awslabs
diff --git a/‎.github/workflows/ci.yml‎
Lines changed: 2 additions & 0 deletions b/‎.github/workflows/ci.yml‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎aws-sdk-build/package-lock.json‎
Lines changed: 3 additions & 45 deletions b/‎aws-sdk-build/package-lock.json‎
Lines changed: 3 additions & 45 deletions
diff --git a/‎eslint/index.js‎
Lines changed: 1 addition & 3 deletions b/‎eslint/index.js‎
Lines changed: 1 addition & 3 deletions
diff --git a/‎eslint/sorted-imports.js‎
Lines changed: 13 additions & 11 deletions b/‎eslint/sorted-imports.js‎
Lines changed: 13 additions & 11 deletions
diff --git a/‎examples/app.js‎
Lines changed: 59 additions & 2 deletions b/‎examples/app.js‎
Lines changed: 59 additions & 2 deletions
diff --git a/‎examples/channelHelper.js‎
Lines changed: 4 additions & 2 deletions b/‎examples/channelHelper.js‎
Lines changed: 4 additions & 2 deletions
diff --git a/‎examples/createSignalingChannel.js‎
Lines changed: 1 addition & 0 deletions b/‎examples/createSignalingChannel.js‎
Lines changed: 1 addition & 0 deletions
diff --git a/‎examples/index.html‎
Lines changed: 27 additions & 0 deletions b/‎examples/index.html‎
Lines changed: 27 additions & 0 deletions
diff --git a/‎examples/master.js‎
Lines changed: 5 additions & 2 deletions b/‎examples/master.js‎
Lines changed: 5 additions & 2 deletions
diff --git a/‎examples/viewer.js‎
Lines changed: 6 additions & 3 deletions b/‎examples/viewer.js‎
Lines changed: 6 additions & 3 deletions
@@ -13,6 +13,8 @@ on:
 jobs:
   nodejs-ubuntu-build:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     strategy:
       matrix:
         node: [ 18, 19, 20, 21, 22, 23 ]
 
@@ -2,8 +2,6 @@ const sortedImports = require('./sorted-imports');
 
 module.exports = {
     rules: {
-        'sorted-imports': {
-            create: sortedImports,
-        },
+        'sorted-imports': sortedImports,
     },
 };
@@ -1,21 +1,22 @@
 function isBlankLineBefore(context, node) {
-    return node.range[0] > 0 && !context.getSourceCode().getLocFromIndex(node.range[0] - 1).column;
+    return node.range[0] > 0 && !context.sourceCode.getLocFromIndex(node.range[0] - 1).column;
 }
 
 function getText(context, node) {
-    return context.getSourceCode().getText(node);
+    return context.sourceCode.getText(node);
 }
 
-module.exports = context => {
-    let previousImport = null;
-    let previousLocalImport = null;
+module.exports = {
+    meta: {
+        type: 'layout',
+        fixable: 'whitespace',
+    },
+    create(context) {
+        let previousImport = null;
+        let previousLocalImport = null;
 
-    return {
-        meta: {
-            type: 'layout',
-            fixable: 'whitespace',
-        },
-        ImportDeclaration(node) {
+        return {
+            ImportDeclaration(node) {
             const sourceValue = node.source.value;
 
             if (sourceValue.startsWith('.') || sourceValue.startsWith('/')) {
@@ -120,4 +121,5 @@ module.exports = context => {
             }
         },
     };
+    },
 };
@@ -114,7 +114,8 @@ function getFormValues() {
         forceSTUN: $('#forceSTUN').is(':checked'),
         forceTURN: $('#forceTURN').is(':checked'),
         accessKeyId: $('#accessKeyId').val(),
-        useDualStackEndpoints: endpoint === undefined && $('#dual-stack').is(':checked'),
+        useDualStackEndpoints: $('#dual-stack').is(':checked'),
+        useFipsEndpoints: $('#enable-fips').is(':checked'),
         endpoint: endpoint,
         secretAccessKey: $('#secretAccessKey').val(),
         sessionToken: $('#sessionToken').val() || null,
@@ -212,6 +213,19 @@ $('#master-button').click(async () => {
         return;
     }
     const formValues = getFormValues();
+
+    // Check for FIPS + WebRTC ingestion incompatibility
+    if (formValues.useFipsEndpoints && (formValues.autoDetermineMediaIngestMode || formValues.mediaIngestionModeOverride)) {
+        console.error('GovCloud regions do not support WebRTC Ingestion and Storage. Please move to a supported region or disable WebRTC ingestion.');
+        return;
+    }
+
+    // Check for FIPS + non-GovCloud region
+    if (formValues.useFipsEndpoints && !formValues.region.startsWith('us-gov-')) {
+        console.error('FIPS endpoints are not supported in this region.');
+        return;
+    }
+
     ROLE = $('#master-heading').text() === 'Viewer' ? 'VIEWER' : 'MASTER';
     form.addClass('d-none');
     $('#master').removeClass('d-none');
@@ -253,6 +267,18 @@ $('#viewer-button').click(async () => {
     }
     const formValues = getFormValues();
 
