--- title: FIPS on Google Cloud description: In August 2016, the United States government announced a new federal source-code policy, which mandates that at least 20% of custom source code developed by or for any agency of the federal government must be released as open-source software (OSS). The memo of this policy also states that the Federal Government spends more than $6 […] url: https://canonical.com/blog/run-your-ubuntu-in-us-government-clouds?format=md --- 1. [Blog](https://canonical.com/blog) 2. Article --- [Hugo Huang](https://canonical.com/blog/author/hugohuangtao "More about Hugo Huang") 22 November 2021 # FIPS on Google Cloud [FIPS](https://canonical.com/blog/tag/fips) [Google Cloud](https://canonical.com/blog/tag/google-cloud) [In-place upgrade](https://canonical.com/blog/tag/in-place-upgrade) [livepatch](https://canonical.com/blog/tag/livepatch) [Security](https://canonical.com/blog/tag/security) [Security certifications and compliance](https://canonical.com/blog/tag/security-certifications-and-compliance) --- Share the article In August 2016, the United States government announced [a new federal source-code policy](https://obamawhitehouse.archives.gov/sites/default/files/omb/memoranda/2016/m_16_21.pdf), which mandates that at least 20% of custom source code developed by or for any agency of the federal government must be released as open-source software (OSS). The memo of this policy also states that the Federal Government spends more than $6 billion each year on software through more than 42,000 transactions. Obviously, this is a huge business for all open-source developers. The question is “how can you get the business from the Federal Government?” The answer is FIPS. [Federal Information Processing Standards (FIPS)](https://www.nist.gov/standardsgov/compliance-faqs-federal-information-processing-standards-fips) are standards and guidelines for federal computer systems that are developed by National Institute of Standards and Technology (NIST). Certain federal-related applications are required to be FIPS compliant, and many non-government organizations also follow FIPS standards.  [Ubuntu Pro](https://ubuntu.com/gcp/pro) provides you with cryptographic packages that are tested and attested by [atsec Information Security](https://www.atsec.com/services/fips-140-2-and-fips-140-3-testing/index.html), a NIST accredited laboratory. And Google automatically encrypts traffic between VMs that travels between Google data centers using FIPS 140-2 validated encryption. Your workloads can easily be FIPS compliant if you properly deploy your workloads on Ubuntu Pro in Google Cloud. Ubuntu 18.04 Pro offers you two FIPS options: FIPS and FIPS-updates. Let’s SSH into your Ubuntu Pro virtual machine. If you haven’t yet upgraded your Ubuntu LTS to Ubuntu Pro, please follow [this tutorial](https://ubuntu.com/blog/securing-the-open-source-supply-chain-with-ubuntu-pro-on-google-cloud). In less than One Minute, you will be able to get your Ubuntu Pro machine without losing any of your mission-critical workloads. Once you SSH into your Ubuntu Pro, input: | | | --- | | ua status | You will see: | SERVICE | ENTITLED | STATUS | DESCRIPTION | | --- | --- | --- | --- | | […] | | fips | yes | disabled | NIST-certified core packages | | fips-updates | yes | disabled | NIST-certified core packages with priority security updates | FIPS option includes the certified cryptographic packages, while the FIPS-updates option uses the certified packages but includes security fixes when available. That said, If you prioritize security patching over strict compliance you go with fips-updates. Let’s enable FIPS now: | | | --- | | sudo ua enable fips | | | | --- | | One moment, checking your subscription first This will install the FIPS core packages. Are you sure? (y/N) y Updating package lists Installing FIPS packages FIPS enabled A reboot is required to complete install. | At the time of writing, FIPS is only available on Ubuntu 18.04 Pro on GCP. We will need to wait longer for FIPS images for Ubuntu 16.04 Pro and Ubuntu 20.04 Pro. ### Maintenance: Livepatch | SERVICE | ENTITLED | STATUS | DESCRIPTION | | --- | --- | --- | --- | | […] || livepatch | yes | n/a | Canonical Livepatch service | Livepatch eliminates the need for unplanned maintenance windows for high and critical severity kernel vulnerabilities by patching the Linux