An AI coding agent for AWS GovCloud (US).

Your boundary, your ATO

Topsoil adds no Thazen-operated service to your system, so there is no vendor control plane to bring into scope. The authorization boundary and the ATO remain yours: Topsoil fits inside the account, the IAM policy and the network path you already document.

AWS describes AWS GovCloud (US) as isolated AWS Regions designed to allow U.S. government agencies and customers to move sensitive workloads into the cloud. It also notes that the overall security of your workloads is a shared responsibility. See AWS’s own pages for what GovCloud provides.

Setting it up in GovCloud

1. Deploy the account stack in your GovCloud region. It creates the context-library bucket, the user policy and the optional budget backstop.
2. Use the GovCloud IAM policy. Topsoil ships policy files for the arn:aws-us-gov partition. An arn:aws resource never matches in GovCloud, and the reverse is also true.
3. Enable model access. AWS documents this as a manual step: third-party models need access enabled in the linked commercial account as well as the GovCloud account, while Amazon’s own models need only the GovCloud step.
4. Enable both GovCloud regions. Bedrock’s us-gov. inference profiles span both GovCloud regions, but access is granted per region, so a model enabled in only one can fail when a request lands in the other. Topsoil ships a script that checks both and prints a console checklist per region.
5. Sign in with IAM, a named profile or IAM Identity Center, and run topsoil setup to pick the region and a default model and prove the connection works.

Which models are available

Model availability in AWS GovCloud (US) differs from commercial regions and changes over time. Topsoil shows only what your GovCloud account has enabled. Check AWS’s current list before you plan a rollout.

Model errors that say what to do

In the terminal, a failed model call prints what happened and what to fix, including a missing model subscription or a step that has to be done from the commercial AWS account.