AWS Global Export Compliance

AWS is responsible for the logical and physical compliance of the cloud infrastructure and our services, and the compliance for AWS’s own controlled content. Customers are responsible for the content they bring to AWS, the services they choose to use, and how they configure it to meet their compliance obligations. Please see the AWS Shared Responsibility Model for more information.

Although the applicability of export laws to cloud services can vary by country, generally, the following are the three principles for how export controls apply in the cloud context:

1. The provision of cloud services (including SaaS and IaaS) is not an export-controlled activity.  Use of cloud hosted software is not an export-controlled activity as long as the software is not downloaded.
   • See U.S. Department of Commerce, Bureau of Industry and Security Advisory Opinions from January 13, 2009,  January 11, 2011 and November 13, 2014.
2. The cross-border transmission of export-controlled content or software, using end-to-end encryption, is not an export-controlled activity until the export-controlled content is accessed in an unencrypted format by the end user.  This is true regardless of the location of the servers used to transit the information so long as the content is not intentionally stored in a restricted country listed in Country Group D:5.
   • See EAR Sec. 738.14 “Activities that are not exports, re-exports or transfers”.
3. Cloud users are responsible for any export compliance requirements that would arise when storing controlled content and/or transmitting it across international borders. For instance, if a cloud user transmits controlled content, without encryption, from country A to country B – and country A requires a license for sending it to country B – the cloud user would need to obtain the license for sending their controlled content to country B.
   • See U.S. Department of Commerce, Bureau of Industry and Security Advisory Opinion from November 13, 2014.