AWS workspaces: Note on FIPS 140-2 endpoint encryption for FedRAMP/DoD SRG
Summary
Adds a note advising that organizations needing FedRAMP authorization or DoD SRG compliance decide on FIPS 140-2 Validated Mode endpoint encryption before creating WorkSpaces in the directory, because it can only be enabled later for a new directory or when all existing WorkSpaces already use it. Also changes "requirement" to "requirements".
Security assessment
The added note documents a compliance-driven endpoint encryption mode (FIPS 140-2 Validated Mode) and warns that the choice is effectively irreversible once WorkSpaces exist in the directory, steering administrators toward strong encryption for regulated workloads. It is security/compliance documentation and hardening guidance, not a response to a specific vulnerability or incident.
Evidence
+If your organization requires FedRAMP authorization or DoD SRG compliance, decide whether to use FIPS 140-2 Validated Mode endpoint encryption. Make this decision before you create WorkSpaces in this directory. You can enable it later only if the directory is new or all existing WorkSpaces already use it. For more information, see [Configure FedRAMP authorization or DoD SRG compliance for WorkSpaces Personal](./fips-encryption.html).
Diff
diff --git a/workspaces/latest/adminguide/register-deregister-directory.md b/workspaces/latest/adminguide/register-deregister-directory.md index b982b79..7a462c9 100644 --- a//workspaces/latest/adminguide/register-deregister-directory.md +++ b//workspaces/latest/adminguide/register-deregister-directory.md @@ -11 +11 @@ To allow WorkSpaces to use an existing Directory Service directory, you must reg -**Requirements:** To register a directory for use with WorkSpaces, it must meet the following requirement: +**Requirements:** To register a directory for use with WorkSpaces, it must meet the following requirements: @@ -52,0 +53,4 @@ After you've registered the Directory Service directory, you can create a person +###### Note + +If your organization requires FedRAMP authorization or DoD SRG compliance, decide whether to use FIPS 140-2 Validated Mode endpoint encryption. Make this decision before you create WorkSpaces in this directory. You can enable it later only if the directory is new or all existing WorkSpaces already use it. For more information, see [Configure FedRAMP authorization or DoD SRG compliance for WorkSpaces Personal](./fips-encryption.html). +