(U) AWS_Prescriptive_Guidance_Secure_Cloud_Computing_Architecture-DoD.pdf

Secure Cloud Computing Architecture on AWS for the US Department of Defense

AWS Prescriptive Guidance

Copyright © 2025 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

UNCLASSIFIED

UNCLASSIFED

AWS Prescriptive Guidance Secure Cloud Computing Architecture on AWS for the US Department of Defense

AWS Prescriptive Guidance: Secure Cloud Computing Architecture on AWS for the US Department of Defense

Copyright © 2025 Amazon Web Services, Inc. and/or its affiliates. All rights reserved.

Amazon's trademarks and trade dress may not be used in connection with any product or service that is not Amazon's, in any manner that is likely to cause confusion among customers, or in any manner that disparages or discredits Amazon. All other trademarks not owned by Amazon are the property of their respective owners, who may or may not be affiliated with, connected to, or sponsored by Amazon.

Table of Contents

Introduction Intended audience

Overview of the Landing Zone Accelerator Planning your LZA deployment on AWS

SCCA components and requirements Cloud Access Point Virtual Data Center Security Stack Virtual Data Center Managed Services

Supplemental service integration Operating system patching

Trusted Cloud Credential Manager Conclusion and resources

AWS resources Other resources

Document history Glossary

A B C D E F G H I L M O P Q R S T iii

U V W Z iv

Secure Cloud Computing Architecture on AWS for the US Department of Defense

Rob Higareda and Rughved Gadgil, Amazon Web Services (AWS)

March 2024 (document history)

The US Department of Defense (DoD) segments cloud information into impact levels (ILs).

The impact level is associated with the sensitivity of the information and the risk of losing the confidentiality, integrity, or availability of that information. IL4 accommodates DoD Controlled Unclassified Information (CUI), and IL5 accommodates DoD CUI and National Security Systems (NSS) information. This guide is designed to help you build a landing zone that supports IL4 and IL5 information.

In order to build an IL4-compliant or IL5-compliant cloud infrastructure, you must build specific components. The Defense Information Systems Agency (DISA) Secure Cloud Computing Architecture (SCCA) is a selection of cloud security and management services. It provides a standardized approach for creating a cloud boundary. The SCCA also includes application-level security components for IL4 and IL5 information hosted in the cloud.

This guide helps you meet SCCA requirements by using the Landing Zone Accelerator (LZA) on AWS. The LZA solution deploys a foundational set of capabilities that is designed to align with AWS best practices and multiple global compliance frameworks. The LZA can help you create many of the components necessary to adhere to the DoD SCCA. This guide also recommends how you can add additional components for SCCA compliance and establish a secure foundation for your cloud environments on AWS. Although this guide doesn't include every potential situation, it provides guidance about how to get started and about which AWS services can help you meet SCCA requirements.

Intended audience

This guide is intended for individuals who need to comply with the DoD Secure Cloud Computing Architecture in order to help secure IL4 and IL5 information in the AWS Cloud. If you haven't done so already, review the DISA Cloud Computing Security Requirements Guide before reading this guide.

Intended audience 1

UNCLASSIFIED

UNCLASSIFIED

https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/ https://aws.amazon.com/solutions/implementations/landing-zone-accelerator-on-aws/ https://disa.mil/-/media/files/disa/news/events/symposium/cloud-computing-security-requirements-guide.ashx

Overview of the Landing Zone Accelerator

In order to build a landing zone in AWS that conforms to the Defense Information Systems Agency (DISA) Secure Cloud Computing Architecture (SCCA), you must have certain elements in place to help you meet the minimum requirements. AWS has created the Landing Zone Accelerator (LZA) to help you deploy a landing zone that conforms to the necessary requirements. Using the LZA solution, you can deploy the environment by using a set of configuration files. These configuration files help you focus on the delivery of an environment instead of learning each individual AWS service and how to deploy it.

The following image shows services involved in the LZA deployment. The numbers indicate the workflow, from modification of the configuration files to configuration of AWS services in the workload accounts.

