trust policy is pinned to that workflow on refs/heads/master, and no standing GovCloud credential exists in GitHub. The role is limited to object read and write on the ingest bucket, to PutObject on the bridged-documents/ prefix of the documents bucket (re-hosted public solicitation files), and to the two bucket KMS keys. Transfer is one-way inbound over TLS 1.2 or higher to the S3 endpoint, and the bucket policy rejects any upload that does not use SSE-KMS under the bucket key. The manifest.json object uploads last and fires the in-boundary public-data-ingest Lambda, which runs the public-data-load Fargate task in upsert mode. CloudTrail records every assumption of the role. An operator can run the in-boundary public-data-export ECS task on demand.

Scope and limitations are stated in the document.

Scope and limitations are stated in the document.

Scope and limitations are stated in the document.