Designing AWS Infrastructure to Support CJIS and FedRAMP Moderate Requirements with Amazon Q Developer

Introduction

When tasked with building infrastructure that meets CJIS (Criminal Justice Information Services) and FedRAMP Moderate compliance requirements, I faced a critical challenge: achieving FIPS 140-2 compliance in AWS Public Cloud. This wasn't just about security best practices—it was about meeting strict federal compliance mandates for handling sensitive law enforcement and government data when not using AWS GovCloud.

Over 7 development phases, Amazon Q Developer helped me navigate complex compliance requirements and build a 266-resource Terraform infrastructure across 11 modules. Here's how we designed infrastructure to support CJIS and FedRAMP Moderate requirements in AWS Commercial Cloud.

Note: An architecture, tool, or generated configuration does not by itself create a FedRAMP authorization or establish CJIS compliance. Authorization and compliance depend on the full system, how it is operated, and assessment by the appropriate authority.

Supporting CJIS and FedRAMP Requirements in AWS Public Cloud

The Compliance Challenge

The project required meeting two stringent compliance frameworks:

CJIS Compliance Requirements

• FIPS 140-2 validated cryptography for all data at rest and in transit
• Audit logging with tamper-evident trails
• Access controls with least privilege
• Network isolation and segmentation
• Encryption for all sensitive data

FedRAMP Moderate Requirements

• 7-year audit log retention (CloudTrail, AWS Config)
• Continuous monitoring and alerting
• Configuration management and drift detection
• Incident response capabilities
• FIPS 140-2 compliance throughout the stack

The FIPS 140-2 Challenge in AWS Public Cloud

Here's where it got complicated: at the time (late 2025), AWS Fargate did not support FIPS 140-2 in Commercial Cloud. FIPS-enabled Fargate was only available in AWS GovCloud.

Since we needed to deploy in AWS Public Cloud, we had to architect around this limitation.

The Solution: EC2-Based ECS with FIPS Compliance

After researching options with Amazon Q, we determined the path forward:

Architecture Decision

• AWS Fargate - No FIPS support in Commercial Cloud (rejected)
• ECS on EC2 with Amazon Linux 2023 FIPS-enabled AMI (selected)
• FIPS-enabled container images built on AL2023 FIPS base
• Bouncy Castle FIPS for Keycloak cryptographic operations

This became a critical architectural decision that Amazon Q helped me implement correctly.

How Amazon Q Helped Navigate FIPS Compliance

1. Understanding the FIPS Limitation

My initial prompt:

"I need to deploy ECS Fargate with FIPS 140-2 compliance for CJIS requirements. How do I enable FIPS mode on Fargate?"

Amazon Q's response identified the issue:

• Fargate FIPS is only available in GovCloud regions
• For Commercial Cloud, need EC2-based ECS with FIPS-enabled AMI
• Recommended Amazon Linux 2023 with FIPS mode enabled
• Explained container image requirements for FIPS compliance

This saved days of trial-and-error deployment attempts.

2. Designing the EC2-Based ECS Architecture

With the constraint identified, I asked:

"Create an ECS cluster using EC2 instances with Amazon Linux 2023 FIPS-enabled AMI. I need auto-scaling, proper IAM roles, and CloudWatch monitoring."

Amazon Q generated:

• ECS cluster configuration for EC2 launch type
• Launch template with AL2023 FIPS-enabled AMI
• Auto Scaling Group with proper capacity management
• IAM instance profile with ECS agent permissions
• User data script for ECS agent configuration
• CloudWatch Container Insights integration
• Proper security group configuration

Key configuration:

# Amazon Linux 2023 FIPS-enabled AMI
ami = "ami-xxxxx"  # AL2023 FIPS AMI for us-east-1

# User data to enable FIPS mode
user_data = <<-EOF
  #!/bin/bash
  # Enable FIPS mode
  fips-mode-setup --enable
  
  # Configure ECS agent
  echo "ECS_CLUSTER=${cluster_name}" >> /etc/ecs/ecs.config
  echo "ECS_ENABLE_CONTAINER_METADATA=true" >> /etc/ecs/ecs.config
  
  # Restart ECS agent
  systemctl restart ecs
EOF

3. FIPS-Enabled Container Images

Next challenge: ensuring containers themselves run in FIPS mode.

"How do I build container images that are FIPS 140-2 compliant for use with AL2023 FIPS-enabled EC2 instances?"