UNCLASSIFIED

https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/solution-overview.html

This solution is architected to align with AWS best practices and conform to multiple global compliance frameworks. When used in coordination with services such as AWS Control Tower, this solution provides a comprehensive, low-code solution across more than 35 AWS services and features. Specifically, this solution helps you manage and govern a multi-account environment that is built to support highly-regulated workloads and complex compliance requirements. LZA helps you establish platform readiness with security, compliance, and operational capabilities. This guide includes specific notes regarding use of this solution to support alignment with United States (US) Federal and Department of Defense (DoD) guidance.

AWS provides the LZA solution as an open source project that was built by using the AWS Cloud Development Kit (AWS CDK) . You can install it directly into your environment, giving you full access to the infrastructure as code (IaC) solution.

Through a simplified set of configuration files, you can:

• Configure additional functionality, guardrails, and security services, such as AWS Config managed rules and AWS Security Hub.

• Manage your foundational networking topology through services such as Amazon Virtual Private Cloud (Amazon VPC), AWS Transit Gateway, and AWS Network Firewall.

• Generate additional workload accounts by using the AWS Control Tower Account Factory.

There are no additional charges or upfront commitments required to use Landing Zone Accelerator on AWS. You pay only for the AWS services that you turn on to set up your platform and operate your guardrails. This solution can also support non-standard AWS partitions, including the AWS GovCloud (US), AWS Secret, and AWS Top Secret Regions.

Important

The LZA solution does not, by itself, make you compliant. It provides the foundational infrastructure from which you can integrate additional complementary solutions. The information contained in the LZA implementation guide is not exhaustive. You must review, evaluate, assess, and approve the solution in compliance with your organization's particular security features, tools, and configurations. It is the sole responsibility of you and your organization to determine which regulatory requirements are applicable and to ensure that you comply with all requirements. Although this solution discusses both the technical and

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/solution-overview.html https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/united-states-us-federal-and-department-of-defense-dod.html https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/united-states-us-federal-and-department-of-defense-dod.html https://docs.aws.amazon.com/cdk/v2/guide/home.html https://docs.aws.amazon.com/cdk/v2/guide/home.html https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/controltower/latest/userguide/account-factory.html administrative requirements, this solution does not help you comply with the non-technical administrative requirements.

Planning your LZA deployment on AWS

AWS has created a detailed implementation guide for deploying the Landing Zone Accelerator (LZA) solution on AWS. For an architecture diagram and an overview of the deployment steps, see Architecture diagram in the Landing Zone Accelerator on AWS Implementation Guide. Your environment must meet prerequisites before deploying the solution. Using the requirements in the SCCA components and requirements chapter in this guide, you can choose between the deployment options that are described in the LZA implementation guide.

Planning your LZA deployment on AWS 4

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/solution-overview.html https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/architecture-diagram.html https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/prerequisites.html

SCCA components and requirements

The Defense Information Systems Agency (DISA) Secure Cloud Computing Architecture (SCCA), adopted by the US Department of Defense (DoD), is intended to be a scalable, cost-effective approach for securing cloud-based applications under a common security architecture. It provides a standard approach for securing IL4 and IL5 data in cloud environments. As described in the DISA SCCA fact sheet, the overarching components of the SCCA include:

• Cloud Access Point (CAP) – Provides access to the cloud, and protects DoD networks from the cloud. Streamlined protections focused on protecting the network boundary.

• Virtual Data Center Security Stack (VDSS) – Virtual network enclave security to protect applications and data in commercial cloud offerings.

• Virtual Data Center Managed Services (VDMS) – Application host security for privileged user access in commercial environments.

• Trusted Cloud Credential Manager (TCCM) – Cloud credential manager to enforce role-based access control (RBAC) and least-privileged access.

The following image shows these components of the SCCA.

UNCLASSIFIED

UNCLASSIFIED

https://www.disa.mil/~/media/files/disa/fact-sheets/secure-cloud-computing.pdf

This section discusses each component in detail and the corresponding components in the LZA that can help you adhere to the Defense Information Systems Agency (DISA) standard. The following image shows the LZA multi-account structure that builds the components of the SCCA within the AWS Cloud. This LZA multi-account structure is a foundation that helps you achieve an architecture that is fully compliant with DISA SCCA requirements. For an example of an architecture that helps you fully meet compliance requirements, see the SCCA on AWS GovCloud architecture diagram.

