Amazon Web Services

Amazon Web Services

Industry	Cloud computing, Web services
Founder(s)	Jeff Bezos
Headquarters	Seattle, Washington, United States
Area served	Worldwide
Key people	Adam Selipsky (CEO)
Products	IaaS, PaaS, DBaaS, DaaS
Revenue	$21.35 billion (2023 Q1)
Parent	Amazon
Website	aws.amazon.com

Amazon Web Services ( also known as AWS) is an American cloud computing company that provides public, private, hybrid, and multicloud solutions to enterprises, organizations, governments, and individuals. AWS has more than 120 data centers distributed in various locations around the world, with Africa and South America the least represented. The company provides more than 200 different products and services representing elastic computing, networking, content delivery, data storage, database management, security management, enterprise management, cloud communication, data analysis, media management, container and middleware management, developer support, scientific computing, internet of things, and virtual and augmented reality.

Provider research

This section uses public information to provide some answers to the 18 questions posed in Chapter 6 of the wiki-based guide Choosing and Implementing a Cloud-based Service for Your Laboratory. In some cases, public information could not be found, and a recommendation to further discuss the question with the cloud service provider (CSP) is made.

1. What experience do you have working with laboratory customers in our specific industry?

Examples of labs that have worked with AWS include Glidewell Laboratories, Merck Research Laboratories, National Renewable Energy Laboratory, and the Innovation Lab. Additionally, an AWS article titled "Building the foundation for Lab of the Future using AWS" published in 2019 provides some insight into what a laboratory integrated with AWS cloud offerings might look like. It's also worth noting that numerous laboratory information management system (LIMS) and laboratory information system (LIS) developers have offered their solution on AWS over the years, including STARLIMS Corporation, Core Informatics, LLC, LabLynx, Inc., Orchard Software Corporation, PD Evidence, LLC, and Thermo Scientific. An AWS representative is likely to be able to supply more examples of laboratories and laboratory informatics developers that use or have used AWS.

2. Can your solution readily integrate with our other systems and business processes, making it easier for our end users to perform their tasks?

It will ultimately be up to your organization to get an answer tailored to your systems and business processes. However, this much can be said about AWS integrations. AWS offers a variety of Application Integration services, described as "a suite of services that enable communication between decoupled components within microservices, distributed systems, and serverless applications." This includes management for application programming interfaces, event-driven architectures, messaging, data flows, and serverless workflows. Additionally, AWS applies a variety of techniques to integrate with existing on-premises system, including AWS Outposts, as well as the combination of AWS DataSync with File Gateway. Another document worth examining is AWS' eBook on building a hybrid cloud strategy.

3. What is the average total historical downtime for the service(s) we're interested in?

You'll largely have to ask this of AWS and see what response they give you. That said, third parties like StatusGator have been monitoring AWS downtime for years and make for one possible option to assess the types of historical downtime AWS has seen. Historically, AWS outages have garnered a number of headlines over the years, pretty much every year since at least 2011. One must keep in mind, however, that these reported outages affect only certain regions or services, not the entirety of AWS. Which is why it's important to get numbers from an AWS representative about, realistically, what sort of outage you should expect for your specific services, keeping in mind how AWS measures uptime percentages in its service agreements.

4. Do we receive comprehensive downtime support in the case of downtime?

AWS does not make this answer clear. However, the answer is likely tied to what after-sales support plan you choose. Confirm with AWS what downtime support they provide based on the services your organization are interested in.

