Skip to main content
The FIPS Connector is a separate build of the Formal Connector for environments that require FIPS 140-3. It uses the Go Cryptographic Module and limits the Connector to approved cryptography.
Using this image does not make an entire deployment FIPS compliant. You must confirm that your operating environment and configuration meet your compliance requirements.

​
Pull the image

The FIPS image uses a separate formalco-prod-connector-fips repository. Use the same release tag across either registry. ECR images are available in us-east-1, us-west-1, and us-west-2. Both registries also publish a latest tag. For example, pull a versioned image from GCP Artifact Registry:
Use versioned tags in production so deployments remain reproducible.

​
Go Cryptographic Module

Formal does not maintain a separate validated cryptographic module. The FIPS Connector builds against the Go Cryptographic Module v1.26.0, frozen from Go 1.26, in FIPS 140-3 mode. In this mode, the Go module performs integrity checks and cryptographic self-tests. It uses a NIST SP 800-90A deterministic random bit generator. Go TLS also rejects protocol versions, cipher suites, signatures, and key exchanges that are not approved. Required key consistency tests can make some key generation operations slower. The image also directs AWS SDK calls to AWS FIPS service endpoints. The Go project lists v1.26.0 as pending CMVP review and covered by CAVP certificate A8028. See the Go FIPS 140-3 documentation for its current CMVP status, tested operating environments, and security policy.

​
Restrictions

The FIPS build removes features that depend on code outside the Go Cryptographic Module. It also rejects protocol options that require unapproved cryptography. Review these restrictions before replacing a standard Connector image. Existing resource or policy settings can prevent the FIPS Connector from starting or serving a connection.