# Deploy in AWS GovCloud

URL: /deploy/aws-govcloud

Prepare an AWS GovCloud account with no internet egress, a customer-managed key, write-once storage for originals and PostgreSQL 16. Then install the signed release and confirm each panel on Hosting.



Foxborne deploys into your own AWS GovCloud account. Originals stay in your buckets under your key, and the deployment sends nothing outside your network. This page shows the example deployment from the console's **Hosting** page, what to prepare for the same layout and how to confirm it.

The same layout applies in a commercial AWS region, since Foxborne deploys into your AWS, AWS GovCloud or Azure Government account. In a commercial region, ARNs start with `arn:aws:` rather than `arn:aws-us-gov:`.

## The example deployment [#the-example-deployment]

The console's example dataset describes one deployment in AWS GovCloud (US-West), region `us-gov-west-1`. Its **Hosting** page draws each part inside a dashed line labeled with the account and region.

| Part                   | Example value                   | What it does                                                          |
| ---------------------- | ------------------------------- | --------------------------------------------------------------------- |
| Foxborne application   | 2 nodes, `m7i.xlarge`           | Serves the console on your network only                               |
| Workers                | 2 nodes, `c7i.2xlarge`          | Parse, align and run rules                                            |
| Inference node         | 1 node, `g4dn.2xlarge`, one GPU | Runs the [AI models](/concepts/ai-models). Optional                   |
| PostgreSQL 16          | Multi-AZ, in the VPC            | Holds events, notes, reports and the audit log                        |
| Original files         | `s3://hfr-foxborne-originals`   | SSE-KMS with the customer key. Object Lock, compliance mode, 7 years. |
| Reports and case files | `s3://hfr-foxborne-exports`     | SSE-KMS with the customer key. Kept 10 years.                         |
| Basemaps and elevation | `s3://hfr-foxborne-basemaps`    | SSE-KMS with the customer key. Kept until replaced.                   |
| Customer-managed key   | `alias/foxborne-evidence`       | AWS KMS, rotated yearly and automatically                             |
| Backups                | AWS Backup vault `hfr-foxborne` | Customer key. Daily, kept 35 days.                                    |
| Network                | No outbound internet            | Egress is denied at the VPC                                           |
| Identity and audit     | Your IdP and SIEM               | SAML assertions in. Audit events out over syslog with TLS.            |

<Callout type="note" title="Example values">
  These values come from the example dataset. The instance types, bucket names, retention periods and backup schedule describe one deployment, not sizing guidance or requirements.
</Callout>

## Before you start [#before-you-start]

* You need the **Admin** role in Foxborne to open **Hosting**. Admins manage hosting, keys and access.
* You need an AWS GovCloud account where you can create a VPC, KMS keys, S3 buckets, a PostgreSQL database and a backup vault.
* Your identity provider signs users in over SAML 2.0, and your SIEM accepts syslog over TLS inside your network.
* You have the signed release bundle, a `.fxb` file, for the version you install.

## Prepare the account [#prepare-the-account]

<Steps>
  <Step title="Build a VPC with no path out">
    Create the VPC without an internet gateway or a NAT gateway, so no route leads to the internet. Reach Amazon S3 through a gateway VPC endpoint, which keeps that traffic inside AWS. Workers that assume an IAM role to read a source bucket also need AWS STS, through an interface VPC endpoint.

    Keep the console private as well. Engineers reach it from your corporate network or VPN, over a private connection such as AWS Site-to-Site VPN or AWS Direct Connect. In the example, the status bar tooltip reads &#x2A;*No outbound internet. Egress is denied at the VPC.**
  </Step>

  <Step title="Create the customer-managed key">
    In AWS KMS, create a symmetric customer-managed key in the deployment's region and turn on automatic rotation. The example key is `alias/foxborne-evidence` and rotates yearly. Rotation keeps the key ID and every earlier version of the key material, so objects encrypted before a rotation stay readable.

    <Callout type="warning" title="The key controls the evidence">
      Disabling this key makes every stored original unreadable, to Foxborne as much as to anyone. Reports, case files and backups encrypted with it become unreadable too.
    </Callout>
  </Step>

  <Step title="Create the three buckets">
    Create the originals bucket with S3 Object Lock turned on, which also turns on versioning. Set its default retention to compliance mode. No user, including the root user, can then overwrite or delete a locked version before its retention ends.

    Create the exports and basemaps buckets, then set default encryption on all three to SSE-KMS with the customer key. In the example, originals are locked for 7 years. Reports and case files are kept for 10.
  </Step>

  <Step title="Create the database">
    Run PostgreSQL 16 inside the VPC, with its storage encrypted with the customer key. The example runs it Multi-AZ. On Amazon RDS, encryption is fixed when the instance is created, so choose the customer key then.
  </Step>

  <Step title="Set up backups">
    Keep backups in a vault encrypted with the customer key. The example uses an AWS Backup vault named `hfr-foxborne`, with a plan that backs up daily and keeps each backup 35 days. Set the schedule and retention your program requires.
  </Step>

  <Step title="Connect identity and audit">
    Foxborne signs users in through your identity provider over SAML 2.0 and provisions them over SCIM. Evidence marked export-controlled opens only for users whose identity provider asserts US person status, in the `usPerson` SAML attribute. The audit log streams to your SIEM over syslog with TLS, inside your network.

