From 7772b0e9e562eb73707eab9979f3666c01cd4cbe Mon Sep 17 00:00:00 2001
From: Kraig Eisenman <kraig.eisenman@yale.edu>
Date: Mon, 15 Dec 2025 13:48:19 -0500
Subject: [PATCH] Enable FIPS 140-3 compliance for RDS API

- Upgrade Go version from 1.23 to 1.24 for native FIPS 140-3 support
- Add GOFIPS140=v1.0.0 build flag to enable FIPS-compliant cryptography
- Configure AWS SDK to use FIPS endpoints via UseFIPSEndpoint setting

Go 1.24 includes native FIPS 140-3 support through the crypto/fips140
module, which uses AWS-LC (NIST Certificate #4631). This ensures all
cryptographic operations use FIPS 140-3 validated algorithms.

The UseFIPSEndpoint configuration directs all AWS API calls to FIPS
endpoints (e.g., rds-fips.us-east-1.amazonaws.com), ensuring end-to-end
FIPS compliance for Dedicated MySQL and PostgreSQL offerings.

Relates to: CLOUD-615
---
 docker/Dockerfile       | 6 +++++-
 docker/Dockerfile.local | 6 +++++-
 go.mod                  | 4 ++--
 pkg/session/session.go  | 5 +++--
 4 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/docker/Dockerfile b/docker/Dockerfile
index c3e0583..6e54bc4 100644
--- a/docker/Dockerfile
+++ b/docker/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.23.4-alpine as gobuff
+FROM golang:1.24-alpine as gobuff
 
 EXPOSE 3000
 
@@ -37,6 +37,10 @@ COPY go.sum .
 RUN go mod download
 ADD . .
 RUN go version
+
+# Enable FIPS 140-3 compliant cryptography
+ENV GOFIPS140=v1.0.0
+
 RUN buffalo build --static -o /bin/api --ldflags "-X github.com/YaleSpinup/rds-api/rdsapi.Version=$version -X github.com/YaleSpinup/rds-api/rdsapi.VersionPrerelease=$prerelease -X github.com/YaleSpinup/rds-api/rdsapi.GitHash=$githash -X github.com/YaleSpinup/rds-api/rdsapi.BuildStamp=$buildstamp"
 
 
diff --git a/docker/Dockerfile.local b/docker/Dockerfile.local
index 4e93bca..fb73f65 100644
--- a/docker/Dockerfile.local
+++ b/docker/Dockerfile.local
@@ -1,4 +1,4 @@
-FROM golang:1.23.4-alpine AS gobuff
+FROM golang:1.24-alpine AS gobuff
 
 EXPOSE 3000
 
@@ -31,6 +31,10 @@ COPY go.sum .
 RUN go mod download
 ADD . .
 RUN go version
+
+# Enable FIPS 140-3 compliant cryptography
+ENV GOFIPS140=v1.0.0
+
 RUN buffalo build --static -o /bin/api
 
 FROM alpine
diff --git a/go.mod b/go.mod
index 72d7d68..fa3217a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,8 @@
 module github.com/YaleSpinup/rds-api
 
-go 1.23
+go 1.24
 
-toolchain go1.23.4
+toolchain go1.24.0
 
 require (
 	github.com/YaleSpinup/apierror v0.1.5
diff --git a/pkg/session/session.go b/pkg/session/session.go
index 0f29cee..0b8ed62 100644
--- a/pkg/session/session.go
+++ b/pkg/session/session.go
@@ -29,8 +29,9 @@ func New(opts ...SessionOption) Session {
 	}
 
 	config := aws.Config{
-		Credentials: s.credentials,
-		Region:      aws.String(s.region),
+		Credentials:     s.credentials,
+		Region:          aws.String(s.region),
+		UseFIPSEndpoint: aws.FIPSEndpointStateEnabled,
 	}
 
 	sess := session.Must(session.NewSession(&config))