[InvaderFizz]

> You cannot, for example, allow AWS Govcloud to handle SSL termination for ECS.

Are you saying you can't terminate TLS at the ALB in FedRAMP high and instead have to terminate TLS at the node/pod level? That's the exact opposite interpretation that we have taken.

Yes, TLS all the way at every layer, but we explicitly terminate at the ALB first.

[y-curious]

We were explicitly told that terminating at the ALB was unacceptable by the 3PAO. We had to build NGINX+ into the containers to terminate there.

I think your approach is valid, and I would have preferred to do it that way. Whatever passes the audit, I guess.