You cannot use AWS to hack into systems you don't own, disrupt other AWS customers' services, or run security scans against systems without explicit permission from the system owner.
Security professionals and researchers who use AWS for legitimate penetration testing or vulnerability research must obtain explicit authorization from both the system owner and AWS before conducting such activities, or risk immediate account termination and potential CFAA criminal exposure.
Cross-platform context
See how other platforms handle Prohibition on Unauthorized System Access and Network Interference and similar clauses.
Compare across platforms →This provision directly references conduct prohibited by the Computer Fraud and Abuse Act, meaning violations expose users to both AWS account termination and federal criminal prosecution.
1) REGULATORY FRAMEWORK: This provision directly implicates the Computer Fraud and Abuse Act (CFAA, 18 U.S.C. § 1030), which criminalizes unauthorized computer access and carries penalties up to 10 years imprisonment for first offenses. The Electronic Communications Privacy Act (ECPA, 18 U.S.C. § 2511) applies to interception of network communications. EU equivalents include Directive 2013/40/EU on attacks against information systems. The primary enforcement authority is the DOJ Computer Crime and Intellectual Property Section (CCIPS) and FBI Cyber Division. 2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.