Evaluating ITAR workloads in US commercial AWS Regions

This article explains how a defense and aerospace customer determined that U.S. commercial AWS Regions can support ITAR-controlled export workloads when properly configured with encryption.

• ITAR permits unclassified technical data outside U.S. if end-to-end encrypted with FIPS 140-2 compliant cryptography
• Customer limited deployments to U.S. commercial AWS Regions with features storing data outside U.S. disabled
• Data must remain encrypted at rest and in transit; decryption occurs only during processing
• AWS KMS uses FIPS 140-3 Security Level 3 HSMs; operators cannot access plaintext key material
• Physical layer: inter-Region traffic automatically encrypted with AES-256
• Network layer: AWS PrivateLink and Nitro System provide transparent AES-256 GCM encryption
• Application layer: TLS 1.2/1.3 with AES-256 or AES-128 ciphers required
• EC2, Lambda, and EKS feature zero operator access design preventing data disclosure

Organizations should consult legal and compliance teams before deploying ITAR workloads on AWS commercial Regions.