UNCLASSIFIED

https://d1.awsstatic.com/architecture-diagrams/ArchitectureDiagrams/dod-scca-multiaccount-ra.pdf

Cloud Access Point

The Boundary Cloud Access Point (BCAP) or Cloud Access Point (CAP) is predetermined by your organization. Therefore, it is not in the scope of this guide. The CAP provides access to commercial cloud environments from the Defense Information Systems Network (DISN). The CAP also provides boundary protection of DISN from the cloud. At the DISN boundary, it includes cyber-defense capabilities, such as firewall, intrusion detection systems (IDS), and intrusion prevention systems

Cloud Access Point 7

(IPS). It's common for organizations to use the DoD Cloud Native Access Point Reference Design for accessing AWS.

Virtual Data Center Security Stack

The purpose of the Virtual Data Center Security Stack (VDSS) is to protect DOD mission-owner applications that are hosted in AWS. The VDSS provides an enclave for security services. The VDSS performs the bulk of the security operations in the SCCA. This component contains security and network services, such as inbound connectivity access controls and perimeter protections services, including web application firewalls, DDOS protection, load balancers, and networking routing resources. The VDSS can reside in the cloud infrastructure or on premises, in your data center.

AWS or third-party vendors can provide VDSS capabilities through infrastructure as a service (IaaS), or AWS can offer these capabilities through software as a service (SaaS) solutions. For more information about the VDSS, see the DoD Cloud Computing Security Requirements Guide.

The following table contains the minimum requirements for the VDSS. It explains whether the LZA addresses each requirement and which AWS services you can use to meet these requirements.

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.1 The VDSS shall

maintain virtual separation of all management, user, and data traffic.

AWS Network Firewall

Network access control list (ACL)

Security groups for elastic network interfaces

Isolate VPCs Covered

2.1.2.2 The VDSS shall

allow the use of encryption for segmentation

Amazon VPC (Encrypt traffic between instances)

Encryption best practices for Amazon VPC

Covered

Virtual Data Center Security Stack 8

UNCLASSIFIED

UNCLASSIFIED

https://dodcio.defense.gov/Portals/0/Documents/Library/CNAP_RefDesign_v1.0.pdf https://public.cyber.mil/dccs/dccs-documents/ https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html#TGW_Scenarios https://docs.aws.amazon.com/vpc/latest/userguide/data-protection.html https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/vpc.html https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/vpc.html https://docs.aws.amazon.com/prescriptive-guidance/latest/encryption-best-practices/vpc.html

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA of management traffic.

2.1.2.3 The VDSS

shall provide a reverse proxy capability to handle access requests from client systems.

N/A Serving content using a fully managed reverse proxy

Not covered

2.1.2.4 The VDSS

shall provide a capability to inspect and filter application layer conversat ions based on a predefine d set of rules (including HTTP) to identify and block malicious content.

AWS WAF

Network Firewall

Web request body inspection

TLS traffic inspection with Network Firewall

Partially covered

2.1.2.5 The VDSS

shall provide a capability that can distingui sh and block unauthorized application layer traffic.

AWS WAF How to use Amazon GuardDuty and AWS WAF to automatically block suspicious hosts

Not covered

Virtual Data Center Security Stack 9

UNCLASSIFIED

UNCLASSIFIED

https://aws.amazon.com/blogs/architecture/serving-content-using-fully-managed-reverse-proxy-architecture/ https://aws.amazon.com/blogs/architecture/serving-content-using-fully-managed-reverse-proxy-architecture/ https://aws.amazon.com/blogs/architecture/serving-content-using-fully-managed-reverse-proxy-architecture/ https://aws.amazon.com/blogs/architecture/serving-content-using-fully-managed-reverse-proxy-architecture/ https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html https://docs.aws.amazon.com/waf/latest/developerguide/waf-oversize-request-components.html https://aws.amazon.com/blogs/security/tls-inspection-configuration-for-encrypted-traffic-and-aws-network-firewall/ https://aws.amazon.com/blogs/security/tls-inspection-configuration-for-encrypted-traffic-and-aws-network-firewall/ https://aws.amazon.com/blogs/security/tls-inspection-configuration-for-encrypted-traffic-and-aws-network-firewall/ https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/ https://aws.amazon.com/blogs/security/how-to-use-amazon-guardduty-and-aws-web-application-firewall-to-automatically-block-suspicious-hosts/

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.6 The VDSS

shall provide a capability that monitors network and system activitie s to detect and report malicious activities for traffic entering and exiting Mission Owner virtual private networks/ enclaves.

