Ernst & Young LLP
Suite 1600
560 Mission Street
San Francisco, CA
94104-2907

Tel: +1 415 894 8000
Fax: + 415 894 8099

Report of Independent Accountants
To the Management of AWS:
We have examined the assertion by the management of Amazon Web Services Inc. (AWS),
that in providing its Certification Authority (CA) services in Seattle, Washington known as
Starfield Services Root Certificate Authority as of July 24, 2015, AWS has:••

Disclosed its Business, Key Life Cycle Management, Certificate Life Cycle Management
and CA Environment Controls practices:−

Certification Practice Statement and−Certificate Policy

Maintained effective controls to provide reasonable assurance that:−AWS’ Certification Practice Statement was consistent with its Certificate Policy;−

AWS provides its services in accordance with its Certificate Policy and Certification
Practice Statement;−

The integrity of keys and certificates it managed was established and protected
throughout their life cycles;−

Subordinate CA certificate requests are accurate, authenticated, and approved;−

Logical and physical access to CA systems and data was restricted to authorizedindividuals;−

The continuity of key and certificate management operations was maintained; and−CA systems development, maintenance and operations were properly authorized
and performed to maintain CA systems integrity,

based on the Trust Service Principles and Criteria for Certification Authorities, Version 2.0.
AWS’ management is responsible for its assertion. Our responsibility is to express an opinion
on management’s assertion based on our examination.
Our examination was conducted in accordance with attestation standards established by theAmerican Institute of Certified Public Accountants, and accordingly, included (1) obtaining an
understanding of AWS’ key and certificate life cycle management business practices and its
controls over key and certificate integrity, over the authenticity and privacy of subscriber andrelying party information, over the continuity of key and certificate life cycle management
operations, and over development, maintenance and operation of systems integrity, (2)selectively testing transactions executed in accordance with disclosed key and certificate life
cycle management business, (3) testing and evaluating the operating effectiveness of thecontrols, and (4) performing such other procedures as we considered necessary in thecircumstances. We believe that our examination provides a reasonable basis for our opinion.

A member firm of Ernst & Young Global Limited

The relative effectiveness and significance of specific controls at AWS and their effect on
assessments of control risk for subscribers and relying parties are dependent on theirinteraction with the controls, and other factors present at individual subscriber and relying
party locations. We have performed no procedures to evaluate the effectiveness of controls
at individual subscriber and relying party locations.
Because of the nature and inherent limitations of controls, AWS ability to meet the
aforementioned criteria may be affected. For example, control may not prevent, or detectand correct, error, fraud, unauthorized access to systems and information, or failure tocomply with internal and external policies or requirements. Also the projection of any
conclusions based on our findings to future periods is subject to the risk that changes mayalter the validity of such conclusions.
In our opinion, as of July 24, 2015, AWS’ management’s assertion referred to above is fairly
stated, in all material respects, based on the Trust Service Principles and Criteria for
Certification Authorities, Version 2.0.
AWS has not issued any Subordinate CAs or cross-signed any CAs for the Starfield Services
Root Certificate Authority - G2. Since AWS does not currently operate subordinate CAs thecriteria relevant to Subscriber information under Principle 6: Certificate Life Cycle
Management Controls (properly authenticated) was not applicable.
This report does not include any representation as to the quality of AWS’ CA services beyond
those covered by the Trust Service Principles and Criteria for Certification Authorities,
Version 2.0, nor the suitability of any of AWS’ services for any customer’s intended purpose.

August 28, 2015

A member firm of Ernst & Young Global Limited