AWS GovCloud looks like AWS. The console is the same. The APIs are the same. And then in your third day you find out that half of what you assumed doesn't work here. I designed a GovCloud posture for T-Mobile and here's what I wish somebody had said upfront.
What GovCloud actually is
Two isolated AWS regions (us-gov-west-1 and us-gov-east-1) physically separated from commercial AWS, staffed by US-persons-only, and designed to meet FedRAMP High, DoD IL4/IL5, ITAR, and CJIS requirements. Different account IDs. Different IAM identity space. Different pricing pages.
If you have a workload with data that touches US export controls, US federal contracts, or specific state/law-enforcement data, GovCloud is often the requirement, not the choice.
The services that aren't there yet
The GovCloud service list lags commercial by 6–24 months. As of writing:
- Newer services — many are GA in commercial but not in GovCloud. Bedrock, Q Business, AgentCore rolled out to GovCloud on a delayed schedule.
- Aurora Serverless v2 — arrived in GovCloud well after commercial.
- Some SDK features — occasionally a feature is available via console but not via CLI in GovCloud.
Rule of thumb: before designing anything, look up every service you plan to use in the GovCloud region service list. Not the AWS docs at large — the specific "AWS Services in Scope by Compliance Program" page for GovCloud.
The identity boundary
You cannot federate a commercial IAM identity into GovCloud. You need a separate root account, separate Organization, separate SSO tenant. If your engineers work in both commercial and GovCloud, they log in twice. This is by design and unchangeable.
The pattern that works: a central identity provider (Okta, Azure AD) with two applications — one federating to commercial AWS, one federating to GovCloud AWS. Users don't see two identity stores, they see two apps.
Networking
- Transit Gateway peering does not cross the commercial/GovCloud boundary. If you need connectivity, it's a Direct Connect or an IPsec VPN over the internet.
- Route53 hosted zones in GovCloud are separate from commercial. If you want a domain to work in both, you're running duplicate zones and reconciling records manually.
- CloudFront exists in GovCloud but is a separate distribution namespace.
Terraform / IaC
Terraform's AWS provider supports GovCloud regions but you need to explicitly set the partition to aws-us-gov in ARN construction. Half the community modules assume the aws partition and break silently. Vet every module you pull in.
Cost
Roughly 15–25% more expensive than commercial for the same services, largely due to the smaller footprint. Reserved Instances and Savings Plans exist in GovCloud but with a smaller selection.
The T-Mobile posture, briefly
The design was a multi-account GovCloud organization with the same landing-zone pattern as commercial — dedicated log-archive account, dedicated audit account, workload accounts per major system. Terraform-managed. What differed from a commercial LZ:
- Every S3 bucket had explicit ITAR-related tag policies enforced by SCP.
- All CloudTrail data was routed to a partition-appropriate log archive; no cross-partition replication.
- The DR posture was cross-region within GovCloud (us-gov-east-1 as DR to us-gov-west-1), not to commercial.
That last point is where teams get burned. You cannot casually replicate GovCloud data to commercial "just for backup." That's a compliance violation waiting to happen.
When you don't need GovCloud
- Your data is not export-controlled.
- Your customer is not a US federal agency or a state law-enforcement body.
- Your compliance requirement is HIPAA, PCI, or SOC2 — commercial AWS handles all of those without needing GovCloud.
Getting into GovCloud when you don't need to is expensive and slow. Don't over-index on compliance theatre.
Bottom line
GovCloud is a legitimate answer to a specific set of legal requirements. It is not a "more secure AWS." The security is comparable to commercial AWS with the same account controls. The value is legal isolation, not cryptographic isolation. Design for that reality.