FIPS 140-3

HeliosLogs can run against the AWS-LC FIPS 140-3 validated cryptographic module. FIPS is a build property — the same application code runs either way; the build selects the cryptographic backend. A prebuilt FIPS image is published as helioslogs/helioslogs:latest-fips (the standard :latest tag is a non-FIPS build).

What's covered

All cryptography routes through a single seam backed by aws-lc-rs:

Use	Algorithm
Control-plane encryption at rest	AES-256-GCM
Password hashing	PBKDF2-HMAC-SHA256 (600k iterations)
JWT signing	HMAC-SHA256 (HS256)
Content hashes / fingerprints	SHA-256
Keys, nonces, tokens	DRBG
Outbound TLS (LLM APIs, S3)	rustls + aws-lc-rs

Building a FIPS binary

cargo build --features fips --release

The FIPS module compiles from source and needs Go, Perl, and CMake plus a C toolchain available at build time. The published helioslogs/helioslogs:latest-fips image is built this way.

Verifying FIPS is active

Two independent confirmations:

1. Startup gating — a FIPS build won't start unless the validated module initializes successfully.
2. Runtime config view — open Admin → General and check the crypto provider. A FIPS build reports AWS-LC FIPS 140-3 (active); a standard build reports AWS-LC (standard, non-FIPS build).

Identical behavior

Because FIPS only changes the crypto backend, you can adopt it without changing any configuration or call sites — pull the :latest-fips image (or build with the feature) and verify via the runtime-config view.