AWS

Key findings

• Acceptance happens by use, not by a separate signature or checkbox: using AWS content or the services binds you to the Intellectual Property License.
• The agreement is a chain of incorporated documents, so reading this file alone does not tell you your full obligations.
• Using one service can automatically pull you into the terms and fees of another service you did not deliberately sign up for.
• The document carries a dated version stamp, which helps you prove what you agreed to.
• Terms are grouped by named AWS service, so you can find the sections that apply to what you actually use.
• No plain-language summary, no age requirement, and no acceptance checkbox described anywhere in this text.

Evidence from the document

Recommendations

• Read the AWS Customer Agreement alongside this document, because the core contract terms are there, not here.
• Before enabling a new AWS service, search this document for that service name and read only that section.
• Save a dated copy of the Service Terms when you sign a significant commitment, since the version stamp is your only proof of what applied.
• Check whether any associated services get pulled in automatically, because they carry their own fees and terms.

Key findings

• Notice and a two business day cure period apply before AWS removes prohibited content, with prompt notice afterward if it had to act immediately.
• Multiple services can be suspended or terminated at any time without prior notice, including beta services, Amazon Sidewalk, RTB Fabric, and Lightsail data services.
• No appeal or human review process for suspension or termination is described anywhere in this document.
• Several services give 30 days notice before deleting inactive data, including SimpleDB, Lambda, Cognito, and GameLift Servers.
• After account closure your content is deleted according to technical documentation, not according to any fixed retention period stated in the contract.
• If WorkMail or paid Chime access ends, your mailboxes and stored material may simply be deleted.

Evidence from the document

Recommendations

• Keep your own backups of anything stored in AWS, because contractual retention after closure is defined by documentation rather than a fixed promise.
• Read the technical documentation for each service you rely on to learn its actual post-termination deletion timeline.
• Respond within two business days to any AWS prohibited content notice, since that window is what protects you from suspension.
• Avoid running anything business critical on beta services or Amazon Sidewalk, both of which can be cut off without notice.

Key findings

• You own the output you generate with AWS AI services, and custom models you fine-tune are exclusive to you.
• AWS commits not to use your content or account-specific usage data to compete with your products and services.
• Professional Services deliverables are licensed to you under Creative Commons Attribution 4.0 and Apache 2.0, which is unusually generous.
• Content processed by many services is used to develop and improve AWS technology unless you configure an opt-out policy.
• AWS takes outright ownership of any feedback and test observations you provide about beta services.
• In B2B Data Interchange, content you contribute to a shared portal carries an irrevocable, unrestricted license to everyone with portal access unless you negotiate different terms first.

Evidence from the document

Recommendations

• Configure an AI services opt-out policy in AWS Organizations before you route sensitive or proprietary content through AI and machine learning features.
• Negotiate explicit license terms before contributing content to a shared B2B Data Interchange portal, because the default grant is irrevocable.
• Treat any feedback you give on beta services as content you are giving away, since AWS owns it outright.
• Keep records showing you created your own content, since AWS makes no attribution commitments.

Key findings

• Standard Contractual Clauses, UK GDPR, Swiss, CCPA, and EU Data Act addenda are all incorporated, giving genuine cross-border transfer protections.
• A consistent opt-out is offered through AWS Organizations for content used to improve AWS machine learning, but it is opt-out rather than opt-in.
• Content that is not personal data may be used to improve AWS and affiliate AI technologies generally, not just the service you are using.
• Face vectors created by Rekognition are stored in a secure environment, used only at your direction, and are not transferred to third parties.
• Amazon Bedrock stores service inputs and outputs for up to 30 days for abuse detection, and suspected child sexual abuse material may be reviewed and reported to authorities.
• Chime stores all user information, including chat messages and meeting recordings, in United States regions regardless of where you operate.
• You, not AWS, must provide privacy notices and obtain consents from your own end users.

Evidence from the document

Recommendations

• Turn on the AI services opt-out policy in AWS Organizations if you do not want your content used to train AWS models.
• Review the Data Processing Addendum and the Standard Contractual Clauses directly if you handle European personal data.
• Check where each service stores data before using it for regulated workloads, since some services store everything in the United States.
• Build your own privacy notice and consent flow for your end users, because the contract makes that your obligation and not AWS's.

Key findings

• Reserved capacity commitments across EC2, RDS, ElastiCache, Redshift, DynamoDB, and Bedrock are noncancellable and nonrefundable for the full selected term.
• Capacity Blocks for machine learning cannot be cancelled or modified at all, and the full price is nonrefundable.
• Price changes do not apply retroactively to capacity you already reserved.
• If AWS passes through a Windows or Red Hat license increase, you get 30 days notice and can exit with a pro rata refund.
• Fees keep accruing for SNS, SES, Pinpoint, WorkMail, and MQ even when delivery is blocked or delayed for reasons outside AWS control.
• The currency service builds its own fee into the exchange rate rather than showing it as a separate line item.
• Service credits for downtime exist but you have to request them yourself rather than receiving them automatically.

