Comment by mpyne

> What if an Amazon employee uses Claude to develop the S3 storage service, which is a core product offering unrelated to the DoD but also something that will be provided to the DoD in govcloud?

Honestly that question has been open for as long as GovCloud has been around. I've used it myself as an exercise in pushing within the Navy to adopt public cloud where security requirements permit, rather than forcing everything onto GovCloud.

After all, if it's the same S3 either way then the real point of security isn't the Amazon datacenter employee changing out dead hard disks in a physical GovCloud datacenter, but the S3 service team developers who are frequently not even American citizens, but whose code may very well go on to touch the most sensitive data the nation generates.