Three holes in the partition wall

Tue, 31 Mar 2026 20:00:00 -0500

I assumed GovCloud was AWS with a different region code. I wrote a whole post about how wrong that was. The partition wall between commercial AWS and GovCloud is real — no shared IAM, no cross-partition role assumption, no federated identity, no common STS endpoints. An arn:aws: principal cannot see an arn:aws-us-gov: resource. They are separate universes connected by a billing relationship and nothing else.

Except that’s not quite true either. There are three holes in the wall, and I found them one at a time over the course of a month.

I assumed GovCloud was AWS with a different region code. It took two weeks to prove me wrong.

Wed, 11 Mar 2026 23:00:00 -0400

I needed a GovCloud account for a multi-tenant NIST compliance platform. I’d been running commercial AWS infrastructure for months — EKS, Terraform, tenant provisioning, the whole stack. GovCloud would be the same thing in a different region. That was the assumption. It lasted about four hours.

The account that doesn’t exist yet

My management account couldn’t call CreateGovCloudAccount. The API returned ConstraintViolationException with a message about not being “enabled for access to GovCloud” and no guidance on what that meant. I filed a support case. AWS enabled the permission two days later, and as a side effect created a standalone GovCloud account that had no relationship to my Organizations structure — an orphan floating in the partition with disconnected root credentials. I still had to find it and deal with it.

Govcloud on ferkakta.dev

Three holes in the partition wall

I assumed GovCloud was AWS with a different region code. It took two weeks to prove me wrong.

The account that doesn’t exist yet