+    // Check for FIPS + WebRTC ingestion incompatibility
+    if (formValues.useFipsEndpoints && (formValues.autoDetermineMediaIngestMode || formValues.mediaIngestionModeOverride)) {
+        console.error('GovCloud regions do not support WebRTC Ingestion and Storage. Please move to a supported region or disable WebRTC ingestion.');
+        return;
+    }
+
+    // Check for FIPS + non-GovCloud region
+    if (formValues.useFipsEndpoints && !formValues.region.startsWith('us-gov-')) {
+        console.error('FIPS endpoints are not supported in this region.');
+        return;
+    }
+
     if (formValues.autoDetermineMediaIngestMode) {
         channelHelper = new ChannelHelper(formValues.channelName,
             {
@@ -269,7 +295,8 @@ $('#viewer-button').click(async () => {
             '[VIEWER]',
             formValues.clientId,
             formValues.logAwsSdkCalls ? console : undefined,
-            formValues.useDualStackEndpoints);
+            formValues.useDualStackEndpoints,
+            formValues.useFipsEndpoints);
         await channelHelper.determineMediaIngestionPath();
 
         if (channelHelper.isIngestionEnabled()) {
@@ -432,6 +459,35 @@ $('#region').on('focusout', event => {
     }
 });
 
+// Auto-enable FIPS for us-gov regions
+$('#region').on('input change', event => {
+    if (event.target.value.includes('us-gov-')) {
+        $('#enable-fips').prop('checked', true).trigger('change');
+    }
+});
+
+// Show/hide ingestion warning for us-gov regions
+function updateGovIngestionWarning() {
+    const region = $('#region').val() || '';
+    const isGovRegion = region.includes('us-gov');
+    const ingestionEnabled = $('#ingest-media').is(':checked') || $('#ingest-media-manual-on').attr('data-selected') === 'true';
+    $('#gov-ingestion-warning').toggleClass('d-none', !(isGovRegion && ingestionEnabled));
+}
+
+$('#region').on('input change', updateGovIngestionWarning);
+$('#ingest-media').on('change', updateGovIngestionWarning);
+$('#ingest-media-manual-on, #ingest-media-manual-off').on('click', () => setTimeout(updateGovIngestionWarning, 0));
+
+// Show/hide FIPS region warning
+function updateFipsRegionWarning() {
+    const fipsEnabled = $('#enable-fips').is(':checked');
+    const region = $('#region').val() || '';
+    $('#fips-region-warning').toggleClass('d-none', !(fipsEnabled && !region.startsWith('us-gov-')));
+}
+
+$('#enable-fips').on('change', updateFipsRegionWarning);
+$('#region').on('input change', updateFipsRegionWarning);
+
 function addViewerMediaStreamToMaster(viewerId, track) {
     $('#empty-video-placeholder')?.remove();
 
@@ -619,6 +675,7 @@ const fields = [
     {field: 'turns-with-udp', type: 'checkbox'},
     {field: 'turns-with-tcp', type: 'checkbox'},
     {field: 'turn-one-set-only', type: 'checkbox'},
+    {field: 'enable-fips', type: 'checkbox'},
 ];
 
 fields.forEach(({field, type, name}) => {
 
@@ -12,7 +12,7 @@ class ChannelHelper {
         DETERMINE_THROUGH_DESCRIBE: 2,
     };
 
-    constructor(channelName, clientArgs, endpoint, role, ingestionMode, loggingPrefix, clientId, logger, useDualStackEndpoints) {
+    constructor(channelName, clientArgs, endpoint, role, ingestionMode, loggingPrefix, clientId, logger, useDualStackEndpoints, useFipsEndpoints) {
         this._channelName = channelName;
         this._clientArgs = clientArgs;
         this._role = role;
@@ -22,6 +22,7 @@ class ChannelHelper {
         this._clientId = clientId;
         this._logger = logger;
         this._useDualStackEndpoints = useDualStackEndpoints;
+        this._useFipsEndpoints = useFipsEndpoints;
     }
 
     // Must be called first
@@ -189,7 +190,8 @@ class ChannelHelper {
                 ...this._clientArgs,
                 logger: this._logger,
                 endpoint: this._endpoint,
-                useDualstackEndpoint: this._useDualStackEndpoints,
+                useDualstackEndpoint: this._endpoint ? undefined : this._useDualStackEndpoints,
+                useFipsEndpoint: this._endpoint ? undefined : this._useFipsEndpoints,
                 correctClockSkew: true,
             });
         }
 
@@ -19,6 +19,7 @@ async function createSignalingChannel(formValues) {
             endpoint: formValues.endpoint,
             logger: formValues.logAwsSdkCalls ? console : undefined,
             useDualstackEndpoint: formValues.useDualStackEndpoints,
+            useFipsEndpoint: formValues.useFipsEndpoints,
         });
 