VPC Flow Logs

Amazon GuardDuty

AWS Nitro Enclaves

AWS Nitro Enclaves workshop

Partially covered

2.1.2.7 The VDSS

shall provide a capability that monitors network and system activitie s to stop or block detected malicious activity.

Network Firewall

AWS WAF

N/A Partially covered

Virtual Data Center Security Stack 10

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html https://docs.aws.amazon.com/enclaves/latest/user/nitro-enclave.html https://catalog.workshops.aws/nitro-enclaves/ https://catalog.workshops.aws/nitro-enclaves/ https://catalog.workshops.aws/nitro-enclaves/ https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.8 The VDSS shall

inspect and filter traffic traversin g between mission owner virtual private networks/ enclaves.

Network Firewall Deploy centraliz ed traffic filtering

Covered

2.1.2.9 The VDSS shall

perform break and inspectio n of SSL/TLS communication traffic supportin g single and dual authentic ation for traffic destined to systems hosted within the CSE.

Network Firewall Deploymen t models for Network Firewall

Covered

Virtual Data Center Security Stack 11

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/ https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/ https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/ https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/ https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/ https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.10 The VDSS

shall provide an interface to conduct ports, protocols , and service management (PPSM) activitie s in order to provide control for MCD operators.

Network Firewall Deploymen t models for Network Firewall

Covered

2.1.2.11 The VDSS

shall provide a monitoring capability that captures log files and event data for cybersecurity analysis.

Amazon CloudWatch

AWS CloudTrail

Logging for security incident response

Covered

Virtual Data Center Security Stack 12

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/ https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/ https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/ https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/logging-and-events.html https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/logging-and-events.html https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/logging-and-events.html

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.12 The VDSS shall

provide or feed security information and event data to an allocated archiving system for common collection, storage, and access to event logs by privileged users performing Boundary and Mission CND activities.

Amazon CloudWatch Logs

Security in CloudWatch Logs

Covered

Virtual Data Center Security Stack 13

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/security.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/security.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/security.html

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.13 The VDSS

shall provide a FIPS-140- 2 compliant encryption key managemen t system for storage of DoD generated and assigned server private encryption key credentials for access and use by the Web Application Firewall (WAF) in the execution of SSL/TLS break and inspectio n of encrypted communication sessions.

AWS Secrets Manager

AWS Key Management Service(AWS

KMS)

Enhance Amazon CloudFront origin security with AWS WAF and Secrets Manager

AWS KMS key management with FIPS 140-2

Not covered

2.1.2.14 The VDSS shall

provide the capability to detect and identify applicati on session hijacking.

N/A N/A Not covered

Virtual Data Center Security Stack 14

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html https://docs.aws.amazon.com/kms/latest/developerguide/overview.html https://docs.aws.amazon.com/kms/latest/developerguide/overview.html https://docs.aws.amazon.com/kms/latest/developerguide/overview.html https://docs.aws.amazon.com/kms/latest/developerguide/overview.html https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/how-to-enhance-amazon-cloudfront-origin-security-with-aws-waf-and-aws-secrets-manager/ https://aws.amazon.com/blogs/security/aws-key-management-service-now-offers-fips-140-2-validated-cryptographic-modules-enabling-easier-adoption-of-the-service-for-regulated-workloads/ https://aws.amazon.com/blogs/security/aws-key-management-service-now-offers-fips-140-2-validated-cryptographic-modules-enabling-easier-adoption-of-the-service-for-regulated-workloads/ https://aws.amazon.com/blogs/security/aws-key-management-service-now-offers-fips-140-2-validated-cryptographic-modules-enabling-easier-adoption-of-the-service-for-regulated-workloads/

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.15 The VDSS shall

provide a DoD DMZ Extension to support to support Internet Facing Applicati ons (IFAs).

