Deploy in AWS GovCloud

Foxborne deploys into your own AWS GovCloud account. Originals stay in your buckets under your key, and the deployment sends nothing outside your network. This page shows the example deployment from the console's Hosting page, what to prepare for the same layout and how to confirm it.

The same layout applies in a commercial AWS region, since Foxborne deploys into your AWS, AWS GovCloud or Azure Government account. In a commercial region, ARNs start with arn:aws: rather than arn:aws-us-gov:.

The example deployment#

The console's example dataset describes one deployment in AWS GovCloud (US-West), region us-gov-west-1. Its Hosting page draws each part inside a dashed line labeled with the account and region.

Before you start#

• You need the Admin role in Foxborne to open Hosting. Admins manage hosting, keys and access.
• You need an AWS GovCloud account where you can create a VPC, KMS keys, S3 buckets, a PostgreSQL database and a backup vault.
• Your identity provider signs users in over SAML 2.0, and your SIEM accepts syslog over TLS inside your network.
• You have the signed release bundle, a .fxb file, for the version you install.

Prepare the account#

1. 01

   Build a VPC with no path out

   Create the VPC without an internet gateway or a NAT gateway, so no route leads to the internet. Reach Amazon S3 through a gateway VPC endpoint, which keeps that traffic inside AWS. Workers that assume an IAM role to read a source bucket also need AWS STS, through an interface VPC endpoint.

   Keep the console private as well. Engineers reach it from your corporate network or VPN, over a private connection such as AWS Site-to-Site VPN or AWS Direct Connect. In the example, the status bar tooltip reads No outbound internet. Egress is denied at the VPC.

2. 02

   Create the customer-managed key

   In AWS KMS, create a symmetric customer-managed key in the deployment's region and turn on automatic rotation. The example key is alias/foxborne-evidence and rotates yearly. Rotation keeps the key ID and every earlier version of the key material, so objects encrypted before a rotation stay readable.

   The key controls the evidence

   Disabling this key makes every stored original unreadable, to Foxborne as much as to anyone. Reports, case files and backups encrypted with it become unreadable too.

3. 03

   Create the three buckets

   Create the originals bucket with S3 Object Lock turned on, which also turns on versioning. Set its default retention to compliance mode. No user, including the root user, can then overwrite or delete a locked version before its retention ends.

   Create the exports and basemaps buckets, then set default encryption on all three to SSE-KMS with the customer key. In the example, originals are locked for 7 years. Reports and case files are kept for 10.

4. 04

   Create the database

   Run PostgreSQL 16 inside the VPC, with its storage encrypted with the customer key. The example runs it Multi-AZ. On Amazon RDS, encryption is fixed when the instance is created, so choose the customer key then.

5. 05

   Set up backups

   Keep backups in a vault encrypted with the customer key. The example uses an AWS Backup vault named hfr-foxborne, with a plan that backs up daily and keeps each backup 35 days. Set the schedule and retention your program requires.

6. 06

   Connect identity and audit

   Foxborne signs users in through your identity provider over SAML 2.0 and provisions them over SCIM. Evidence marked export-controlled opens only for users whose identity provider asserts US person status, in the usPerson SAML attribute. The audit log streams to your SIEM over syslog with TLS, inside your network.

   Single sign-on and SCIM provisioning cover the settings on the Foxborne side.

7. 07

   Install the signed release

   Each Foxborne release is one signed bundle, a .fxb file, with a software bill of materials. Foxborne checks the bundle's signature against the Foxborne release key before anything installs, and a bundle that does not match installs nothing.

Check the result#

Sign in through your identity provider and open Hosting. Compare each panel with the example below, with your own values in place of the example's.

The Custody line names the service that holds the key. Its FIPS 140-3 validation belongs to the AWS KMS hardware security modules, not to Foxborne.

The status bar repeats the environment, No outbound internet and the version on every screen. The Encryption key panel also carries the note Disabling this key makes every stored original unreadable, to Foxborne as much as to anyone.

Troubleshoot#

Compliance mode cannot be undone. Once a version is locked in compliance mode, nobody can shorten its retention or delete it before the period ends. Settle the retention period before the first original arrives.

The key is disabled or scheduled for deletion. Stored originals and exports stay unreadable until the key is back in service. A disabled key can be enabled again. AWS KMS waits 7 to 30 days before deleting a key, and you can cancel the deletion inside that window.

The console is not reachable from outside your network. That is the intended layout: the application serves the console on your network only. Connect over the VPN or from a network listed under Access, Sign-in, Sessions.

Collectors cannot connect. Each vehicle opens an outbound HTTPS connection to the deployment's address while it is on the ground. Give that address a route from the network the vehicles use, as in Install and enroll the collector.

Next#

• Install an update when the next signed bundle arrives.
• Monitor a deployment reads the same Hosting panels day to day.
• Backups and recovery covers the vault and the checks after a restore.
• Amazon S3 and S3-compatible storage connects the bucket where flight logs already land.