FedRAMP High Deployment Guide

FedRAMP High Deployment — Cloud Air-Gap Without USB

The Misconception

"Air-gap" for FedRAMP High doesn't mean physically disconnected. It means:

• No unauthorized egress — workloads can't phone home to arbitrary internet endpoints
• Controlled ingress — only authorized traffic from authorized sources
• Data sovereignty — data stays within the FedRAMP authorization boundary
• Supply chain control — all software artifacts verified and auditable

AWS GovCloud, Azure Government, and GCP Assured Workloads provide this. You never touch a USB drive.

How It Actually Works (No USB)

Arivaran Commercial Hub              FedRAMP Authorization Boundary
(SOC 2, commercial cloud)            (GovCloud / Azure Gov / GCP Assured)

┌──────────────────────┐             ┌──────────────────────────────────┐
│ Harbor Registry      │             │                                  │
│ (images, charts)     │─── IPsec ──→│ ECR/ACR/GAR (mirror)            │
│                      │  VPN or     │   All images scanned + signed   │
│ Hub API              │  PrivateLink│                                  │
│ (bootstrap, PKI)     │────────────→│ Satellite (EKS/AKS/GKE)        │
│                      │             │   step-ca (local PKI)           │
│                      │             │   CNPG+Citus (RDS or self-mgd) │
│                      │             │   S3/Blob/GCS (local storage)   │
│                      │             │   KuiperDesk services           │
│                      │             │                                  │
│                      │←── IPsec ───│ Heartbeat + metrics only        │
│                      │  (metadata  │ (no backup data crosses boundary)│
│                      │   only)     │                                  │
└──────────────────────┘             └──────────────────────────────────┘

Cloud-Specific Transfer Mechanisms (No USB)

AWS GovCloud

# values-fedramp-high-aws.yaml
cloud:
  provider: aws
  region: us-gov-west-1              # GovCloud region
  fipsEndpoints: true                 # Use FIPS 140-2 validated endpoints

registry:
  # ECR in GovCloud (replicated from commercial Harbor)
  host: "<account-id>.dkr.ecr.us-gov-west-1.amazonaws.com"
  mirror:
    source: "registry.arivaran.ai"
    target: "<govcloud-ecr>"
    replicationType: cross-account    # automatic, no USB

pki:
  provider: step-ca                   # local CA, not Let's Encrypt
  # ACM Private CA also available on GovCloud (FedRAMP authorized)
  # But step-ca gives us full control
  stepCA:
    enabled: true
    fipsMode: true                    # step-ca compiled with FIPS Go crypto

storage:
  backend: aws-s3
  s3:
    bucket: "kuiperdesk-<tenant>-govcloud"
    kmsKeyArn: "arn:aws-us-gov:kms:..."  # GovCloud KMS
    encryption: aws:kms               # SSE-KMS (FIPS 140-2 Level 3)
    objectLock: true                   # WORM for compliance retention

database:
  backend: rds
  rds:
    instanceClass: db.r6g.large
    engine: aurora-postgresql
    engineVersion: "15.4"
    encrypted: true
    kmsKeyArn: "arn:aws-us-gov:kms:..."
    fipsEndpoint: true
    multiAz: true                      # HA within GovCloud region

networking:
  # PrivateLink from commercial hub → GovCloud satellite
  hubConnection: privatelink
  privateLink:
    serviceName: "com.amazonaws.vpce.us-gov-west-1.vpce-svc-xxx"
  # No network overlay needed — PrivateLink provides private connectivity

Azure Government

# values-fedramp-high-azure.yaml
cloud:
  provider: azure
  region: usgovvirginia               # Azure Government region

registry:
  host: "<registry>.azurecr.us"       # Azure Gov ACR

database:
  backend: azure-postgresql
  azurePostgres:
    sku: GP_Standard_D2s_v3
    encrypted: true
    geoRedundantBackup: true

storage:
  backend: azure-blob
  azureBlob:
    accountName: "kuiperdesk<tenant>gov"
    encryption: microsoft-managed      # or customer-managed HSM keys
    immutableStorage: true             # legal hold / time-based retention

GCP Assured Workloads

True Air-Gap (USB Required — IL5/IL6/SCIF Only)

USB sneakernet is ONLY needed for:

• IL5/IL6 (Impact Level 5/6) — classified environments
• SCIF (Sensitive Compartmented Information Facility) — no network at all
• Submarine/ship — literally disconnected
• Field deployment — military forward operating base

For these, the USB/ISO bundle from our air-gap policy applies. But this is <1% of FedRAMP deployments.

How This Eases FedRAMP High Certification

What Auditors Check (and How We Pass)

What We Already Have vs What's Needed

FedRAMP Certification Path

1. Select sponsor — federal agency willing to use KuiperDesk (ATO sponsor)
2. Engage 3PAO — accredited assessor (e.g., Coalfire, Schellman, A-LIGN)
3. Prepare SSP — System Security Plan documenting all 325+ controls
4. Readiness assessment — 3PAO reviews SSP + architecture
5. Full assessment — 3PAO tests all controls (penetration test, config review)
6. Remediate — Fix any findings
7. Authorization — Agency ATO + FedRAMP PMO listing
8. Continuous monitoring — Monthly vulnerability scans, annual assessment

Estimated timeline: 6-12 months from engagement to P-ATO
Estimated cost: $300K-$500K (3PAO fees + remediation effort)

Our Architectural Advantages for FedRAMP

1. Satellite model = clean authorization boundary — customer data never leaves their GovCloud VPC. The hub (commercial) is a separate system with its own SOC 2.
2. Helm chart = deterministic baseline — CM-2 compliance is trivial: helm template outputs the exact expected state.
3. step-ca = FIPS crypto we control — no dependency on external CA (Let's Encrypt is NOT FedRAMP authorized).
4. Per-satellite intermediate CA — SC-12 key management is clean: each satellite has isolated PKI, revocable from hub.
5. Citus tenant isolation — even within a satellite, data is distributed by tenant_id. Multi-tenant Tier B/C satellites get row-level isolation.
6. Agent TPM identity — IA-2/IA-5 authenticator management: non-exportable hardware-bound keys, auto-rotating certificates.

Revision History