You cannot use AWS to launch or assist denial-of-service attacks, generate mass unsolicited messages, or disrupt other internet systems in any way.
Businesses running publicly accessible services on AWS must implement adequate security controls to prevent their infrastructure from being compromised and used for attacks, because a security breach that results in their AWS resources being weaponized could trigger AUP violations and account suspension even though they were the victim.
How other platforms handle this
Don't enter confidential information in your Gemini Apps conversations. For example, if you're using a Gemini app to help with code, don't paste confidential source code into the conversation. To the extent possible, please don't share information in your Gemini Apps conversations that you wouldn't ...
Other than the rights and responsibilities described in this section (Settling disputes, governing law, and courts), Google doesn't make any specific promises about the services. For example, we don't make any commitments about the content within the services, the specific functions of the services,...
THE PELOTON SERVICE OFFERS HEALTH AND FITNESS INFORMATION AND IS DESIGNED FOR EDUCATIONAL AND ENTERTAINMENT PURPOSES ONLY. YOU SHOULD CONSULT YOUR PHYSICIAN OR GENERAL PRACTITIONER BEFORE BEGINNING A NEW FITNESS PROGRAM. YOU SHOULD NOT RELY ON THIS INFORMATION AS A SUBSTITUTE FOR, NOR DOES IT REPLAC...
This provision creates broad liability for any AWS customer whose infrastructure is compromised and used by attackers to conduct DDoS attacks or spam campaigns — even if the customer did not initiate the attack, inadequate security leading to compromise could be construed as 'enabling' prohibited activity.
(1) REGULATORY FRAMEWORK: DDoS attacks constitute violations of CFAA (18 U.S.C. § 1030(a)(5), DOJ enforcement), UK Computer Misuse Act 1990 s.3, and EU Directive 2013/40/EU Art. 5. Enabling or facilitating such attacks through inadequate security may also implicate FTC Act Section 5 (unfair security practices) per FTC's LabMD and Wyndham precedents establishing that inadequate security constitutes an unfair practice. NIS2 Directive Art. 21 requires operators of essential services to implement security measures proportionate to risks, including DDoS protection. (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.