Amazon Web Services Vendor Risk Assessment — Full Report

Recommended Actions

Steps to address findings for AWS

1. 1

   Obtain AWS compliance reports via the [AWS Artifact portal](https://aws.amazon.com/artifact/) — this self-service portal provides on-demand access to SOC 1 Type II, SOC 2 Type II, ISO 27001 certificates, PCI DSS Attestations of Compliance, and FedRAMP documentation. Download the most recent SOC 2 Type II report and ISO 27001 certificate and retain them with this assessment report for your audit file.

   SOC 2 Overview (AICPA)ISO 27001 StandardPCI DSS StandardsFedRAMP Marketplace
2. 2

   Document your Complementary User Entity Controls (CUECs) if AWS is within your SOC 2 audit boundary. AWS's SOC 2 report specifies controls that AWS implements and controls that customers are expected to implement (e.g., IAM least privilege, MFA enforcement, CloudTrail logging). Request the AWS SOC 2 report from Artifact, review Appendix A (CUECs), and map each control to your internal implementation evidence.

   SOC 2 Overview (AICPA)
3. 3

   Activate the Amazon Organizations AI services opt-out policy if your data handling policies require it. Log into your AWS Organizations management account, navigate to Policies > AI services opt-out policies, and apply the opt-out to your organization or specific accounts. Document the activation date and retain as a data governance record.

4. 4

   Review the full AWS subprocessor list directly at [aws.amazon.com/compliance/sub-processors/](https://aws.amazon.com/compliance/sub-processors/) to confirm completeness for your GDPR Article 28 vendor management obligations. The automated scan identified one entry; the live page may contain additional entries.

   GDPR Full TextGDPR Subprocessor Rules
5. 5

   Confirm AI data retention duration with your AWS account team or via AWS Support. The [AI opt-out policy documentation](https://docs.amazonaws.cn/en_us/organizations/latest/userguide/orgs_manage_policies_ai-opt-out.html) does not specify a retention period for AI-processed data; this detail is material for data minimization compliance under GDPR and CCPA.

   GDPR Full TextCCPA Overview (CA AG)

• The Web archive service archive data returned an anomalous first-seen date of 2026-02-05 for aws.amazon.com, which conflicts with the WHOIS registration date of 1994-11-01. This is likely a data artifact from the archive source and should not be interpreted as an indicator of a new web presence.
• Independent registry lookups for ISO 27001 (IAF CertSearch), HITRUST (HITRUST directory), and PCI DSS (PCI SSC) did not confirm vendor-attested claims. Registry matching for large multi-entity, multi-scope organizations is inherently limited; absence from a registry search result is not equivalent to absence of certification.
• AI data retention policy duration was not stated in the evidence retrieved from the AI data usage policy source; the retention policy field returned 'not_stated'. Procurement teams should request clarification on how long AI-processed data is retained.
• The subprocessor page at [aws.amazon.com/compliance/sub-processors/](aws.amazon.com) returned only 1 subprocessor (Twitch Interactive, Inc.) at time of assessment. AWS operates a much larger supply chain; this may reflect the scope of the specific page crawled rather than AWS's full subprocessor universe. Manual review of the full page is recommended.