N/A N/A Not covered

2.1.2.16 The VDSS

shall provide full packet capture (FPC) or cloud service equivalent FPC capabilit y for recording and interpret ing traversing communications.

Network Firewall

VPC Flow Logs

N/A Covered

2.1.2.17 The VDSS shall

provide network packet flow metrics and statistics for all traversing communications.

CloudWatch Monitor network throughput of interface VPC endpoints using CloudWatch

Covered

Virtual Data Center Security Stack 15

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/WhatIsCloudWatch.html https://aws.amazon.com/blogs/mt/monitor-network-throughput-of-interface-vpc-endpoints-using-amazon-cloudwatch/ https://aws.amazon.com/blogs/mt/monitor-network-throughput-of-interface-vpc-endpoints-using-amazon-cloudwatch/ https://aws.amazon.com/blogs/mt/monitor-network-throughput-of-interface-vpc-endpoints-using-amazon-cloudwatch/ https://aws.amazon.com/blogs/mt/monitor-network-throughput-of-interface-vpc-endpoints-using-amazon-cloudwatch/ https://aws.amazon.com/blogs/mt/monitor-network-throughput-of-interface-vpc-endpoints-using-amazon-cloudwatch/

ID VDSS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.2.18 The VDSS shall

provide for the inspection of traffic entering and exiting each mission owner virtual private network.

Network Firewall Deploy centraliz ed traffic filtering

Covered

There are components of the CAP that you define and that are not covered in this guide because each agency has their own CAP connection to AWS. You can supplement the components of the VDSS with the LZA in order to help inspect the traffic coming into AWS. The services used in the LZA provide boundary and internal traffic scanning to help secure your environment. In order to continue building a VDSS, there are some additional infrastructure components that are not included in the LZA.

By using virtual private cloud (VPCs), you can establish boundaries in each AWS account to help adhere to the SCCA standards. This isn't configured as part of the LZA because VPCs, IP addressing, and routing are components that you must set up as needed for your infrastructure. You can implement components such as Domain Name System Security Extensions (DNSSEC) in Amazon Route 53. You can also add AWS WAF or third-party, commercial WAFs to help you achieve necessary standards.

Additionally, to support requirement 2.1.2.7in the DISA SCCA, you can use GuardDuty and Network Firewall to help secure and monitor the environment for malicious traffic.

Virtual Data Center Managed Services

The purpose of Virtual Data Center Managed Services (VDMS) is to provide host security and shared data center services. The functions of VDMS can either run in the hub of your SCCA, or the mission owner can deploy parts of it in their own AWS accounts. This component can be provided within your AWS environment. For more information about the VDMS, see the DoD Cloud Computing Security Requirements Guide.

Virtual Data Center Managed Services 16

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/ https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/ https://aws.amazon.com/blogs/networking-and-content-delivery/deploy-centralized-traffic-filtering-using-aws-network-firewall/ https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html https://docs.aws.amazon.com/guardduty/latest/ug/what-is-guardduty.html https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://docs.aws.amazon.com/network-firewall/latest/developerguide/what-is-aws-network-firewall.html https://public.cyber.mil/dccs/dccs-documents/

The following table contains the minimum requirements for the VDMS. It explains whether the LZA addresses each requirement and which AWS services you can use to meet these requirements.

ID VDMS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.3.1 The VDMS shall

provide Assured Compliance Assessment Solution (ACAS), or approved equivalent, to conduct continuous monitoring for all enclaves within the CSE.

AWS Config

AWS Security Hub

AWS Audit Manager

Amazon Inspector

Vulnerabi lity scanning with Amazon Inspector

Partially covered

2.1.3.2 The VDMS shall

provide Host Based Security System (HBSS), or approved equivalent, to manage endpoint security for all enclaves within the CSE.

