Written and maintained by CASRAI Editorial Board
Last updated
AWS FedRAMP status is a question research offices meet when a federal award, a sponsor contract or a security review asks whether data can sit in Amazon Web Services. In short: AWS says its US East-West regions hold FedRAMP Certification at Class C (formerly the Moderate baseline) and its AWS GovCloud (US) region holds it at Class D (formerly the High baseline). FedRAMP AWS certification belongs to the provider; the authorization to use it for a given system is still your agency’s or institution’s decision. This guide sets out which region carries which level, how the old and new labels map, what you inherit and what you still own, and where to get the evidence. Everything below is as described on the official pages, checked on 2026-10-29.
What it is and who runs it
FedRAMP is the federal program for security assessment of cloud services. The FedRAMP name and logo are the property of the General Services Administration (GSA), and the official site describes the FedRAMP Marketplace as a searchable database of FedRAMP certified cloud services, authorizing agencies and FedRAMP recognized assessors (fedramp.gov, 2026-10-29). For background on the highest baseline, see the CASRAI guide to FedRAMP High.
AWS describes its own position on its FedRAMP compliance page. The FedRAMP PMO grants certifications, and the provider undergoes an annual independent assessment by a FedRAMP Recognized Independent Assessment Service. The page states that “the FedRAMP process does not issue an ATO to CSPs”: the agency ATO is the agency’s responsibility, while FedRAMP Certification is the cloud service provider’s. It also says the JAB P-ATO that AWS held earlier “is a legacy designation superseded by FedRAMP Certification.” If an older policy, template or vendor questionnaire asks for a “JAB P-ATO”, that wording predates the current certification language.
Which AWS regions carry which level
As AWS describes it on 2026-10-29, the two certifications cover different sets of regions:
| AWS scope | AWS’s wording | FedRAMP ID |
|---|---|---|
| US East-West regions (N. Virginia, Ohio, Oregon, N. California) | FedRAMP Certified Class C (formerly Moderate baseline) | AGENCYAMAZONEW |
| AWS GovCloud (US) | FedRAMP Certified Class D (formerly High baseline) | F1603047866 |
AWS also says high-impact workloads can be placed in AWS GovCloud (US), which it describes as authorized for the high impact level. The practical reading for a research office is that the region you choose, not just the vendor name, decides which certification level sits underneath your data. A project that only needs the Moderate-equivalent level and a project that needs High-equivalent do not necessarily belong in the same AWS region. The FedRAMP ID is the handle to use when you search for AWS in the Marketplace.
One point deserves care. The FedRAMP 20x page says Class D certifications will be developed during FedRAMP 20x Phase 4, with a pilot estimated for fiscal year 2027 Q1-Q2 (fedramp.gov/20x, 2026-10-29). That is the new 20x path, and it is separate from AWS’s existing certification for GovCloud (US), which AWS labels Class D, formerly the High baseline. Treat AWS’s wording as AWS’s description of its own certification, and confirm the current listing in the FedRAMP Marketplace before you rely on it in a security plan.
Eligibility: who can use it and who can see the evidence
Certification is a property of the cloud service, not of a customer, so nobody applies to “get” AWS FedRAMP status. What varies by audience is access to the evidence. According to AWS’s page:
- Federal customers can get the documents through AWS Artifact, which AWS describes as a self-service portal for on-demand access to AWS compliance reports, in the console.
- Government staff and contractors can request the Certification Package, including Ongoing Certification Reports, with a Package Access Request Form sent to [email protected].
- Commercial customers and partners can obtain the AWS FedRAMP Partner Package through AWS Artifact or their AWS account manager.
A university research office is typically in the commercial-customer or contractor position, depending on the award, so which route applies depends on your role under the agreement, which your contracts office should confirm.
