System and Organization Controls 3 (SOC 3) Report Report on the Amazon Web Services System Relevant to Security, Availability, and Confidentiality For the Period April 1, 2019 - September 30, 2019 ©2019 Amazon.com, Inc. or its affiliates ©2019 Amazon.com, Inc. or its affiliates 2 ©2019 Amazon.com, Inc. or its affiliates 3 Amazon Web Services 410 Terry Avenue North Seattle, WA 98109-5210 Management’s Report of its Assertions on the Effectiveness of Its Controls Over the Amazon Web Services System Based on the Trust Services Criteria for Security, Availability, and Confidentiality We, as management of, Amazon Web Services, Inc. are responsible for: • Identifying the AWS Web Services System (System) and describing the boundaries of the System, which are presented in Attachment A • Identifying our principal service commitments and system requirements • Identifying the risks that would threaten the achievement of its principal service commitments and service requirements that are the objectives of our system, which are presented in Attachment B • identifying, designing, implementing, operating, and monitoring effective controls over the System to mitigate risks that threaten the achievement of the principal service commitments and system requirement • Selecting the trust services categories that are the basis of our assertion We assert that the controls over the system were effective throughout the period April 1, 2019 to September 30, 2019 to provide reasonable assurance that the principle service commitments and system requirements were achieved based on the criteria relevant to security, availability and confidentiality set forth in the AICPA’s TSP section 100, 2017 Trust Services Criteria for Security, Availability, Processing Integrity, Confidentiality and Privacy. Very truly yours, Amazon Web Services Management ©2019 Amazon.com, Inc. or its affiliates 4 Attachment A – Amazon Web Services System AWS Background Since 2006, Amazon Web Services (AWS) has provided flexible, scalable and secure IT infrastructure to businesses of all sizes around the world. With AWS, customers can deploy solutions on a cloud computing environment that provides compute power, storage, and other application services over the Internet as their business needs demand. AWS affords businesses the flexibility to employ the operating systems, application programs, and databases of their choice. The scope covered in this report consists of the following services (the service name is followed by the services’ namespace1 in parenthesis): • AWS Amplify Console (amplify) • AWS IoT Events (iotevents) • API Gateway (apigateway) • AWS IoT Greengrass (greengrass) • Amazon AppStream 2.0 (appstream) • AWS Key Management Service (kms) • AWS AppSync (appsync) • Amazon Kinesis Data Analytics • Amazon Athena (athena) (kinesisanalytics) • AWS Auto Scaling (autoscaling) • Amazon Kinesis Data Firehose • AWS Backup (backup) (firehose) • AWS Batch (batch) • Amazon Kinesis Data Streams (kinesis) • AWS Certificate Manager (acm) • Amazon Kinesis Video Streams • Amazon Cloud Directory (kinesisvideo) (clouddirectory) • AWS Lambda (lambda) • AWS CloudFormation (cloudformation) • Amazon Lex (runtime.lex, • Amazon CloudFront (cloudfront) models.lex) • AWS CloudHSM (cloudhsm) • AWS License Manager (license- • AWS CloudTrail (cloudtrail) manager) • Amazon CloudWatch (cloudwatch, • Amazon Macie (macie) events, logs) • AWS Managed Services • CloudWatch SDK Metrics for Enterprise • Amazon Managed Streaming for Kafka Support (sdkmetrics) (Amazon MSK) (kafka) • AWS CodeBuild (codebuild) • Amazon MQ (mq) • AWS CodeCommit (codecommit) • Amazon Neptune (neptune-db) • AWS CodeDeploy (codedeploy) • AWS OpsWorks (opsworks) • AWS CodePipeline (codepipeline) • AWS OpsWorks for Chef Automate or • Amazon Cognito (cognito-idp, AWS OpsWorks for Puppet Enterprise cognito-identity, cognito-sync) (opsworks-cm) • Amazon Comprehend (comprehend) • AWS Organizations (organizations) • Amazon Comprehend Medical • Amazon Personalize (personalize) (comprehendmedical) • Amazon Pinpoint (mobiletargeting) • AWS Config (config) • Amazon Polly (polly) 1 When customers create IAM policies or work with Amazon Resource Names (ARNs), customers identify an AWS service using a namespace. For example, the namespace for Amazon S3 is s3, and the namespace for Amazon EC2 is ec2. Customers use namespaces when identifying actions and resources across AWS. ©2019 Amazon.com, Inc. or its affiliates 5 • Amazon Connect (connect) • Amazon QuickSight (quicksight) • AWS Control Tower (controltower) • Amazon Redshift (redshift) • AWS Database Migration Service (dms) • Amazon Rekognition (rekognition) • AWS DataSync (datasync) • Amazon Relational Database Service • AWS Direct Connect (directconnect) (rds) • AWS Directory