Skip to main content

AWS Cloud Security

Federal Information Processing Standard (FIPS) 140-3

Overview

What is FIPS 140?

The Federal Information Processing Standard (FIPS) Publication 140 is a United States and Canadian government standard that specifies security requirements for cryptographic modules that protect sensitive information. For more information about FIPS 140, and its current third version referred to as 140-3, see Cryptographic Module Validation Program on the NIST Computer Security Resource Center website.

AWS FIPS Validation Approach

The cryptographic modules powering AWS services undergo FIPS validation across multiple module types, which are listed below with the relevant FIPS module names:

  • Software libraries: AWS-LC (dynamic), AWS-LC (static), AWS OpenSSL FIPS (based on the OpenSSL FIPS Provider)
  • Operating systems libraries: Amazon Linux Kernel Cryptographic API, Amazon Linux OpenSSL FIPS Provider, Amazon Linux GnuTLS, Amazon Linux NSS, Amazon Linux  Libgcrypt
  • Hardware Security Modules (HSMs): AWS Key Management Service HSM, AWS CloudHSM (Marvell LS2 HSM Family)
  • Optical networking: AWS Link Encryption Module and AWS Scalable Network Crypto
  • Nitro at-rest storage: AWS Nitro Card Security Engine SSMAE, AWS Nitro Ethernet Storage Encryption (ESE) Engine
  • Nitro VPC networking: AWS Nitro Networking
Because of the cyclical nature of the FIPS validation process – validate -> update -> validate again – the module names above can be found in various stages in one or more of the following locations: the FIPS Cryptographic Module Validation Program (CMVP) Search page, Modules in Process List, and Implementation Under Test List. AWS follows an update stream methodology for maintaining FIPS modules, consistent with the FedRAMP Policy for Cryptographic Module Selection and Use. Under this approach, we apply the latest updates and patches to our FIPS-validated cryptographic modules operating in FIPS-approved mode, while submitting major updates through the formal validation process.

All cryptographic solutions are global except FIPS endpoints for encryption in transit (US Commercial, GovCloud, and Canadian regions only).

Missing alt text value

Data in Transit Encryption

FIPS Endpoints

FIPS endpoints provide encryption in-transit using FIPS-validated cryptographic libraries. They ensure that communications between AWS services and customer applications use cryptographic modules that are CMVP certified and operating in FIPS-approved mode. All FIPS endpoints listed on this page utilize cryptography from the latest release of AWS-LC (dynamic), which undergoes regular FIPS validation for each new major version released. More information on AWS-LC can be found in this AWS Security blog post.

AWS Site-to-Site Optical

All data flowing across the AWS global network that interconnects our data centers and Regions is automatically encrypted at the physical layer before it leaves our secured facilities. These AES256-enabled MACsec cryptography edge devices use cryptography from AWS Encryption Module and AWS Scalable Network Crypto validations on the Modules in Process List as well as Original Equipment Manufacturer (OEM) FIPS modules from other vendors.

AWS Client VPN and Site-to-Site VPN

AWS Client VPN and Site-to-Site VPN use cryptography from the latest release of AWS-LC (static) and Amazon Linux 2023 kernel, both of which undergo regular FIPS validation. AWS Site-to-Site VPN endpoints use AWS-LC for IKEv2 and Amazon Linux 2023 kernel for IPsec operations, while AWS Client VPN uses AWS-LC for server-side encryption.

FIPS-Validated HSMs (Key Protection)

FIPS-validated hardware security modules (HSMs), such as AWS Key Management Service (KMS) or AWS CloudHSM, use physical HSMs that have been independently validated under the Cryptographic Module Validation Program (CMVP) at FIPS 140-3 Level 3. These services protect keys within a tamper-resistant boundary where plaintext keys cannot be exported.

AWS Key Management Service (AWS KMS)

AWS KMS uses HSMs that are FIPS 140-3 Level 3 validated or in the process of validation. The modules operate exclusively in FIPS-approved mode when providing functionality to KMS. Every production release of an HSM in KMS undergoes FIPS 140 validation.

AWS CloudHSM

⚠️ IMPORTANT MIGRATION NOTICE
On January 4, 2026, the certificate for hsm1.medium moved to the CMVP historical list. Customers should migrate to the hsm2m.medium instance type.

AWS CloudHSM provides dedicated, single-tenant HSMs that are CMVP certified and operating in FIPS-approved mode

Data at Rest Encryption

Our foundational storage services represent the largest locales of data stored at rest in AWS, being leveraged both by customers and other AWS services. They utilize the latest FIPS tested release of the libraries from the FIPS Modules in Process page or the list of completed AWS FIPS validations:

  • Amazon S3 - All modes of operation (SSE-S3, SSE-KMS, SSE-C, DSSE-KMS, S3 Bucket Keys) use AWS-LC (Static) for Server-side encryption.
  • Amazon DynamoDB - All modes of operation use AWS-LC (Static) for server-side encryption.
  • Amazon Elastic Block Store (EBS) - Nitro instances encrypt EBS volumes using the Nitro Card Security Engine (SSMAE) cryptography, except instances built on Nitro v6 which use the Nitro Ethernet Storage Encryption (ESE) Engine. For a list of Nitro v6 instances, see this reference.
  • Amazon EC2 Nitro – Nitro instances use the AWS Nitro Card Security Engine SSMAE cryptography for server-side encryption.

Operating Systems