NEW 2026 · BOOK 1 OF 3

AWS for Government & Federal Agencies

Book 1: Foundations & Compliant Architecture

by Stephen P. Thomas

Book 1 of the AWS Federal series covers the foundations of federal cloud computing and compliant architecture on AWS GovCloud. Understand the federal cloud mandate, GovCloud isolation, FedRAMP, FISMA, and NIST 800-53 — then build production-ready IAM, networking, encryption, logging, and incident response architectures that pass ATO assessment. This is the essential starting point for federal cloud practitioners.

What You'll Learn

• Understand the federal cloud mandate, Executive Order 14028, and the OMB Cloud Smart strategy driving agency cloud adoption
• Navigate AWS GovCloud isolation, eligibility requirements, service availability gaps, and account setup
• Master FISMA, NIST 800-53 Rev 5, FedRAMP baselines, and the full ATO process from SSP to authorization
• Implement compliant IAM with PIV/CAC federation, SCPs, and break-glass procedures
• Design TIC 3.0 compliant networking with Transit Gateway, VPN, Direct Connect, and DNSSEC
• Configure FIPS 140-2 validated encryption with KMS, CloudHSM, and data residency controls
• Build continuous monitoring with CloudTrail, Security Hub, Config, and automated evidence collection
• Establish federal incident response with GuardDuty, automated runbooks, and US-CERT reporting

Full Table of Contents

1. I Part I: Understanding the Federal Cloud Landscape
2. 1 The Federal Cloud Mandate — Executive Order 14028, Cloud Smart strategy, cloud maturity across agencies, key federal stakeholders, and real-world migration stories
3. 2 Understanding AWS GovCloud (US) — Isolation model, GovCloud East vs. West, eligibility, service gaps, account setup, and procurement channels
4. 3 The Federal Compliance Framework — FISMA, NIST 800-53 Rev 5, FedRAMP authorization, impact levels, ATO process, CMMC, ITAR, IRS 1075, and CJIS
5. II Part II: Building Compliant Architecture on AWS GovCloud
6. 4 Identity and Access Management — IAM policies, SCPs, IAM Identity Center, PIV/CAC federation, least privilege, and break-glass procedures
7. 5 Networking and Perimeter Security — TIC 3.0, VPC design, Transit Gateway, PrivateLink, VPN, Direct Connect, and DNSSEC
8. 6 Data Protection and Encryption — FIPS 140-2, KMS, CloudHSM, S3/RDS encryption, data classification, CUI handling, and data residency
9. 7 Logging and Monitoring — Continuous monitoring (NIST 800-137), CloudTrail, Config, Security Hub, SIEM integration, and evidence automation
10. 8 Incident Response — NIST 800-61, GuardDuty/Detective, US-CERT reporting, automated IR runbooks, and forensic preservation
11. A GovCloud Service Availability Matrix
12. B NIST 800-53 to AWS Service Mapping
13. C FedRAMP High Quick Reference
14. D AWS Config Conformance Pack Reference
15. E Acronym Glossary
16. F Resources and Further Reading