• A non-containerized Linux host.
• Your Linux OS must be in FIPS-compliant mode. See your OS vendor’s documentation on what steps are required to meet this requirement.
• FIPS-compliant storage backing the host file system.

• A non-containerized Windows host.
• Windows must be in FIPS-compliant mode.
• FIPS-compliant storage backing the host file system.

Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:

• Use a FIPS-compliant region (for example, AWS GovCloud)

Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:

• Use a FIPS-compliant region (for example, AWS GovCloud)
• Configure AWS compute services (EC2 or Fargate) in FIPS mode
• Use FIPS-compliant storage for your ECS tasks

Ensure your AWS setup is FIPS compliant. This includes, but is not limited to, the following requirements:

• Use a FIPS-compliant region (for example, AWS GovCloud)
• Configure EKS worker nodes in FIPS mode
• Use FIPS-compliant storage for your EKS worker nodes

1. Install the Agent with FIPS support.

   Note: FIPS support is only available on Agent versions 7.65.0 and above:

   1. If you’re using the Agent install script, specify the DD_AGENT_FLAVOR="datadog-fips-agent" environment variable in your installation command. For example:

      DD_SITE="ddog-gov.com" DD_API_KEY="MY_API_KEY" DD_AGENT_FLAVOR="datadog-fips-agent" … bash -c "$(curl -L https://s3.amazonaws.com/dd-agent/scripts/install_script_agent7.sh)"
      

   2. If you’re installing with a package, follow the instructions to install the latest datadog-fips-agent package available for your platform.

   3. Add GOFIPS=1 to your Datadog environment variables, reload all service units, and restart the Datadog Agent service (datadog-agent.service). For example, if your host is using systemd:

      echo "GOFIPS=1" | sudo tee -a /etc/datadog-agent/environment
      systemctl daemon-reload
      systemctl restart 'datadog-agent*'
      

2. Run the datadog-agent status command and make sure you see FIPS Mode: enabled in the status output.

    <div class="shortcode-wrapper shortcode-img expand"><figure class="text-center"><a href="https://datadog-docs-staging.imgix.net/images/agent/fips-linux.9b9ee1a25073301cb634384630327924.png?fit=max&amp;auto=format" class="pop" data-bs-toggle="modal" data-bs-target="#popupImageModal"><picture class=""  style="width:100%;"  >
            <img 
                class="img-fluid" 
                srcset="https://datadog-docs-staging.imgix.net/images/agent/fips-linux.9b9ee1a25073301cb634384630327924.png?auto=format" 
                style="width:100%;"  alt="Agent status command output with FIPS Mode enabled - Linux"  />
          </picture></a></figure>
    </div>
   

1. Follow the Windows instructions to uninstall any existing Datadog Agent on the machine.

2. Run the command below to install the FIPS Agent, replacing DATADOG_API_KEY with your API key:

   Note: FIPS support is only available on Agent versions 7.65.0 and above:

$p = Start-Process -Wait -PassThru msiexec -ArgumentList '/qn /i https://windows-agent.datadoghq.com/datadog-fips-agent-7-latest.amd64.msi /log C:\Windows\SystemTemp\install-datadog.log APIKEY="<DATADOG_API_KEY>" SITE="ddog-gov.com"'
if ($p.ExitCode -ne 0) {
   Write-Host "msiexec failed with exit code $($p.ExitCode) please check the logs at C:\Windows\SystemTemp\install-datadog.log" -ForegroundColor Red
}

1. Run the Agent status command and make sure you see FIPS Mode: enabled in the status output.

   & "$env:ProgramFiles\Datadog\Datadog Agent\bin\agent.exe" status
   

Note: The program name for the FIPS Agent in Add or Remove Programs is “Datadog FIPS Agent.”

For AWS Lambda FIPS compliance, follow the instructions in the AWS Lambda FIPS Compliance documentation.

When following the ECS installation instructions, make sure to use these FIPS-specific configuration values for your Task Definition:

• Set image (in containerDefinitions object) to public.ecr.aws/datadog/agent:7-fips
• Set DD_SITE environment variable to ddog-gov.com

When following the Datadog Agent installation on Kubernetes instructions, make sure to include these FIPS-specific configuration values depending on your chosen installation method (in datadog-agent.yaml file):

For the Datadog Operator:

datadog:
   site: "ddog-gov.com"
useFIPSAgent: true

For the Datadog Helm Chart:

spec:
   global:
      site: "ddog-gov.com"
      useFIPSAgent: true