Service (ds) – [Excludes • AWS Resource Groups (resource- Simple Active Directory] groups) • Amazon DocumentDB (with MongoDB • AWS RoboMaker (robomaker) compatibility) • Amazon Route 53 (route53) • Amazon DynamoDB (dynamodb) • Amazon SageMaker (sagemaker) • AWS Elastic Beanstalk • AWS Secrets Manager (elasticbeanstalk) (secretsmanager) • Amazon Elastic Block Store (ec2) • AWS Security Hub (securityhub) • Amazon Elastic Compute Cloud (ec2) • AWS Server Migration Service (sms) • Amazon Elastic Container Registry (ecr) • AWS Serverless Application Repository • Amazon Elastic Container Service (ecs) – (serverlessrepo) [both Fargate and EC2 launch types] • AWS Service Catalog (servicecatalog) • Amazon Elastic Container Service for • AWS Shield (shield, DDoSProtection) Kubernetes (eks) • Amazon Simple Email Service (ses) • Amazon Elastic File System • Amazon Simple Notification Service (sns) (elasticfilesystem) • Amazon Simple Queue Service (sqs) • Amazon Elasticsearch Service (es) • Amazon Simple Storage Service (s3) • Elastic Load Balancing • Amazon Simple Workflow Service (swf) (elasticloadbalancing) • Amazon SimpleDB (sdb) • Amazon ElastiCache (elasticache) • AWS Snowball (snowball) • AWS Elemental MediaConnect • AWS Snowball Edge (mediaconnect) • AWS Snowmobile • Amazon EMR (elasticmapreduce) • AWS Step Functions (states) • AWS Firewall Manager (fms) • AWS Storage Gateway • Amazon Forecast (amazonforecast) (storagegateway) • Amazon FreeRTOS (freertos) • AWS Systems Manager (ssm) • Amazon FSx (fsx) • Amazon Transcribe (transcribe) • Amazon Glacier (glacier) • AWS Transfer for SFTP (transfer) • AWS Global Accelerator • Amazon Translate (translate) (globalaccelerator) • Amazon Virtual Private Cloud (Amazon • AWS Glue (glue) VPC) (ec2) • AWS GuardDuty (guardduty) • AWS WAF (waf) • AWS Identity and Access Management (iam) • Amazon WorkDocs (workdocs) • VM Import/Export • Amazon WorkLink (worklink) • Amazon Inspector (inspector) • Amazon WorkMail (workmail) • AWS IoT Core (iot) • Amazon WorkSpaces (workspaces) • AWS IoT Device Management (iot) • AWS X-Ray (xray) ©2019 Amazon.com, Inc. or its affiliates 6 The scope of locations covered in this report includes the supporting data centers located in the US East (Northern Virginia), US East (Ohio), US West (Oregon), US West (Northern California), GovCloud (US West), GovCloud (US East), Canada (Montreal), Europe (Ireland), Europe (Frankfurt), Europe (London), Europe (Paris), Europe (Stockholm), Middle East (Bahrain), Asia Pacific (Singapore), Asia Pacific (Sydney), Asia Pacific (Tokyo), Asia Pacific (Osaka)2, Asia Pacific (Seoul), Asia Pacific (Mumbai), Asia Pacific (Hong Kong), and South America (São Paulo) Regions, as well as the AWS Edge locations in: • Canberra, Australia • Hyderabad, India • Dubai, United Arab Emirates • Melbourne, Australia • Mumbai, India • Fujairah, United Arab Emirates • Perth, Australia • New Delhi, India • Arizona, United States • Sydney, Australia • Dublin, Ireland • California, United States • Vienna, Austria • Tel Aviv, Israel • Colorado, United States • Rio de Janeiro, Brazil • Milan, Italy • Florida, United States • São Paulo, Brazil • Palermo, Italy • Georgia, United States • Montréal, Canada • Osaka, Japan • Illinois, United States • Toronto, Canada • Tokyo, Japan • Indiana, United States • Vancouver, Canada • Seoul, Korea • Massachusetts, United States • Prague, Czech Republic • Kuala Lumpur, Malaysia • Minnesota, United States • Hong Kong, China • Amsterdam, Netherlands • Nevada, United States • Copenhagen, Denmark • Oslo, Norway • New Jersey, United States • London, England • Manila, Philippines • New York, United States • Manchester, England • Warsaw, Poland • Ohio, United States • Helsinki, Finland • Lisbon, Portugal • Oregon, United States • Marseille, France • Singapore • Pennsylvania, United States • Paris, France • Cape Town, South Africa • Texas, United States • Berlin, Germany • Johannesburg, South Africa • Utah, United States • Frankfurt, Germany • Madrid, Spain • Virginia, United States • Munich, Germany • Stockholm, Sweden • Washington, United States • Bengaluru, India • Zurich, Switzerland • Chennai, India • Taipei, Taiwan Infrastructure AWS operates the cloud infrastructure that customers may use to provision computing resources such as processing and storage. The AWS infrastructure includes the facilities, network, and hardware as well as some operational software (e.g., host operating system, virtualization software, etc.) that support the provisioning and use of these resources. The AWS infrastructure is designed and managed in accordance with security compliance standards and AWS best practices. 2 The Asia Pacific (Osaka) Region is a Local Region, which comprises an isolated, fault-tolerant infrastructure design consisting