N/A N/A Not covered

2.1.3.3 The VDMS

shall provide identity services to include an Online Certificate

Multi-factor authentication (MFA) available through:

Configure a CAC card for Amazon WorkSpaces

Partially covered

Virtual Data Center Managed Services 17

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html https://docs.aws.amazon.com/audit-manager/latest/userguide/what-is.html https://docs.aws.amazon.com/audit-manager/latest/userguide/what-is.html https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html https://catalog.us-east-1.prod.workshops.aws/secure-windows/en-US/vulnerability-management/inspector https://catalog.us-east-1.prod.workshops.aws/secure-windows/en-US/vulnerability-management/inspector https://catalog.us-east-1.prod.workshops.aws/secure-windows/en-US/vulnerability-management/inspector https://catalog.us-east-1.prod.workshops.aws/secure-windows/en-US/vulnerability-management/inspector https://docs.aws.amazon.com/workspaces/latest/adminguide/smart-cards.html https://docs.aws.amazon.com/workspaces/latest/adminguide/smart-cards.html https://docs.aws.amazon.com/workspaces/latest/adminguide/smart-cards.html

ID VDMS security requirement

AWS technolog ies

Additional resources

Covered by LZA

Status Protocol (OCloud Workload Security) responder for remote system DoD Common Access Card (CAC) two-facto r authentic ation of DoD privileged users to systems instantiated within the CSE.

AWS Identity and Access Management

(IAM)

AWS IAM

Identity Center

AWS Directory Service for Microsoft Active Directory

AWS Private Certificate Authority

2.1.3.4 The VDMS

shall provide a configuration and update management system to serve systems and applications for all enclaves within the CSE.

AWS Systems Manager Patch Manager

AWS Config

Automatin g patch managemen t with AWS Systems Manager (YouTube video)

Partially covered

Virtual Data Center Managed Services 18

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html https://docs.aws.amazon.com/privateca/latest/userguide/PcaWelcome.html https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html https://docs.aws.amazon.com/config/latest/developerguide/WhatIsConfig.html https://www.youtube.com/watch?v=1bLJdJ4zryU https://www.youtube.com/watch?v=1bLJdJ4zryU https://www.youtube.com/watch?v=1bLJdJ4zryU https://www.youtube.com/watch?v=1bLJdJ4zryU https://www.youtube.com/watch?v=1bLJdJ4zryU https://www.youtube.com/watch?v=1bLJdJ4zryU

ID VDMS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.3.5 The VDMS

shall provide logical domain services to include directory access, directory federation, Dynamic Host Configuration Protocol (DHCP), and Domain Name System (DNS) for all enclaves within the CSE.

AWS Managed Microsoft AD

Amazon Virtual Private Cloud (Amazon VPC)

Amazon Route 53

Configure DNS attributes for your VPC

Partially covered

2.1.3.6 The VDMS

shall provide a network for managing systems and applications within the CSE that is logically separate from the user and data networks.

Amazon VPC

Amazon VPC subnets

N/A Covered

Virtual Data Center Managed Services 19

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/Welcome.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html https://docs.aws.amazon.com/vpc/latest/userguide/what-is-amazon-vpc.html https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html https://docs.aws.amazon.com/vpc/latest/userguide/configure-subnets.html

ID VDMS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.3.7 The VDMS

shall provide a system, security, application, and user activity event logging and archiving system for common collection, storage, and access to event logs by privileged users performing BCP and MCP activities.

AWS Security Hub

AWS CloudTrail

Amazon CloudWatch Logs

Amazon Simple Storage Service (Amazon S3)

Centralized Logging with OpenSearch

Covered

Virtual Data Center Managed Services 20

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html https://aws.amazon.com/solutions/implementations/centralized-logging-with-opensearch/ https://aws.amazon.com/solutions/implementations/centralized-logging-with-opensearch/ https://aws.amazon.com/solutions/implementations/centralized-logging-with-opensearch/

ID VDMS security requirement

AWS technolog ies

Additional resources

Covered by LZA

2.1.3.8 The VDMS shall

provide for the exchange of DoD privileged user authentic ation and authoriza tion attribute s with the CSP's Identity and access managemen t system to enable cloud system provision ing, deploymen t, and configura tion.

AWS Managed Microsoft AD

Enhance your AWS Managed Microsoft AD security configuration

Not covered

2.1.3.9 The VDMS shall

implement the technical capabilities necessary to execute the mission and objectives of the TCCM role.

