Ernst & Young LLP
Suite 1600
560 Mission Street
San Francisco, CA94104-2907

Tel: +1 415 894 8000
Fax: + 415 894 8099

Report of Independent Accountants
To the Management of AWS:
We have examined the assertion by the management of Amazon Web Services Inc. (AWS),
that in providing its SSL Certification Authority (“CA”) services in Seattle, Washington, as ofMay 27, 2015, AWS has:
·Disclosed its Certificate practices and procedures and its commitment to provide SSL
Certificates in conformity with the applicable CA/Browser Forum Guidelines, and·Maintained effective controls to provide reasonable assurance that:- The integrity of keys and certificates it manages was established and protected
throughout their life cycles;- Logical and physical access to CA systems and data was restricted to authorizedindividuals;- The continuity of key and certificate management operations was maintained;- CA systems development, maintenance and operations were properly authorized
and performed to maintain CA systems integrity; and- Met the Network and Certificate System Security Requirements as set forth by theCA/Browser Forumfor the Amazon Root 1, Amazon Root 2, Amazon Root 3 and Amazon Root 4 based on theWebTrust® Principles and Criteria for Certification Authorities – SSL Baseline with Network
Security Version 2.0.
AWS’ management is responsible for its assertion. Our responsibility is to express an opinion
on management’s assertion based on our examination.
Our examination was conducted in accordance with attestation standards established by theAmerican Institute of Certified Public Accountants, and accordingly, included (1) obtaining an
understanding of AWS’ key and SSL certificate life cycle management business practices andits controls over key and SSL certificate integrity, over the continuity of key and certificatelife cycle management operations, and over the development, maintenance, and operation ofsystems integrity; (2) testing transactions executed in accordance with disclosed key andcertificate life cycle management business practices; (3) testing and evaluating the operating
effectiveness of the controls; and (4) performing such other procedures as we considerednecessary in the circumstances.
We believe that our examination provides a reasonable basis for our opinion.

A member firm of Ernst & Young Global Limited

The relative effectiveness and significance of specific controls at AWS and their effect onassessments of control risk for subscribers and relying parties are dependent on theirinteraction with the controls, and other factors present at individual subscriber and relying
party locations. We have performed no procedures to evaluate the effectiveness of controls
at individual subscriber and relying party locations.
Because of the nature and inherent limitations of controls, AWS’ ability to meet theaforementioned criteria may be affected. For example, controls may not prevent, or detectand correct, error, fraud, unauthorized access to systems and information, or failure tocomply with internal and external policies or requirements. Also, the projection of anyconclusions based on our findings to future periods is subject to the risk that changes mayalter the validity of such conclusions.
In our opinion, as of May 27, 2015, AWS’ management’s assertion, as set forth in the firstparagraph, is fairly stated, in all material respects, based on the WebTrust Principles andCriteria for Certification Authorities – SSL Baseline with Network Security Version 2.0.
AWS has not issued any Subordinate CAs for the Amazon Root CA 1, Amazon Root CA 2,Amazon Root CA 3 and Amazon Root CA 4. Since AWS does not currently operate
subordinate CAs the criteria relevant to Subscriber information under Principle 2: Service
Integrity (properly collected, authenticated and verified) was not applicable.
This report does not include any representation as to the quality of AWS’ services beyond
those covered by the WebTrust Principles and Criteria for Certification Authorities – SSL
Baseline with Network Security Version 2.0 criteria, nor the suitability of any of AWS services
for any customer's intended purpose.

June 3, 2015

A member firm of Ernst & Young Global Limited