5. Where are your servers located, and how is data securely transferred to and from those servers?

AWS has 80 Availability Zones, each with one or more discrete data centers, with 15 more Availability Zones planned (as of April 2021). These zones are distributed in various locations around the world, with Africa and South America the least represented. AWS uses its content delivery network Amazon Cloudfront, which can "securely deliver content with low latency and high transfer speeds." Security capabilities for Cloudfront include field-level encryption, HTTPS, and multiple other layers of Amazon protection. When moving data to and from on-premises and AWS systems, AWS provides AWS DataSync, which ensures "end-to-end security, including data encryption and data integrity validation" to "simplify and accelerate secure data migrations." Data in motion is encrypted using a trimmed-down version of Transport Layer Security (TLS) called s2n, designed "to provide you with network encryption that is easier to understand and that is fully auditable." Other protections are in place as well, as seen in the security portion of AWS' Well-Architected Framework. As for data localization and residency requirements, an AWS eBook on the topic addresses some elements of this topic, largely in the scope of Amazon Outposts; discuss the topic further with an AWS representative.

6. Who will have access to our data (including subcontractors), and what credentials, certifications, and compliance training do they have?

AWS discusses personnel and third-party access management in regards to physical data security on its data center controls page. However, it does not reference the specific certifications and training required for those who have permission to access your data. You will have to inquire with AWS about these considerations when asking this question.

7. Will our sensitive and regulated data be stored on a machine dedicated to complying with the necessary regulations?

Not all AWS machines have the same controls on them; it will depend on the region, product, and compliance requirements of your lab. That said, verify with a representative that the machine your data will land on meets all the necessary regulations affecting your data.

8. How segregated is our cloud data from another customer's, i.e., will lapses of security of another customer's cloud affect our cloud? (It typically won't, but asking the question will hopefully prompt the provider to better explain how your data is segregated.)

Like Alibaba, AWS have moved past a paradigm of physical separation of data pools. In 2020, writing for AWS, Hyun and Anderson updated their whitepaper on logical separation on AWS, addressing how "identity management, network security, serverless and containers services, host and instance features, logging, and encryption" can fill the same shoes as physical separation, while also providing a U.S. Department of Defense use case that highlights logical separation as meeting physical separation intent.

However, the concept of tenant isolation is addressed by AWS in multiple ways, from whitepapers to training courses and videos. The primary whitepaper addresses the concepts and architecture behind AWS' tenant isolation practices, primarily as they relate to software as a service (SaaS). Further technical details on how your data is segregated, if required, may be garnered in discussion with AWS.

9. Do you have documented data security policies?

AWS documents its security practices in several places:

• Introduction to AWS Security whitepaper
• AWS security page
• AWS trust center

Some security-related documents, like the SOC 2 report, may not be publicly available, requiring direct discussion with an AWS representative to obtain them.

10. How do you test your platform's security?

According to Amazon, customers are allowed to perform penetration testing of eight of its services without prior approval, though "[c]ustomers are not permitted to conduct any security assessments of AWS infrastructure, or the AWS services themselves." Other types of testing that are allowed, with restrictions, include network stress testing, DDoS simulation testing, and other simulated events. Amazon also appears to have a bug bounty program, managed by HackerOne. As for AWS running attack-and-defense drills or breach and attach simulations on its own infrastructure, no public information could be found regarding this. You'll have to discuss this topic with an AWS representative.

11. What are your policies for security audits, intrusion detection, and intrusion reporting?

Audits: Per AWS: "AWS regularly undergoes independent third-party attestation audits to provide assurance that control activities are operating as intended. More specifically, AWS is audited against a variety of global and regional security frameworks dependent on region and industry. AWS participates in over 50 different audit programs." This is demonstrated by its compliance credentials (e.g., see its trust center). AWS also provides guidance for customers conducting security audits of their own configurations, etc.

Intrusion detection and reporting: AWS details its intrusion detection and prevention systems for its EC2 products in a two-page brochure. They state that these tools are capable of "alerting administrators of possible incidents, logging information, and reporting attempts," and are able to "actively prevent or block intrusions that are detected." AWS also has Amazon GuardDuty for Amazon S3 instances, able "to identify unusual activity within your accounts, analyze the security relevance of the activity, given the context in which it was invoked, and apply predictive probability to make a final verdict on whether that activity is sufficiently anomalous to warrant investigation." Confirm the intrusion detection and reporting services available to you for the services you plan to use.