Amazon Q provided guidance:

• Use AL2023 FIPS-enabled base images
• Install FIPS-validated OpenSSL libraries
• Configure applications to use FIPS-approved algorithms
• Validate FIPS mode is active in containers

Dockerfile pattern:

# Use AL2023 FIPS-enabled base
FROM public.ecr.aws/amazonlinux/amazonlinux:2023

# Minimal runtime: Java, CA roots, crypto policies, curl (for healthcheck)
RUN dnf update -y && \
 dnf install -y \
 crypto-policies-scripts && \
 update-crypto-policies --set FIPS && \
 dnf clean all && \
 rm -rf /var/cache/dnf /var/cache/yum
   

4. The Keycloak FIPS Challenge

Keycloak (our identity provider) presented a unique challenge—it needed to run in strict FIPS mode for cryptographic operations.

"I need to configure Keycloak to run in strict FIPS mode using Bouncy Castle FIPS provider. How do I integrate this with my container image?"

Amazon Q helped me:

• Understand Bouncy Castle FIPS requirements
• Design artifact repository for FIPS libraries
• Configure Keycloak to use BC FIPS provider
• Set up proper Java security properties

Implementation:

• Created FIPS-compliant artifact repository in S3
• Stored Bouncy Castle FIPS JAR files with checksums
• Modified Keycloak container to include BC FIPS
• Configured Java security properties for FIPS mode

Keycloak FIPS configuration:

# Start with the official Keycloak image as our base
# This gives us Keycloak already installed and configured
FROM quay.io/keycloak/keycloak:26.4.5
# Enable health and metrics support
ENV KC_HEALTH_ENABLED=true
ENV KC_METRICS_ENABLED=true
ENV KC_HTTP_MANAGEMENT_SCHEME=http

# Pass this via command line or env variable
# DB URL, DB USERNAME, DB PASSWORD, KEYSTORE PASSWORD
# Copy your keycloak.conf file into the container
# This assumes keycloak.conf is in the same directory as this Dockerfile
# Copy your files
COPY keycloak.conf /opt/keycloak/conf/keycloak.conf
COPY server.bcfks /opt/keycloak/conf/server.bcfks
COPY *.jar /opt/keycloak/providers/
COPY kc.java.security /opt/keycloak/conf/

# Fix ownership + safe permissions in one go
USER root
RUN chown -R keycloak:root /opt/keycloak && \
    find /opt/keycloak/themes -type d -exec chmod 755 {} \; && \
    find /opt/keycloak/themes -type f -exec chmod 644 {} \; && \
    find /opt/keycloak/providers -type f -exec chmod 644 {} \;
RUN chmod 640 /opt/keycloak/conf/server.bcfks

# Switch back — Keycloak must run as 'keycloak'
USER keycloak

HEALTHCHECK --interval=60s --timeout=10s --start-period=120s --retries=3 \  CMD bash -c "{ printf 'HEAD /health/ready HTTP/1.0\r\n\r\n' >&0; grep 'HTTP/1.0 200'; } 0<>/dev/tcp/localhost/9000" || exit 1

# Build Keycloak with your configuration
# This optimizes Keycloak for faster startup
RUN /opt/keycloak/bin/kc.sh build --features=fips --fips-mode=strict

# Define what command runs when the container starts
ENTRYPOINT ["/opt/keycloak/bin/kc.sh"]

5. Artifact Repository for FIPS Components

To manage FIPS-compliant software distributions:

"Create a secure artifact repository for storing FIPS-validated libraries, Keycloak distributions, checksums, and SBOMs with versioning and encryption"

Amazon Q built:

• S3 bucket with KMS encryption
• Versioning for compliance tracking
• A folder structure:
  • keycloak/: FIPS-compatible Keycloak distributions
  • bouncycastle/fips/: BC FIPS cryptographic libraries
  • checksums/: SHA256 checksums for integrity verification
  • sbom/: Software Bill of Materials for supply chain security
• A bucket policy restricting access to a specific AWS account
• Access logging to CloudTrail

Security features:

• All objects encrypted with customer-managed KMS key
• Versioning enabled for audit trail
• HTTPS required for all operations
• Integration with CI/CD for automated builds

6. FedRAMP Moderate: 7-Year Audit Retention

For FedRAMP Moderate compliance:

"Configure CloudTrail with 7-year retention, KMS encryption, log file validation, and CloudWatch Logs integration for real-time monitoring"

Amazon Q implemented:

• CloudTrail with multi-region support
• S3 bucket with 2,555-day (7-year) lifecycle policy
• KMS encryption for all log files
• CloudWatch Logs for real-time analysis
• Log file validation for tamper detection
• AWS Config with compliance rules
• VPC Flow Logs with 90-day retention

