Wally on AWS Bedrock GovCloud — FedRAMP High and IL5

AWS Bedrock GovCloud is the only Anthropic-on-Bedrock path with FedRAMP High authorization. It's also the path most teams pick when their workload is bound by a DoD Impact Level 5 (IL5) ATO.

What you need:
• An AWS GovCloud account with Bedrock enabled in your account
• Anthropic Claude models requested and approved on that account (Bedrock model access is per-account; the request usually clears within a business day)
• An IAM role or user with bedrock:InvokeModel permission on the Claude models you want Wally to use
• An access key + secret (or temporary credentials via STS) for that identity

Endpoint format:
The Bedrock Runtime endpoint for GovCloud is https://bedrock-runtime.us-gov-west-1.amazonaws.com — Wally needs the Anthropic-compatible path, which most teams expose either through (a) a thin Lambda proxy that takes Anthropic-format requests and signs SigV4 to Bedrock, or (b) AWS's Anthropic-compatible Bedrock endpoint when available in your account. Settings → Wally model accepts either URL.

What this gets you:
• Wally chat, Builder Docs rewrites, Builder Sites generation and review, Builder Design (all surfaces) — inference runs entirely inside your AWS GovCloud boundary
• Anthropic prompts and responses never traverse Turtini's infrastructure on the inference path
• Your CO can audit that AI processing stays inside the same boundary as the rest of your federal workload
• Your bill on the inference side comes from AWS, not Turtini — the Turtini +15% chargeback does not apply to the inference path

What still runs on the Turtini side:
• The Wally application code that orchestrates the call — the function that builds the prompt, calls your endpoint, parses the response, runs tools — runs on Turtini's Cloud Functions in us-central1
• Platform metadata (which user asked, which org, the tool name) lives in our audit log
• Background AI features that are not org-data-touching (help article authoring, market refresh, the platform's own admin briefings) continue to run on Turtini's account

If you need every byte of the orchestration to also live in GovCloud, that's a separate Turtini-deployment-pattern conversation — contact your account team.