Ernst & Young LLP
Suite 1600
560 Mission Street
San Francisco, CA94104-2907

Tel: +1 415 894 8000
Fax: + 415 894 8099

Report of Independent Accountants
To the Management of AWS:
We have examined the assertion by the management of Amazon Web Services Inc. (AWS),
that in providing its SSL Certification Authority (“CA”) services in Seattle, Washington, as ofJuly 24, 2015, AWS has:
•Disclosed its Certificate practices and procedures and its commitment to provide SSL
Certificates in conformity with the applicable CA/Browser Forum Guidelines, and•

Maintained effective controls to provide reasonable assurance that:− The integrity of keys and certificates it manages was established and protected
throughout their life cycles;− Logical and physical access to CA systems and data was restricted to authorizedindividuals;− The continuity of key and certificate management operations was maintained;− CA systems development, maintenance and operations were properly authorized
and performed to maintain CA systems integrity; and− Met the Network and Certificate System Security Requirements as set forth by theCA/Browser Forumfor the Starfield Services Root Certificate Authority - G2 based on the WebTrust® Principlesand Criteria for Certification Authorities – SSL Baseline with Network Security Version 2.0.
AWS’ management is responsible for its assertion. Our responsibility is to express an opinion
on management’s assertion based on our examination.
Our examination was conducted in accordance with attestation standards established by theAmerican Institute of Certified Public Accountants, and accordingly, included (1) obtaining an
understanding of AWS’ key and SSL certificate life cycle management business practices andits controls over key and SSL certificate integrity, over the continuity of key and certificate
life cycle management operations, and over the development, maintenance, and operation ofsystems integrity; (2) testing transactions executed in accordance with disclosed key andcertificate life cycle management business practices; (3) testing and evaluating the operating
effectiveness of the controls; and (4) performing such other procedures as we considerednecessary in the circumstances.
We believe that our examination provides a reasonable basis for our opinion.

A member firm of Ernst & Young Global Limited

The relative effectiveness and significance of specific controls at AWS and their effect on
assessments of control risk for subscribers and relying parties are dependent on theirinteraction with the controls, and other factors present at individual subscriber and relyingparty locations. We have performed no procedures to evaluate the effectiveness of controls
at individual subscriber and relying party locations.
Because of the nature and inherent limitations of controls, AWS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detectand correct, error, fraud, unauthorized access to systems and information, or failure tocomply with internal and external policies or requirements. Also, the projection of anyconclusions based on our findings to future periods is subject to the risk that changes mayalter the validity of such conclusions.
In our opinion, as of July 24, 2015, AWS’ management’s assertion, as set forth in the firstparagraph, is fairly stated, in all material respects, based on the WebTrust Principles andCriteria for Certification Authorities – SSL Baseline with Network Security Version 2.0.
AWS has not issued any Subordinate CAs or cross-signed any CAs for the Starfield Services
Root Certificate Authority - G2. Since AWS does not currently operate subordinate CAs thecriteria relevant to Subscriber information under Principle 2: Service Integrity (properlycollected, authenticated and verified) was not applicable.
This report does not include any representation as to the quality of AWS’ services beyond
those covered by the WebTrust Principles and Criteria for Certification Authorities – SSL
Baseline with Network Security Version 2.0 criteria, nor the suitability of any of AWS services
for any customer's intended purpose.

August 28, 2015

A member firm of Ernst & Young Global Limited