# AWS Clarifies FedRAMP Regional Authorizations

AWS FedRAMP guidance distinguishes the stated certification levels for its regions: Class C for US East-West and Class D for GovCloud (US). For agencies and contractors evaluating AWS services, the regional distinction affects which inherited controls apply; customers must independently map inherited controls, document their responsibilities, and obtain their own agency authorization to operate (ATO). The guidance is procurement and compliance information, not legislation, and does not create new appropriations or statutory contracting requirements.

- Procurement teams should verify the certification level for the specific AWS region and service under consideration rather than assume that coverage is uniform across regions.
- Agencies and contractors using inherited controls must document which controls AWS provides and which remain their responsibility, then pursue the agency-specific ATO.
- The FedRAMP Certification Package, including Ongoing Certification Reports, can be requested through package-access@fedramp.gov.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cloud Services, Cybersecurity
**Published:** October 29, 2026

### Government Entities
- General Services Administration (GSA)
- FedRAMP Program Management Office (FedRAMP PMO)

### Vendors
- Amazon Web Services (AWS) (Cloud service provider with stated FedRAMP certifications for US East-West and GovCloud (US) regions)

### Sources
- [AWS FedRAMP: Certified Regions and Inheritance — CASRAI](https://casrai.org/guides/aws-fedramp) - CASRAI