AWS Managed Microsoft AD

IAM

IAM Identity Center

N/A Partially covered

As shown in the following image, the LZA lays the foundational components to meet the VDMS base requirements. There are some additional components that you need to configure after the

Virtual Data Center Managed Services 21

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_network_security.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_network_security.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_network_security.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_network_security.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_network_security.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html

LZA is deployed to help you meet VDMS standards. In the previous table, make sure that you review the links in the Additional resources column. These links either help you configure these additional items or provide further security enhancements.

Supplemental service integration

The Additional resources column of the previous table lists resources to help you expand on the LZA to meet VDMS requirements. AWS additionally offers some workshop materials to help you configure a secure cloud architecture. Without modification, the LZA meets the IL4/ IL5 requirements, but you can deploy additional services to enhance the security of your AWS environment.

Supplemental service integration 22

For example, Amazon Inspector is a vulnerability management service that continuously scans your AWS workloads for software vulnerabilities and unintended network exposure. You can use it to identify and investigate vulnerabilities in host operating systems, such as Windows and Linux. Although Amazon Inspector might not fully incorporate all necessary requirements for an Host Based Security System (HBSS), it at least provides a base-level vulnerability assessment of instances.

Operating system patching

Operating system patching is a core component of operating a secure environment. AWS offers and recommends using Patch Manager, a capability of AWS Systems Manager, to maintain consistent patch baselines and automate patch deployment. Patch Manager automates the process of patching managed nodes with both security-related updates and other types of updates.

You can use Patch Manager to apply patches for both operating systems and applications. (On Windows Server, application support is limited to updates for applications released by Microsoft.)

For more information, see Orchestrating multi-step, custom patch processes using AWS Systems Manager Patch Manager on the AWS Cloud Operations and Migrations Blog.

For step-by-step instructions on using Patch Manager, see the AWS Management and Governance Tools Workshop.

For more information about securing Microsoft Windows workloads on AWS, see the Securing Windows Workloads on AWS Workshop.

Trusted Cloud Credential Manager

The Trusted Cloud Credential Manager (TCCM) is a component of the SCCA. It is responsible for credential management. When establishing the TCCM, it's important to allow least-privilege access to the SCCA. This can be accomplished by using AWS identity and access management services. An additional component of the TCCM is a connection to the Virtual Data Center Managed Services (VDMS). You can use this connection as needed to access the AWS Management Console to manage the TCCM.

The TCCM is a combination of both technologies and standards that govern access to AWS. The TCCM is considered critical for most implementations because it controls access permissions.

The TCCM function is not intended to place unique identity management requirements upon the

Operating system patching 23

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/systems-manager/latest/userguide/patch-manager.html https://aws.amazon.com/blogs/mt/orchestrating-custom-patch-processes-aws-systems-manager-patch-manager/ https://aws.amazon.com/blogs/mt/orchestrating-custom-patch-processes-aws-systems-manager-patch-manager/ https://mng.workshop.aws/ssm/use-case-labs/inventory_patch_management/patch.html https://mng.workshop.aws/ssm/use-case-labs/inventory_patch_management/patch.html https://catalog.us-east-1.prod.workshops.aws/secure-windows https://catalog.us-east-1.prod.workshops.aws/secure-windows commercial cloud service provider (CSP). The TCCM also does not prohibit the use of DoD CSP federation or third-party identity broker solutions to provide the intended identity control.

The TCCM policy components are based on a general understanding that CSPs offer an identity and access management system that allows control of access to cloud systems. Such systems can include the CSP's access console, API, and command-line interface (CLI) service components. At the base level, the TCCM must lock down credentials that can be used to create unauthorized networks and other resources. The TCCM is appointed by the Authorizing Official (AO) charged with oversight of IT systems. The TCCM policies establish the need for a least-privilege access model. These policies are responsible for the provision and control of privileged user credentials in the commercial cloud. This is to stay in alignment with the DoD Cloud Computing Security Requirements Guide, which addresses the implementation of policies, plans, and procedures for managing your portal account credentials. Prior to connection to the Defense Information Systems Network (DISN), DISA validates the existence of the Cloud Credential Management Plan (CCMP) as part of the connection approval process defined in the Connection Process Guide.