What it funds or requires: inheritance versus your own responsibility
FedRAMP certification does not fund anything. What it gives you is controls you can inherit. AWS states that “you can inherit various security controls when using FedRAMP-authorized infrastructure, platforms, and services,” and that your initial analysis of control versus inheritance will determine your compliance responsibilities. In other words, the certification covers what AWS operates; configuring your own accounts, data handling and access within them is separate work that you document in your own system security plan.
This is the same split that governs an agency ATO. The agency authorizes a specific system, using the provider’s certification package as evidence. For that step see authority to operate. Where the data is controlled unclassified information from a sponsor, the cloud question sits alongside the contract’s own safeguarding rules; the CASRAI guides on NIST SP 800-171 for university CUI and ITAR-compliant cloud storage cover those.
Compliance steps
- Identify the data and the level it needs. Take the level from the award, contract or agency requirement, not from the vendor.
- Match the region to the level. US East-West regions are described as Class C (formerly Moderate); GovCloud (US) as Class D (formerly High).
- Look up the listing. Search the FedRAMP Marketplace using the FedRAMP ID in the table above and note what it shows, including the date you checked.
- Obtain the package. Use AWS Artifact or the Package Access Request Form route that fits your role.
- Do the inheritance analysis. Record which controls you inherit from AWS and which remain yours.
- Get the authorization decision. The agency ATO, or your institution’s equivalent decision, is separate from AWS’s certification.
Typical timeline phases
The sources do not publish durations for these steps, so none are given here. The order is: scoping the data and level; locating the provider’s listing and package; the inheritance analysis and your own control documentation; the authorization decision; then ongoing monitoring. For the last phase AWS publishes a quarterly Ongoing Certification Report, and the provider is assessed annually, so a package you downloaded earlier is not the current record.
Common mistakes
- Treating certification as your ATO. AWS says the agency ATO is the agency’s responsibility.
- Looking only at the vendor name. The certification is scoped to named regions; check the region against the level.
- Relying on the old labels alone. Documents that say Moderate or High map to Class C and Class D in AWS’s wording; the JAB P-ATO is a legacy designation.
- Assuming inheritance covers everything. AWS states that your control-versus-inheritance analysis determines your responsibilities.
- Using a stale package. AWS publishes quarterly Ongoing Certification Reports.
Related programs
The FedRAMP 20x page describes classes of authorization (fedramp.gov/20x, 2026-10-29):
| Class | As described on the 20x page |
|---|---|
| Class A (Pilot) | Mature security programs entering the federal market; small upfront information and limited ongoing reporting |
| Class B | Low |
| Class C | Moderate; common enterprise services, possibly agency-wide |
| Class D | High; 20x Class D certifications will be developed in Phase 4, pilot estimated FY27 Q1-Q2 |
For how CMMC scoping interacts with cloud services in defense-funded research, see the CMMC scoping guide.
FAQ
Is AWS FedRAMP authorized?
AWS states that its US East-West regions are FedRAMP Certified Class C (formerly Moderate) and that AWS GovCloud (US) is FedRAMP Certified Class D (formerly High), as described on its compliance page on 2026-10-29.
Is FedRAMP AWS certification the same as an ATO?
No. AWS says the process does not issue an ATO to cloud providers. The agency ATO is the agency’s responsibility, while certification is the provider’s.
Which AWS region should hold High-impact data?
AWS says high-impact workloads can be placed in AWS GovCloud (US), described as authorized for the high impact level.
Where do I get the AWS FedRAMP documents?
Federal customers use AWS Artifact; government staff and contractors can request the Certification Package through the Package Access Request Form; commercial customers and partners can get the Partner Package through AWS Artifact or their account manager.
Does AWS’s certification make my own system compliant?
No. You can inherit controls, but your own control-versus-inheritance analysis determines your responsibilities.
Sources
- Amazon Web Services, FedRAMP compliance page: aws.amazon.com/compliance/fedramp, checked 2026-10-29.
- FedRAMP, 20x: fedramp.gov/20x, checked 2026-10-29.
- FedRAMP, program home and Marketplace description: fedramp.gov, checked 2026-10-29.
Programs change; check the official pages for the current position.
