Imagine you want to build a massive Lego castle. In the past, you had to buy thousands of bricks, clear out a room in your house to store them, and hope you bought the right pieces. If you decided to stop building, you were stuck with boxes of useless plastic.

Amazon Web Services (AWS) changed that. Instead of buying bricks, you rent as many as you need from AWS. When you’re done, you hand them back and stop paying.

Most people know Amazon for the boxes on their porch, but AWS is its most profitable business. As of February 2026, AWS is the largest cloud provider, running everything from streaming services to banking apps.

What Is AWS?

AWS is a Cloud Computing provider.

Companies used to build their own server rooms: cold, noisy closets full of expensive computers. They had to pay for the hardware, the electricity to cool it, and the staff to fix it.

AWS replaced those closets with giant warehouses (data centers) all over the world. Today, it sells those services to companies so they can run websites, store customer records, and train Artificial Intelligence (AI) models without ever owning a physical server.

AWS by the numbers

As of early 2026, AWS has roughly 30% of the global cloud infrastructure market.

• Revenue: AWS generates tens of billions of dollars every quarter. For context, in Q4 2024 alone, AWS reported $28.8 billion in revenue.

• Market size: The broader cloud market reached roughly $330 billion recently.

Why does this matter to a student? When 30% of the cloud market depends on one provider, an AWS outage or security failure affects businesses everywhere.

The Auditor’s Guide: Where the Risks Are

This section is for aspiring IT auditors and risk managers.

Moving to the cloud shifts some security work to Amazon, but the customer stays responsible for most of the controls auditors test. This is called the Shared Responsibility Model.

Think of it like renting a safety deposit box at a bank. The bank (AWS) promises to guard the vault door and the building (Physical Security). But if you (the Customer) leave your key in the lock or put dangerous chemicals inside the box, that is your fault.

Auditors must focus on these 5 “Customer-Side” controls:

1. Identity and Access (Who has the keys?)

Weak or stolen logins are one of the most common ways attackers get in. Check who can log in and how they prove who they are.

• The Risk: Weak passwords or stolen credentials.

• The Fix: Multi-Factor Authentication (MFA), where you need a password and a code from your phone to get in.

2. Configuration and Posture (Is the door open?)

A misconfiguration is a setting that is wrong or unsafe.

• The Risk: Accidentally leaving a digital storage bucket “public” so anyone on the internet can see your files.

• The Fix: Scanning tools that alert you if a database is left open to the world.

3. Data Protection (Is the treasure safe?)

Even if someone steals the data, can they read it?

• The Risk: Storing sensitive customer names or health records in plain text.

• The Fix: Encryption. This scrambles the data so only authorized people can read it. Auditors also check if backups are kept separate and tested regularly.

4. Logging and Detection (Is the camera on?)

• The Risk: A hacker enters the system, steals data, and leaves without a trace.

• The Fix: Centralized logging. This records every action taken in the account so security teams can investigate incidents.

5. AI and Third-Party Services

With the boom in Generative AI (AI that creates text or images), new risks have emerged.

• The Risk: Training a smart AI model using private customer data that shouldn’t be shared.

• The Fix: Strict rules on who can query AI models and checks that third-party code doesn’t introduce hidden weaknesses.

Real-World Examples

How this looks in practice:

1. The Retailer: Runs their online store on AWS servers. They use managed databases to store your order history.

   • Audit focus: Ensuring credit card numbers are encrypted.

2. The Hospital: Uses a cloud-based system to store Electronic Health Records (EHR).

   • Audit focus: Checking data residency, which means making sure patient data stays in the country where the law requires it to be.

3. The Startup: Rents powerful AWS processors (GPUs) to train a new recommendation AI.

   • Audit focus: Reviewing who has access to the training data to prevent leaks.

Glossary of Terms

• Cloud Computing: Renting computing power and storage over the internet instead of buying it.

• Shared Responsibility: The rule that defines what Amazon secures (the hardware) vs. what you secure (your data and passwords).

• Identity and Access (IAM): The security discipline that controls who can log in and what they are allowed to do.

• Encryption: Scrambling data mathematically so it is unreadable without a secret key.

• Misconfiguration: A setting that is wrong or unsafe (e.g., leaving a digital file folder open to the public).

• Infrastructure as Code (IaC): Writing text files that automatically create cloud resources, rather than clicking buttons manually.

• Generative AI: Artificial Intelligence that creates new content (text, images, code); it requires massive cloud computing power.

Appendix: The Auditor’s Toolkit

One-Page Auditor Checklist for AWS

Use this when reviewing a client’s cloud environment.

• [ ] Asset Map: Do we know everything we own in the cloud? (You can’t protect what you don’t know exists).

• [ ] Contract Review: Have we read the contract to confirm exactly what security tasks are ours versus Amazon’s?

• [ ] Identity Check: Is Multi-Factor Authentication (MFA) turned on for everyone? Are we using “Least Privilege” (giving people only the access they strictly need)?

• [ ] Configuration Scan: Are we scanning our “Infrastructure as Code” templates for risky settings before we deploy them?

• [ ] Encryption Verification: Is data encrypted both when it is sitting still (at rest) and when it is moving (in transit)?

• [ ] Backup Test: Are backups isolated (kept separate from the main network) and have we actually tried to restore from them recently?

• [ ] Incident Drill: Have we run a “Tabletop Exercise” (a practice drill) that includes a specific cloud hack scenario?

Student Practice Exercise: The “Open Bucket” Hunt

Scenario: You are a Junior IT Auditor for “ShopSmart,” a retail company. They use AWS S3 (Simple Storage Service) to store receipts.

The Task: You need to verify if the storage buckets are safe.

1. Step 1 (Discovery): Ask the system administrator for a list of all S3 buckets.

   • What you find: A list of 5 buckets. One is named shopsmart-public-assets and one is named shopsmart-customer-receipts.

2. Step 2 (The Check): You look at the “Permissions” tab for shopsmart-customer-receipts.

   • Observation: You see a setting that says “Block Public Access: OFF“.

3. Step 3 (The Risk Analysis):

   • Question: What is the risk here?

   • Answer: Because “Block Public Access” is off, anyone on the internet who guesses the bucket name could potentially download every customer receipt.

4. Step 4 (The Recommendation):

   • Action: Write a finding report. “High Risk: Customer data storage is publicly accessible. Recommendation: Immediately enable ‘Block Public Access’ on the receipts bucket and implement a policy to prevent public buckets by default.”