Requirements addressed:

• 7-year audit log retention (our retention target; confirm your agency's requirement)
• Tamper-evident logging (CJIS requirement)
• Real-time monitoring (both frameworks)
• Configuration compliance tracking

7. Network Isolation for CJIS

CJIS requires strict network segmentation:

"Design network architecture with complete isolation—no internet access for workloads, all AWS service communication via VPC endpoints, and multi-layer security controls"

Amazon Q designed:

• 12 VPC endpoints (S3, ECR, Secrets Manager, CloudWatch, SES, KMS, SSM, STS, ECS)
• Zero internet access for EC2 instances and containers
• Security groups with deny-by-default egress:
  • Database: port 3306 only
  • VPC endpoints: port 443 only
  • Email service: port 587 only
• Network ACLs for stateless firewall protection
• VPC Flow Logs for network monitoring

Result: network isolation designed for CJIS requirements.

8. Encryption Everywhere

Both CJIS and FedRAMP require encryption at rest and in transit:

"Implement comprehensive encryption using FIPS 140-2 validated KMS keys for all data at rest, and TLS 1.2+ for all data in transit"

Amazon Q configured:

• 5 dedicated KMS keys, for S3, RDS, Secrets Manager, CloudWatch Logs, and EBS volumes
• TLS 1.2+ enforcement on ALB with FIPS-compliant cipher suites
• Database encryption with KMS for Aurora clusters
• Secrets encryption with automatic rotation

FIPS-compliant TLS policy:

ssl_policy = "ELBSecurityPolicy-TLS13-1-3-FIPS-2023-04"  # FIPS-compatible

9. Continuous Monitoring & Alerting

FedRAMP requires continuous monitoring:

"Create comprehensive CloudWatch monitoring with alarms for security events, performance issues, and compliance violations with SNS notifications"

Amazon Q created:

• 6 CloudWatch alarms: 5 for ECS memory utilization and 1 for ALB response time
• AWS Config rules for S3 encryption, RDS encryption, CloudTrail enabled, VPC security group rules, and EBS encryption
• SNS notifications for security team
• CloudWatch dashboards for operational visibility

What We Built

Requirements targeted: CJIS Security Policy, FedRAMP Moderate, and FIPS 140-2 cryptography. As noted at the top, meeting them in practice also depends on how the system is operated and assessed.

Lessons Learned

• Check service limits first. As of late 2025, FIPS-enabled Fargate was only available in AWS GovCloud, so Commercial Cloud meant ECS on EC2. Amazon Q flagged this on the first prompt, which saved days of troubleshooting.
• FIPS is per layer. Amazon Linux 2023 supports FIPS mode, but you must enable it explicitly in user data, and the container images must be FIPS-enabled too.
• Keycloak needs Bouncy Castle FIPS. Strict FIPS mode needs the BC FIPS provider and matching Java security properties. A managed artifact repository for those libraries is essential.
• VPC endpoints remove the internet dependency. That shrinks the attack surface, and it is what made the network isolation work.
• Compliance as code pays off. AWS Config rules check compliance continuously, CloudTrail gives a tamper-evident trail, and Terraform makes every deployment repeatable.

The Keycloak work was the hardest part. Amazon Q's guidance (use BC FIPS rather than standard Bouncy Castle, prioritize it in the Java security properties, set KC_FIPS_MODE=strict, and verify FIPS mode at runtime) got it running in strict FIPS mode in 2 days. On my own, I estimate that research and testing would have taken weeks.

Getting Started

If you're building infrastructure for CJIS or FedRAMP workloads:

1. Understand your requirements. Identify the technical controls (FIPS, encryption, logging, retention) and the AWS service limits that affect them, such as Fargate FIPS.
2. Design for compliance first. Don't retrofit it. Use Amazon Q to test architectural decisions against your requirements before you build.
3. Implement FIPS at every layer. In Commercial Cloud, that means ECS on EC2 with AL2023 FIPS; in GovCloud, FIPS-enabled Fargate is available. Verify FIPS mode in the OS, the containers, and the applications.
4. Automate compliance checks. AWS Config rules, CloudTrail, and CloudWatch alarms keep watching after go-live.
5. Document everything. Keep configuration history and audit evidence ready for your assessors.

The Bottom Line

FIPS 140-2 in AWS Commercial Cloud has real constraints. Amazon Q Developer helped me find them early, design around them, and implement the result in Terraform.

Project stats: 266 AWS resources in 11 Terraform modules, built part-time over about a month. I estimate that saved roughly two months of full-time effort.