tbh I personally wouldn’t expect/suspect this to be using any of the flavours of govcloud for mass-market flavours (because that has implications on staff hiring etc)

the easy way to handle this is to have a backend/frontend separation with baseline access controlled simply by construction of routing and zone primitives. it’s relatively simple (albeit moderately involved) to do this on most cloud providers