kernel while the system runs. This reduces fire drills while keeping uninterrupted service. Let’s enable Livepatch in Ubuntu 20.04 Pro and let the machine safely go for 10 years: | | | --- | | sudo ua enable livepatch | | | | --- | | One moment, checking your subscription first Canonical livepatch enabled. | Check it: | | | --- | | ua status | | SERVICE | ENTITLED | STATUS | DESCRIPTION | | --- | --- | --- | --- | | cis | yes | disabled | Center for Internet Security Audit Tools | | esm-apps | yes | enabled | UA Apps: Extended Security Maintenance (ESM) | | esm-infra | yes | enabled | UA Infra: Extended Security Maintenance (ESM) | | fips | yes | n/a | NIST-certified core packages | | fips-updates | yes n/a | NIST-certified core packages with priority security updates | | | livepatch | yes | enabled | Canonical Livepatch service | At the time of writing, Livepatch is only available on Ubuntu 20.04 Pro. Livepatch for Ubuntu 16.04 Pro and Ubuntu 18.04 Pro will be available soon. ## A spell to rule them all In this blog series, we navigate through the great features of Ubuntu Pro: [CIS](https://ubuntu.com/blog/make-your-ubuntu-cis-hardened-in-gcp), [ESM](https://ubuntu.com/blog/secure-your-open-source-freedom-for-10-years), FIPS, Livepatch. Now, if you just want them all at once, here us the single magic spell you need to remember: | | | --- | | gcloud beta compute disks update BOOT\_DISK\_NAME \   –zone=ZONE \   –update-user-licenses=”LICENSE\_URI” | Replace the following: * BOOT\_DISK\_NAME: the name of the boot disk to append the license to * ZONE: the zone containing the boot disk to append the license to * LICENSE\_URI: the license URI for the version of Ubuntu Pro you are upgrading to. The following table shows the license URI for the supported versions of Ubuntu Pro: | Ubuntu Pro version | License URI | | --- | --- | | Ubuntu Pro 16.04 LTS | https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-1604-lts | | Ubuntu Pro 18.04 LTS | https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-1804-lts | | Ubuntu Pro 20.04 LTS | https://www.googleapis.com/compute/v1/projects/ubuntu-os-pro-cloud/global/licenses/ubuntu-pro-2004-lts | For comprehensive instruction, please refer to official Google Cloud documentation: [Upgrade from Ubuntu to Ubuntu Pro](https://cloud.google.com/compute/docs/images/premium/ubuntu-pro/upgrade-from-ubuntu). [Get in touch Interested in running Ubuntu in your organization?](https://ubuntu.com/about/contact-us/form) ## Sign up for our newsletter Get the latest Canonical news and updates in your inbox. Work email: \*I agree to receive information about Canonical's products and services. By submitting this form, I confirm that I have read and agree to [Canonical's Privacy Policy](https://canonical.com/legal/dataprivacy). Sign up ## Share on --- ## Related posts [### Canonical joins the Open Secure AI Alliance](https://canonical.com/blog/open-secure-ai-alliance) Canonical is now part of the Open Secure AI Alliance, announced by NVIDIA with partners across cloud computing, cybersecurity, enterprise software, open source foundations, and... [Canonical](https://canonical.com/blog/author/canonical) 28 August 2026 [### Januscape vulnerability CVE-2026-53359 mitigations available](https://canonical.com/blog/januscape-linux-vulnerability-mitigations-available) Introduction A local privilege escalation (LPE) vulnerability affecting the Linux kernel was publicly disclosed on July 6, 2026. The vulnerability was assigned CVE ID... [seth-arnold](https://canonical.com/blog/author/seth-arnold) 11 July 2026 [### DirtyClone Linux kernel local privilege escalation vulnerability fixes available](https://canonical.com/blog/dirtyclone-linux-vulnerability-fixes-available) On June 25, 2026, JFrog published their research into CVE-2026-43503, referring to the vulnerability as DirtyClone. The vulnerability had previously been responsibly disclosed... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026 [### pedit COW kernel local privilege escalation vulnerability mitigations](https://canonical.com/blog/pedit-cow-linux-vulnerability-fixes-available) Mitigations are available for the Linux vulnerability with CVE ID CVE-2026-46331. The CVE ID was assigned on June 16 2026 and highlighted as a local privilege escalation (LPE)... [Luci Stanescu](https://canonical.com/blog/author/lucistanescu) 1 July 2026