Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 1. Getting started with Red Hat OpenShift Service on AWS classic architecture in AWS GovCloud

This service is for use by federal and government agencies, or by commercial organizations and Federal Information Security Modernization Act (FISMA) R&D Universities supporting a government contract or in the process of bidding on a government contract such as a request for proposal (RFP) or request for information (RFI) pre-bid stage.

Red Hat OpenShift Service on AWS classic architecture in AWS GovCloud, carries the following requirements:

  • Red Hat OpenShift Service on AWS classic architecture FedRAMP can only be deployed into an existing VPC. See Create Amazon VPC architecture for the AWS PrivateLink use case for instructions on setting up a VPC.
  • Red Hat OpenShift Service on AWS classic architecture in AWS GovCloud only supports the use of the AWS STS credentials method.
  • Red Hat OpenShift Service on AWS classic architecture in AWS GovCloud only uses Federal Information Processing Standards (FIPS) validated modules in process cryptographic libraries.

  • Red Hat OpenShift Service on AWS classic architecture in AWS GovCloud requires a separate Red Hat account for use with FedRAMP, even if you already have an existing Red Hat account for Red Hat OpenShift Service on AWS classic architecture clusters in commercial regions.

    • Each person who needs to be able to create, modify, or delete clusters must have their own Red Hat FedRAMP account.
    • Access to an existing cluster, to use that cluster, does not require a Red Hat FedRAMP account.
  • You can use your Red Hat FedRAMP account to deploy to multiple AWS GovCloud accounts.

1.1. Signing up for a Red Hat FedRAMP account
Copy link

To access Red Hat OpenShift Service on AWS classic architecture in AWS GovCloud, you must sign up for a Red Hat FedRAMP account.

Procedure

  1. Navigate to https://console.redhat.com/openshift/create/rosa/govcloud.
  2. Complete the access request form.

  3. Click Submit to sign up.

    You will receive a Submission confirmation.

Red Hat’s confirmed stateside support team will contact you through email for the following information:

  • Admin details to include your organization name, administrator first and last name and administrator email.

  • User authentication option to the FedRAMP Hybrid Cloud Console from one of the following two options:

    • Local group in a Red Hat managed Keycloak instance, where users will be required to setup multi-factor authentication (MFA) with an approved device.

      Note

      Only device YubiKEY 5C NFC FIPS currently accepted.

    • Customer managed Identity Provider (IdP), integrated via OpenID Connect (OIDC), where you will need to provide the following:

      • Discovery Endpoint: The IdP’s OIDC discovery URL (typically ending in /.well-known/openid-configuration). This allows Keycloak to automatically fetch most of the IdP’s settings.
      • Client ID and secret: Credentials that allow Keycloak to authenticate with the customer’s IdP.
      • Email domain(s): A list of approved email domains. Only users with an email address from one of these domains will be allowed to log in.

      • Essential claim: A specific key-value pair (e.g., "rh-approved": "true") that must be present in a user’s token from the IdP to grant them access.

        In this configuration, the customer takes on the responsibility for implementing FIPS 140-2 validated MFA.

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Theme

© 2026 Red HatBack to top