diff --git a/scripts/publish_govcloud_layers.sh b/scripts/publish_govcloud_layers.sh
index 2d6f2dc64..c0e8743ed 100755
--- a/scripts/publish_govcloud_layers.sh
+++ b/scripts/publish_govcloud_layers.sh
@@ -9,7 +9,7 @@
 # Download button on the `layer bundle` job. This will be a zip file containing
 # all of the required layers. Run this script as follows:
 #
-# ENVIRONMENT=[us1-staging-fed or us1-fed] [PIPELINE_LAYER_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud_layers.sh <layer-bundle.zip>
+# CI_COMMIT_TAG=<vX.Y.Z> ENVIRONMENT=[us1-staging-fed|us1-fed|us2-fed] [PIPELINE_LAYER_SUFFIX=optional-layer-suffix] [REGIONS=us-gov-west-1] ./scripts/publish_govcloud_layers.sh <layer-bundle.zip>
 #
 # protip: you can drag the zip file from finder into your terminal to insert
 # its path.
@@ -59,6 +59,23 @@ elif [ $ENVIRONMENT = "us1-fed" ]; then
 # sso_account_id=002406178527
 # sso_role_name=engineering
 # sso_region=us-gov-west-1
+# region=us-gov-west-1
+
+  export STAGE="prod"
+    if [[ ! "$PACKAGE_NAME" =~ ^datadog_lambda_js-signed-bundle-[0-9]+$ ]]; then
+        echo "[ERROR]: Unexpected package name: $PACKAGE_NAME"
+        exit 1
+    fi
+
+elif [ $ENVIRONMENT = "us2-fed" ]; then
+    AWS_VAULT_ROLE=sso-govcloud-fed-us2-lambda-layer-operator
+
+# this role looks like this in ~/.aws/config:
+# [profile sso-govcloud-fed-us2-lambda-layer-operator]
+# sso_start_url=https://start.us-gov-west-1.us-gov-home.awsapps.com/directory/d-98671fdc8b
+# sso_account_id=486696501492
+# sso_role_name=lambda-layer-operator
+# sso_region=us-gov-west-1
 # region=us-gov-west-1
 
     export STAGE="prod"
@@ -68,7 +85,7 @@ elif [ $ENVIRONMENT = "us1-fed" ]; then
     fi
 
 else
-    printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed or us1-fed.\n"
+    printf "[ERROR]: ENVIRONMENT not supported, must be us1-staging-fed, us1-fed, or us2-fed.\n"
     exit 1
 fi