Evidence from the document

Recommendations

• Size reserved capacity and savings plans conservatively, because you owe the full term even if you stop using AWS entirely.
• Request service credits promptly whenever a service breaches its Service Level Agreement, since credits are not applied automatically.
• Compare the AWS currency service exchange rate against your bank's rate before agreeing to be invoiced in a non-dollar currency.
• Budget for messaging fees that continue even when delivery fails, and monitor delivery rates independently.

Key findings

• Beta services and beta regions are provided as is, with liability capped at the amount you actually paid for them, which can be zero for free previews.
• AWS accepts no liability at all for third-party patent claims relating to encoding, decoding, or transcoding with Kinesis Video Streams, GameLift Streams, or the Chime SDK.
• AWS accepts no liability for disclosure of the public DNS records that Route 53 makes available.
• Neither AWS nor its affiliates are liable for any damages from failed emergency services calls through Chime or Connect.
• Professional Services claims must be raised in writing within 90 days, and your only remedy is re-performance or a refund of fees.
• Third-party software disclaimers from Microsoft, Oracle, Red Hat, and Progress stack on top of the AWS ones, some on an as is with all faults basis.
• One meaningful counterweight: AWS's generative AI defense obligations are expressly not subject to any damages cap.

Evidence from the document

Recommendations

• Do not run production or safety-critical workloads on beta services, where AWS's liability may be effectively zero.
• Carry your own insurance or licensing for video codec patents, since AWS excludes all liability for those claims.
• Raise any Professional Services complaint in writing well inside the 90 day window, or you lose the remedy entirely.
• Never rely on AWS communications services for emergency calling, and tell your own users the same in writing.

Key findings

• AWS defends you and your officers and directors against third-party intellectual property claims over generative AI output from listed services.
• That defense obligation is expressly not subject to any damages cap, which is rare.
• The generative AI indemnity has seven exclusions and is the sole and exclusive remedy for such claims, so its practical reach is narrower than it first appears.
• AWS controls the defense but must get your consent, not to be unreasonably withheld, before settling.
• You must release and indemnify AWS for emergency calling failures, including ones caused by your loss of power or internet access, which are outside your control.
• Marketplace disputes with third-party sellers are entirely yours, and you must hold AWS harmless for all related claims.
• The seller tax indemnity in the Reserved Instance Marketplace is fault-based and narrow, which is fair.

Evidence from the document

Recommendations

• Enable the available content filters and follow the documented guidance, since disabling them voids the AWS generative AI defense.
• Check whether the specific model you use appears on the Indemnified Generative AI Services list before relying on that protection.
• Treat the emergency calling indemnity as real exposure and arrange independent emergency access for your users.
• Handle AWS Marketplace purchases as direct relationships with the seller, because AWS takes no responsibility for those disputes.

Key findings

• AWS can add or modify beta service terms, including usage limits, at any time.
• Support for third-party identity providers, trust providers, push notification platforms, and wallet providers can be changed or removed at any time without prior notice.
• Price changes are consistently prospective and do not reach capacity you already reserved, which is a real and repeated protection.
• Microsoft and Red Hat license increases come with 30 days notice plus the option to convert or exit with a pro rata refund.
• You are bound by current technical documentation posted on the AWS site, which AWS can update without notifying you.
• The document carries a last updated date but no changelog or archive of prior versions.
• Many notice promises are softened to where practicable under the circumstances rather than a firm commitment.

Evidence from the document

Recommendations

• Subscribe to AWS service announcements and health notifications, because feature deprecations can arrive without contractual notice.
• Archive the technical documentation you depend on, since your obligations shift when AWS updates it.
• Avoid designing around a single third-party identity provider or integration that AWS can drop without warning.
• Confirm your reserved pricing in writing when you commit, and keep the invoice as proof that later increases do not apply.

Key findings

• No arbitration clause, class action waiver, jury trial waiver, or forum selection clause appears anywhere in this document.
• Your contracting party is a regional Amazon entity determined by your country, which can put your counterparty closer to your own courts.
• Microsoft and Oracle are named as intended third-party beneficiaries with the right to enforce provisions against you directly.
• You must act as exporter and importer of record for your own data and technology, and AWS will not participate in those procedures.
• Disputes involving AWS Marketplace sellers must be pursued directly against the seller, not against AWS.
• Your contracting party can change over time, with the new entity taking over invoicing.

Evidence from the document

Recommendations

• Read the dispute resolution and governing law sections of the AWS Customer Agreement, since none of that appears in the Service Terms.
• Identify which regional AWS entity is your actual counterparty, because it determines who you would sue and where.
• Get export control advice before shipping Snow devices or moving controlled technology, since AWS takes no part in that process.
• Recognise that software vendors such as Microsoft and Oracle can enforce these terms against you directly.