How to Mount Amazon S3 Buckets in AWS GovCloud (US)

AWS GovCloud (US) is an isolated AWS partition for eligible U.S. customers. It is designed for sensitive data and regulated workloads with specific regulatory and compliance requirements.

AWS GovCloud (US) provides two Regions: AWS GovCloud (US-West) and AWS GovCloud (US-East). TntDrive supports Amazon S3 in both Regions.

Supported Amazon S3 endpoints

TntDrive uses the dual-stack regional endpoints shown below and selects the correct endpoint automatically. You do not need to enter an endpoint when adding an account.

Keep secure transfer enabled when working with sensitive or export-controlled data. The FIPS account type always uses HTTPS.

Before using TntDrive, you need an eligible AWS GovCloud (US) account and credentials created in the AWS GovCloud (US) partition.

Direct AWS customers can create an AWS GovCloud (US) account through a linked standard AWS account or AWS Organizations. Customers who purchase AWS services through an AWS Solution Provider or reseller should contact that provider. See the AWS GovCloud (US) account sign-up process.

Add an AWS GovCloud (US) account to TntDrive

1. Start TntDrive Dashboard and choose Accounts > Add new account...

   

2. The Add New Account dialog will open.

   Enter an account name and select the required account type.

   

3. Configure the selected account type:

   • Amazon S3 GovCloud - enter an Access Key ID and Secret Access Key issued in the AWS GovCloud (US) partition.
   • Amazon S3 GovCloud (FIPS 140-3) - enter the same GovCloud credentials. TntDrive sends Amazon S3 requests through the regional FIPS endpoint.
   • Amazon S3 GovCloud via EC2 IAM Role - use this type when TntDrive runs on an Amazon EC2 instance in AWS GovCloud (US) with an IAM role attached. Access keys do not need to be stored in TntDrive. See Access Amazon S3 from Amazon EC2 via an IAM role for details.
   • Amazon S3 GovCloud via AssumeRole - specify the Role ARN, optional External ID, and Source Account. A GovCloud IAM role ARN begins with arn:aws-us-gov:iam::, and the source account must provide credentials from the AWS GovCloud (US) partition. See Access Amazon S3 by assuming an IAM role for descriptions of these fields.
   • Amazon S3 GovCloud via Environment Variables - TntDrive reads the Access Key ID, Secret Access Key, and optional session token from AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. These variables must contain AWS GovCloud (US) credentials. See Load Amazon S3 credentials from environment variables for details.
   • Amazon S3 GovCloud via AWS Config or Credentials File - select an AWS config or shared credentials file and specify the profile containing the AWS GovCloud (US) credentials. See Load Amazon S3 credentials from an AWS config or credentials file for descriptions of the file and profile fields.

4. Keep Use secure transfer (SSL/TLS) enabled. This option is enforced for the FIPS account type.

5. Click Add new account.

You can now add a new mapped drive and select this account. All six GovCloud account types can be used with buckets in AWS GovCloud (US-West) and AWS GovCloud (US-East).