Ernst & Young LLP
Suite 1600
560 Mission StreetSan Francisco, CA94104-2907

Tel: +1 415 894 8000
Fax: + 415 894 8099

Report of Independent Accountants
To the Management of AWS:
We have examined the assertion by the management of Amazon Web Services Inc. (AWS),
that in providing its Certification Authority (“CA”) services in Seattle, Washington for its
Extended Validation (“EV”) SSL Certification Authority services as of July 24, 2015, AWS
has:•Disclosed its EV SSL Certificate practices and procedures, and its commitment toprovide EV SSL Certificates in conformity with the applicable CA/Browser Forum
Guidelines, and•

Maintained effective controls to provide reasonable assurance that the integrity ofkeys and EV SSL certificates it managed was established and protected throughout
their life cycles

for the Starfield Services Root Certificate Authority - G2, based on the WebTrust® Principles
and Criteria for Certification Authorities – Extended Validation SSL Version 1.4.5.
AWS’ management is responsible for its assertion. Our responsibility is to express an opinion
on management’s assertion based on our examination.
Our examination was conducted in accordance with attestation standards established by theAmerican Institute of Certified Public Accountants (AICPA), and accordingly, included (1)obtaining an understanding of AWS’s EV SSL Certificate practices and procedures and its
relevant controls over the issuance, renewal and revocation of EV certificates; (2) testingtransactions executed in accordance with disclosed EV Code Signing Certificate practices; (3)testing and evaluating the operating effectiveness of the controls; and (4) performing suchother procedures as we considered necessary in the circumstances. We believe that ourexamination provides a reasonable basis for our opinion.
Because of the nature and inherent limitations of controls, AWS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detectand correct, error, fraud, unauthorized access to systems and information, or failure tocomply with internal and external policies or requirements. Also, the projection of any
conclusions based on our findings to future periods is subject to the risk that changes mayalter the validity of such conclusions.
In our opinion, as of July 24, 2015, AWS management’s assertion, as set forth in the firstparagraph, is fairly stated, in all material respects, based on the WebTrust Principles andCriteria for Certification Authorities – Extended Validation SSL Version 1.4.5.
AWS has not issued any Subordinate CAs or cross-signed any CAs for the Starfield Services
Root Certificate Authority - G2. Since AWS does not currently operate subordinate CAs thecriteria relevant to Extended Validation Subscriber information under Principle 2: ServiceIntegrity (properly collected, authenticated and verified) was not applicable.

A member firm of Ernst & Young Global Limited

The relative effectiveness and significance of specific controls at AWS and their effect on
assessments of control risk for subscribers and relying parties are dependent on theirinteraction with the controls, and other factors present at individual subscriber and relying
party locations. We have performed no procedures to evaluate the effectiveness of controls
at individual subscriber and relying party locations.
This report does not include any representation as to the quality of AWS’ services beyond
those covered by the WebTrust Principles and Criteria for Certification Authorities – Extended
Validation SSL Version 1.4.5 criteria, nor the suitability of any of AWS’ services for any
customer's intended purpose.

August 28, 2015

A member firm of Ernst & Young Global Limited