Self-managed install & maintenance > Install and config > Advanced config > Security & access control > AWS FIPS endpoints

AWS FIPS endpoints¶

FedRAMP installations on AWS GovCloud must send AWS API calls (S3, STS, ECR, and others) to AWS FIPS endpoints (for example, s3-fips.us-gov-west-1.amazonaws.com instead of s3.us-gov-west-1.amazonaws.com).

The AWS SDKs used by DataRobot switch every client to the FIPS endpoint when the environment variable AWS_USE_FIPS_ENDPOINT is set to true. The following sections describe where to set the variable.

Note

Only set AWS_USE_FIPS_ENDPOINT when every AWS service DataRobot calls has a FIPS endpoint in your region. A client fails to connect when no FIPS endpoint exists for its service and region. See the AWS FIPS documentation for additional details.

Configure platform services¶

Add to global.extraEnvVars to enable the variable to every DataRobot service pod:

global:
  extraEnvVars:
    - name: AWS_USE_FIPS_ENDPOINT
      value: "true"

Helm replaces lists instead of merging them. If global.extraEnvVars is already set in your values, add this entry to the existing list.

Configure notebook sessions¶

Notebook session pods are created at runtime and don't receive global.extraEnvVars. Add the variable to the notebook operator values:

nbx-operator:
  notebookSession:
    extraEnvVars:
      - name: AWS_USE_FIPS_ENDPOINT
        value: "true"

Configure file storage (S3)¶

When S3_HOST is set, DataRobot connects to that host directly and AWS_USE_FIPS_ENDPOINT has no effect on file storage. To route AWS file storage API calls to FIPS endpoints, set S3_HOST to the S3 FIPS endpoint for your region:

global:
  filestore:
    type: s3
    environment:
      S3_HOST: s3-fips.us-gov-west-1.amazonaws.com
      S3_REGION: us-gov-west-1

See Object storage config for other S3 settings.

Limitations¶

Custom model, custom application, and other workloads that run on long-running services (LRS) don't receive these environment variables.