12. What data logging information is kept and acted upon in relation to our data?

AWS has several data logging tools for customers, including Centralized Logging, Amazon CloudWatch, and AWS CloudTrail. AWS makes its data privacy policy relatively clear; however, AWS doesn't appear to make it publicly clear if they use these tools for their own data logging, let alone what they do with data logs related to your data. (They only state that they automatically collect "offering usage, occurrences of technical errors, diagnostic reports, your settings preferences, backup information, API calls, and other logs.") Be sure an AWS representative is clear about what logging information they collect and use as it relates to your data.

13. How thorough are those logs and can we audit them on-demand?

Most AWS documentation references managing and viewing logs related to your own activities. However, unlike Alibaba, it's unclear if you are able to audit internal AWS logs on-demand. This is a conversation to have with an AWS representative.

14. For HIPAA-eligible data (e-PHI) we may have, will you sign a business associate agreement?

Yes, AWS will sign a business associate agreement. Consult their HIPAA compliance page for more details on their approach to HIPAA compliance.

15. What happens to our data should the contract expire or be terminated?

The AWS base agreement states:

Unless we terminate your use of the Service Offerings pursuant to Section 7.2(b), during the 30 days following the Termination Date:

(i) we will not take action to remove from the AWS systems any of Your Content as a result of the termination; and

(ii) we will allow you to retrieve Your Content from the Services only if you have paid all amounts due under this Agreement.

However, clarify this policy in full with an AWS representative.

16. What happens to our data should you go out of business or suffer a catastrophic event?

It's not publicly clear how AWS would handle your data should they go out of business; consult with an AWS representative about this topic. As for catastrophic events, most documentation from AWS seems to address how you, the customer, should address disaster recovery, but little discusses AWS' own approach to catastrophic events. Like Alibaba, AWS uses three zones for redundancy: "All EBS volumes are designed for 99.999% availability. Amazon S3 objects are stored across a minimum of three Availability Zones providing 99.999999999% durability of objects over a given year. Regardless of your cloud provider, there is the potential for failures to impact your workload. Therefore, you must take steps to implement resiliency if you need your workload to be reliable." It's highly unlikely that all three zones would be affected in an catastrophic event. However, if this is a concern, discuss further data redundancy with an AWS representative.

17. Can we use your interface to extract our data when we want, and in what format will it be?

AWS doesn't make it publicly clear how data migration from AWS to another cloud service would work. However, they advertise their AWS DataSync service "for moving data between on-premises storage systems and AWS Storage services, as well as between AWS Storage services." They also offer a database migration service from your systems to AWS. But AWS doesn't appear to address migrating data from their systems. Your data would presumably be in some AWS database format. One article author has even stated that transferring data out of AWS costs money, though it's not clear if this is true. It's unclear whether or not a third-party cloud transfer service (e.g., Cloudsfer) would be required or useful when moving from AWS to another cloud service. In the end, if there are still questions on this topic, discuss it with an AWS representative.

18. Are your support services native or outsourced/offshored?

It is unclear if support personnel are local to the customer or if support is outsourced to another business and country. Discuss this with an AWS representative.

Managed security services

AWS doesn't appear to explicitly advertise "managed security services" (though it references third-party MSSP parterners). AWS does, however, offer a standard managed services portfolio through its AWS Managed Services offering. Security and network management is offered as services of AWS Managed Services, but the breadth of that security management is dependent on which operations plan is selected: Accelerate or Advanced. At both levels, security monitoring is provided using AWS GuardDuty/Amazon Macie. However, it's security conformance, IAM and security review, access management, managed firewall, endpoint protection, and network configuration varies depending on the plan chosen. Consult the plan feature table on AWS to learn more.

Additional information

Documentation and other media

• Architecting for HIPAA whitepaper
• Disaster Recovery of Workloads whitepaper
• Introduction to AWS Security whitepaper

External links

• Amazon Web Services architecture framework or description
• Amazon Web Services Managed Services
• Amazon Web Services shared responsibility model
• Amazon Web Services trust center