    [Single sign-on](/security/sso) and [SCIM provisioning](/security/scim) cover the settings on the Foxborne side.
  </Step>

  <Step title="Install the signed release">
    Each Foxborne release is one signed bundle, a `.fxb` file, with a software bill of materials. Foxborne checks the bundle's signature against the Foxborne release key before anything installs, and a bundle that does not match installs nothing.
  </Step>
</Steps>

## Check the result [#check-the-result]

Sign in through your identity provider and open **Hosting**. Compare each panel with the example below, with your own values in place of the example's.

| Panel                         | Field                 | Example value                                                                                                                               |
| ----------------------------- | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| Summary                       | **Mode**              | Self-hosted                                                                                                                                 |
| Summary                       | **Environment**       | AWS GovCloud (US-West)                                                                                                                      |
| Summary                       | **Version**           | 1.4.2, with **Signature verified**                                                                                                          |
| Summary                       | **Network**           | No outbound internet                                                                                                                        |
| Summary                       | **License**           | 8 of 40 seats, renews 30 Jun 2027                                                                                                           |
| Data boundary                 | Dashed line           | Your AWS GovCloud (US-West) account, its ID and `us-gov-west-1`                                                                             |
| Data boundary                 | Inside the line       | Foxborne application, workers, PostgreSQL 16, original files, customer-managed key, your IdP and SIEM                                       |
| Data boundary                 | Outside the line      | **Foxborne, Inc. receives nothing**                                                                                                         |
| Where each kind of data lives | Six rows              | One row per store, from original files to backups, each with location, encryption and retention                                             |
| Encryption key                | **Key**               | `alias/foxborne-evidence`                                                                                                                   |
| Encryption key                | **ARN**               | The key's ARN, starting `arn:aws-us-gov:kms:us-gov-west-1:`                                                                                 |
| Encryption key                | **Custody**           | AWS KMS, FIPS 140-3 validated HSMs                                                                                                          |
| Encryption key                | **Rotation**          | Yearly, automatic, last on 30 Jun 2026                                                                                                      |
| Updates                       | **Installed**         | 1.4.2, 12 Sep 2026                                                                                                                          |
| Updates                       | **Signed by**         | Foxborne release key 7C1E 4B90 3A2F 9A42                                                                                                    |
| Updates                       | **Bill of materials** | SPDX 2.3, 412 components, stored with the release                                                                                           |
| Nodes                         | Four rows             | Application 2 `m7i.xlarge`, workers 2 `c7i.2xlarge`, database 1 PostgreSQL 16 Multi-AZ, inference 1 `g4dn.2xlarge`, each **Healthy**        |
| Nodes                         | Footer                | **Last backup 7 h ago. Restore tested on 12 Sep 2026.**                                                                                     |
| Outbound connections          | Five rows             | Foxborne, Inc. **None**, map and tile services **None**, AI model providers **None**, identity provider **Inbound**, your SIEM **Internal** |

The **Custody** line names the service that holds the key. Its FIPS 140-3 validation belongs to the AWS KMS hardware security modules, not to Foxborne.

The status bar repeats the environment, **No outbound internet** and the version on every screen. The **Encryption key** panel also carries the note &#x2A;*Disabling this key makes every stored original unreadable, to Foxborne as much as to anyone.**

## Troubleshoot [#troubleshoot]

**Compliance mode cannot be undone.** Once a version is locked in compliance mode, nobody can shorten its retention or delete it before the period ends. Settle the retention period before the first original arrives.

**The key is disabled or scheduled for deletion.** Stored originals and exports stay unreadable until the key is back in service. A disabled key can be enabled again. AWS KMS waits 7 to 30 days before deleting a key, and you can cancel the deletion inside that window.

**The console is not reachable from outside your network.** That is the intended layout: the application serves the console on your network only. Connect over the VPN or from a network listed under **Access**, **Sign-in**, **Sessions**.

**Collectors cannot connect.** Each vehicle opens an outbound HTTPS connection to the deployment's address while it is on the ground. Give that address a route from the network the vehicles use, as in [Install and enroll the collector](/collect/collector/install).

## Next [#next]

* [Install an update](/deploy/upgrades) when the next signed bundle arrives.
* [Monitor a deployment](/deploy/operations) reads the same **Hosting** panels day to day.
* [Backups and recovery](/deploy/backup-and-restore) covers the vault and the checks after a restore.
* [Amazon S3 and S3-compatible storage](/collect/sources/amazon-s3) connects the bucket where flight logs already land.