The following table contains the minimum requirements for the TCCM. It explains whether the LZA addresses each requirement and which AWS services you can use to meet these requirements.

ID TCCM security requirements

AWS technolog ies

Additional resources

Covered by LZA

2.1.4.1 The TCCM shall

develop and maintain a Cloud Credentia l Management Plan (CCMP)to address the implement ation of policies, plans, and procedures that will be applied to mission owner customer portal account

N/A N/A Not covered

Trusted Cloud Credential Manager 24

UNCLASSIFIED

UNCLASSIFIED

https://public.cyber.mil/dccs/dccs-documents/ https://dl.dod.cyber.mil/wp-content/uploads/connect/CPG/ConnProcGuide.html

ID TCCM security requirements

AWS technolog ies

Additional resources

Covered by LZA credential management.

2.1.4.2 The TCCM shall

collect, audit, and archive all Customer Portal activity logs and alerts.

AWS CloudTrail

Amazon CloudWatch Logs

N/A Covered

2.1.4.3 The TCCM shall

ensure activity log alerts are shared with, forwarded to, or retrievable by DoD privileged users engaged in MCP and BCP activities.

AWS CloudTrail

CloudWatch Logs

Amazon Simple Notification Service (Amazon

SNS)

CloudWatch Logs Insights

N/A Covered

2.1.4.4 The TCCM shall, as necessary for information sharing, create log repository access accounts for access to activity log data by privileged users performin g both MCP and BCP activities.

AWS CloudTrail

CloudWatch Logs

Amazon SNS

CloudWatch Logs Insights

N/A Covered

Trusted Cloud Credential Manager 25

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/sns/latest/dg/welcome.html https://docs.aws.amazon.com/sns/latest/dg/welcome.html https://docs.aws.amazon.com/sns/latest/dg/welcome.html https://docs.aws.amazon.com/sns/latest/dg/welcome.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/WhatIsCloudWatchLogs.html https://docs.aws.amazon.com/sns/latest/dg/welcome.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AnalyzingLogData.html

ID TCCM security requirements

AWS technolog ies

Additional resources

Covered by LZA

2.1.4.5 The TCCM shall

recover and securely control customer portal account credentials prior to mission application connectivity to the DISN.

AWS IAM

Identity Center

N/A Covered

2.1.4.6 The TCCM shall

create, issue, and revoke, as necessary, role based access least privilege d customer portal credentia ls to mission owner applicati on and system administr ators (i.e., DoD privileged users).

AWS Identity and Access Management

(IAM)

AWS Directory Service for Microsoft Active Directory

N/A Covered

In order to enable the TCCM to meet requirements, the LZA uses programmatic control of resources through the IAM service. You can additionally combine IAM with AWS Managed Microsoft AD to implement single sign-on to another directory. This ties your AWS environment to your on-premises infrastructure with Active Directory trusts. In the LZA, the implementation is deployed

Trusted Cloud Credential Manager 26

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html https://docs.aws.amazon.com/singlesignon/latest/userguide/what-is.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html with IAM roles for temporary, session-based access IAM roles are short-lived credentials that help your organization meet the necessary TCCM requirements.

Although the LZA implements least privilege access and programmatic, short-term access to AWS resources, review the IAM best practices to ensure that you follow the recommended security guidance.

For more information about implementing AWS Managed Microsoft AD, see the AWS Managed Microsoft AD section of the Active Directory on AWS Immersion Day workshop.

The AWS shared responsibility model applies to the TCCM and the LZA. The LZA builds the foundational aspects of access control, but each organization is responsible for the configuration of their security controls.

Trusted Cloud Credential Manager 27

UNCLASSIFIED

UNCLASSIFIED

https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html https://catalog.workshops.aws/ad-id/en-US/1-aws-managed-microsoft-ad/deploymgmt https://catalog.workshops.aws/ad-id/en-US/1-aws-managed-microsoft-ad/deploymgmt https://aws.amazon.com/compliance/shared-responsibility-model/

Conclusion and resources

For the US Department of Defense (DoD), this guide explains what the Defense Information Systems Agency (DISA) requirements are for deploying a Secure Cloud Computing Architecture…