{"resourceId":"aws-bedrock-models-fedramp-il-status-no-5-2-listing-20261109","versions":[{"version":"external-634640bbc8712dafeacf4eee6047847aef8330cd501be10a6a2368479df5cd16","resource":{"id":"aws-bedrock-models-fedramp-il-status-no-5-2-listing-20261109","title":"AWS's Bedrock FedRAMP and DoD IL4/IL5 model status page, updated November 9, lists Anthropic models through Fable 5.1 but not Fable 5.2 or Mythos 5.2","organization":"Amazon Web Services","sector":"Cross-SLED compliance / government cloud authorization","geography":"United States (commercial US East/West and GovCloud (US))","publishedAt":"2026-11-09","publicationDate":"2026-11-09","eventDate":"2026-11-09","sourceName":"AWS Compliance","sourceLabel":"Amazon Bedrock models - FedRAMP and DoD CSP SRG (IL4/IL5) certification status","sourceUrl":"https://aws.amazon.com/compliance/services-in-scope/FedRAMP/amazon-bedrock-models/","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["governance-procurement","data-security"],"finding":"AWS's model-level authorization page for Bedrock shows 'Last updated: November 9, 2026' and a table of model families against U.S. East/West (FedRAMP Class C), GovCloud (FedRAMP Class D) and DoD IL4/IL5 columns. At retrieval, the Anthropic rows ran from Claude 3 Haiku through 'Fable 5.1'; neither Fable 5.2 nor Mythos 5.2 appeared on the page, even though both were announced for GovCloud the same day. The AWS GovCloud Bedrock user guide (also opened) points customers to this page for FedRAMP Class D and IL approvals.","sledRelevance":"For state agencies and universities that require FedRAMP or StateRAMP-aligned authorization per model, GovCloud availability is not the same as an authorization listing. Compliance teams should check this page before approving the newly available models.","evidence":"Vendor compliance documentation observed at a point in time. The absence of a listing was checked by text search of the retrieved page; it does not prove the models will not be authorized later.","architectureImplications":"Authorization is tracked per model, not per service, so platform teams need model-level allow-lists in Bedrock (for example via IAM or service control policies).","governanceImplications":"Supports a governance rule: only models listed for the required authorization level may process regulated data. The page may lag announcements.","securityPrivacyImplications":"Using an unlisted model for regulated data could fall outside an agency's authorization boundary.","caveats":"Point-in-time observation of a page that may be updated soon; the text extraction did not let us map each 'X' to a specific column, so no claim is made about Fable 5.1's exact authorization levels.","streamIds":["aws"],"roles":{"sales":"Interpretation: this protects both the customer and us from overpromising. The problem is that announcements of GovCloud availability are easily read as compliance approval. Stakeholders are compliance officers, ATO authorizers and CIOs. Discovery should ask which authorization level the workload needs and whether the agency's policy requires per-model listing. Present the new models as available for evaluation, not as authorized for regulated data, until the listing changes. Do not claim any authorization status for Fable 5.2 or Mythos 5.2.","engineering":"Interpretation: engineers should enforce model-level allow-lists tied to this page. In Bedrock that means restricting model IDs through IAM policies or service control policies so only listed models can process regulated data. Prerequisites are an agreed authorization requirement per workload and an owner who tracks page updates. The constraint is that availability and authorization may diverge for days or longer. A proof of value is an automated check that compares allowed model IDs with the current listing.","delivery":"Interpretation: delivery should add a model-authorization checkpoint to the AI intake process. Dependencies are the compliance team's interpretation of required levels and a maintained allow-list. Ownership sits with the cloud governance or compliance function. Governance checkpoints include re-checking the page whenever a model is requested and documenting the authorization level used in the ATO. Proposed acceptance criteria: no unlisted model reachable from regulated accounts. The risk is quietly adopting an announced model before it is listed."},"roleDetails":{"sales":{"customerProblem":"Agencies may read GovCloud model availability as equivalent to FedRAMP/IL authorization.","stakeholders":["Compliance officer / ATO authorizer","Agency CIO","Cloud governance lead"],"discoveryQuestions":["Which authorization level does each AI workload require?","Does policy require per-model authorization listing?","Who monitors the listing for changes?"],"valueHypothesis":"A model-level allow-list tied to the authorization page reduces compliance risk when new models launch.","potentialEngagement":"Model-authorization guardrail setup for Bedrock accounts.","unsupportedClaims":["Any authorization status for Fable 5.2 or Mythos 5.2","Timing of future listings"]},"engineering":{"fit":"Strong fit as a governance control for regulated Bedrock workloads.","architectureIntegration":"IAM/SCP restrictions on Bedrock model IDs aligned to the authorization listing.","prerequisites":["Per-workload authorization requirement","Owner for listing updates","SCP/IAM policy management"],"constraints":["Listing may lag announcements","Column mapping must be read on the live page"],"security":"Prevents regulated data from reaching models outside the authorization boundary.","proofOfValue":["Automated comparison of allowed model IDs with the listing","Test that an unlisted model call is denied in regulated accounts"]},"delivery":{"work":"Add a model-authorization checkpoint to AI intake and enforce it in policy.","dependencies":["Compliance interpretation","Maintained allow-list"],"ownership":"Cloud governance / compliance function.","skillsAdoption":"Platform teams need to read authorization tables and maintain policy-as-code.","governanceCheckpoints":["Listing re-check on each model request","Authorization level recorded in ATO"],"acceptanceCriteria":["Proposed: no unlisted model reachable from regulated accounts","Proposed: allow-list reviewed within a set period after page updates"],"risks":["Adopting models before listing","Misreading table columns","Page changes without notice"]}},"retrievedAt":"2026-11-10T04:06:45Z","enrichedAt":"2026-11-10T04:11:25Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Not addressed.","procurementImplications":"Procurement and ATO packages should reference this model-level page rather than the GovCloud availability announcement.","operatingModelImplications":"Requires a routine check of the listing when new models are announced.","sourceVerification":{"openedUrl":"https://aws.amazon.com/compliance/services-in-scope/FedRAMP/amazon-bedrock-models/","referenceExcerpt":"Amazon Bedrock models - FedRAMP and DoD CSP SRG (IL4/IL5) certification status Last updated: November 9, 2026","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}