Executive Summary
AI-generated analysis for AWS
Amazon Web Services (AWS), the cloud infrastructure division of Amazon.com, Inc., presents a Tier 3 (Moderate Risk) profile under ThirdProof's deterministic rule engine — a rating that reflects not fundamental security deficiencies, but specific transparency gaps that procurement and compliance teams should address before relying on AWS as an in-scope subservice organization. AWS demonstrates substantial strengths across nearly every independently verifiable security dimension:
Key Findings
- **Domain integrity**: The aws.amazon.com domain, registered in November 1994, carries a fully clean reputation with no malware listings, no phishing flags, and a zero abuse confidence score across all scanned engines.
- **Infrastructure posture**: Only two open ports (80 and 443) are exposed, no CVEs were detected in the infrastructure scan, and TLS 1.3 is confirmed active with no weak protocols or ciphers.
- **Web security**: Mozilla HTTP Observatory returned a grade of A (95/100), with HSTS and X-Frame-Options headers correctly configured.
- **FedRAMP**: AWS GovCloud is independently confirmed as FedRAMP Authorized at the High impact level via the FedRAMP Marketplace, the strongest independently verifiable compliance signal in this assessment.
- **Sanctions and adverse media**: No sanctions matches, no SEC enforcement filings, and no adverse media signals were found across all queried sources in the past 12 months.
- **Leadership**: A named CISO, Chris Betz (appointed August 2023), is publicly identified and responsible for AWS's security program. Two findings warrant attention before this vendor is treated as fully cleared for in-scope use. First, no publicly crawlable AI data usage policy was discovered — a meaningful gap given AWS's expanding portfolio of AI and machine learning services (Amazon Bedrock, SageMaker, CodeWhisperer). Procurement teams relying on AWS for AI workloads should request the vendor's Data Protection Addendum or AI-specific service terms directly. Second, the vendor's compliance page claims PCI DSS certification, but independent registry verification returned no confirming entry — this is a cross-source contradiction (CONTRA-001) that should be resolved by requesting the current AWS PCI DSS Attestation of Compliance (AoC) directly from the vendor or via AWS Artifact. Overall, AWS is one of the most extensively audited cloud platforms in the world, and the Tier 3 rating reflects documentation transparency gaps rather than evidence of security weakness. A conditional approval posture is appropriate: the two open findings are resolvable through direct vendor engagement, and neither represents a structural security concern.
Independence Statement
All evidence used in this assessment was independently sourced from external data registries, threat intelligence feeds, DNS/TLS analysis, public compliance registries, and open-web media scans — without vendor participation, self-submission, or sponsored input.