         // Create signaling channel
 
@@ -135,6 +135,7 @@ <h4 id="subheader">Tracks</h4>
                     </div>
                 </div>
             </div>
+            <small id="gov-ingestion-warning" class="text-danger d-none">Warning: GovCloud regions do not support WebRTC Ingestion and Storage</small>
             </details>
             <h4 id="subheader">Video Resolution</h4>
             <p><small>Set the desired video resolution and aspect ratio.</small></p>
@@ -368,6 +369,32 @@ <h6>Audio Codecs Allowed</h6>
                     </div>
                 </div>
 
+                <div class="d-flex align-items-center mt-3">
+                    <p class="mb-0">
+                        <small>KVS FIPS Endpoint</small>
+                    </p>
+
+                    <!-- Tooltip icon -->
+                    <span data-delay="{ &quot;hide&quot;: 1500 }"
+                        data-position="auto"
+                        tabindex="0"
+                        class="text-info ml-1"
+                        data-toggle="tooltip"
+                        data-html="true"
+                        title="<p>Enables FIPS endpoints. Supported Regions can be found in the link below.</p>
+                        <a href=&quot;https://aws.amazon.com/compliance/fips/&quot;>Additional information</a>">
+                        <sup>&#9432;</sup>
+                    </span>
+                </div>
+
+                <div class="form-group">
+                    <div class="form-check">
+                                <input class="form-check-input" type="checkbox" id="enable-fips"/>
+                                <label for="enable-fips" class="form-check-label">Enable FIPS Endpoints</label>
+                    </div>
+                    <small id="fips-region-warning" class="text-danger d-none">FIPS endpoints not supported in this region.</small>
+                </div>
+                                    
                 <p class="mt-3"><small>Endpoint Override</small></p>
                 <div class="form-group">
                     <input type="text" class="form-control" id="endpoint" placeholder="Endpoint">
 
@@ -87,6 +87,7 @@ async function startMaster(localView, remoteView, formValues, onStatsReport, onR
             role === 'VIEWER' ? formValues.clientId : undefined,
             formValues.logAwsSdkCalls ? console : undefined,
             formValues.useDualStackEndpoints,
+            formValues.useFipsEndpoints,
         );
 
         await master.channelHelper.init();
@@ -352,10 +353,12 @@ async function getIceServersWithCaching(formValues) {
 
     // Add the STUN server unless it is disabled
     if (!formValues.natTraversalDisabled && !formValues.forceTURN && formValues.sendSrflxCandidates) {
+        const protocol = formValues.useFipsEndpoints ? 'stuns' : 'stun';
+        const fipsSuffix = formValues.useFipsEndpoints ? '-fips' : '';
         if (formValues.useDualStackEndpoints) {
-            iceServers.push({ urls: `stun:stun.kinesisvideo.${formValues.region}.api.aws:443` });
+            iceServers.push({ urls: `${protocol}:stun.kinesisvideo${fipsSuffix}.${formValues.region}.api.aws:443` });
         } else {
-            iceServers.push({ urls: `stun:stun.kinesisvideo.${formValues.region}.amazonaws.com:443` });
+            iceServers.push({ urls: `${protocol}:stun.kinesisvideo${fipsSuffix}.${formValues.region}.amazonaws.com:443` });
         }
     }
 
 
@@ -367,7 +367,8 @@ async function startViewer(localView, remoteView, formValues, onStatsReport, rem
             },
             endpoint: formValues.endpoint,
             correctClockSkew: true,
-            useDualstackEndpoint: formValues.useDualStackEndpoints,
+            useDualstackEndpoint: formValues.endpoint ? undefined : formValues.useDualStackEndpoints,
+            useFipsEndpoint: formValues.endpoint ? undefined : formValues.useFipsEndpoints,
         });
 
         // Get signaling channel ARN
@@ -451,10 +452,12 @@ async function startViewer(localView, remoteView, formValues, onStatsReport, rem
         const iceServers = [];
         // Don't add stun if user selects TURN only or NAT traversal disabled
         if (!formValues.natTraversalDisabled && !formValues.forceTURN && formValues.sendSrflxCandidates) {
+            const protocol = formValues.useFipsEndpoints ? 'stuns' : 'stun';
+            const fipsSuffix = formValues.useFipsEndpoints ? '-fips' : '';
             if (formValues.useDualStackEndpoints) {
-                iceServers.push({ urls: `stun:stun.kinesisvideo.${formValues.region}.api.aws:443` });
+                iceServers.push({ urls: `${protocol}:stun.kinesisvideo${fipsSuffix}.${formValues.region}.api.aws:443` });
             } else {
-                iceServers.push({ urls: `stun:stun.kinesisvideo.${formValues.region}.amazonaws.com:443` });
+                iceServers.push({ urls: `${protocol}:stun.kinesisvideo${fipsSuffix}.${formValues.region}.amazonaws.com:443` });
             }
         }