Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
Customers are required to defend and indemnify AWS, its affiliates, and their personnel against any third-party losses arising from customer or end user use of the services, content violations, applicable law breaches, or disputes between the customer and their end users. The indemnification obligation extends to reimbursing AWS for attorney fees and staff time spent responding to subpoenas or legal orders related to covered claims at AWS's then-current hourly rates.
This analysis describes what AWS's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision requires customers to bear the cost of defending AWS against third-party claims arising from customer account activity, including unauthorized use by third parties, end user conduct, and customer content. The obligation to reimburse AWS hourly staff time in response to subpoenas creates a potential cost exposure that is not capped by the damages limitation in Section 9.
Under this clause, customers assume responsibility for defending AWS against third-party claims connected to their account activity, end user actions, and content, including reimbursing AWS at its then-current hourly rates for time spent responding to legal process related to those claims. The agreement states this obligation applies to the extent permitted by applicable law.
Cross-platform context
See how other platforms handle Broad Customer Indemnification Obligation and similar clauses.
Compare across platforms →Monitoring
AWS has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"To the extent permitted by applicable law, you will defend, indemnify, and hold harmless us, our affiliates and licensors, and each of their respective employees, officers, directors, and representatives from and against any Losses arising out of or relating to any third-party claim concerning: (a) your or any End Users' use of the Services (including any activities under your AWS account and use by your employees and personnel); (b) breach of this Agreement or violation of applicable law by you, End Users or Your Content; or (c) a dispute between you and any End User. You will reimburse us for reasonable attorneys' fees, as well as our employees' and contractors' time and materials spent responding to any third party subpoena or other compulsory legal order or process associated with third party claims described in (a) through (c) above at our then-current hourly rates.Excerpt from AWS's Customer Agreement
1. REGULATORY LANDSCAPE: Indemnification clauses in commercial B2B agreements are generally permissible under U.S. contract law; however, the scope of this provision, which extends to end user conduct and unauthorized account activity, may interact with consumer protection frameworks in jurisdictions where customers are individuals or small businesses. GDPR and applicable data protection law may constrain the extent to which customers can be held responsible for data processing activities conducted through AWS infrastructure that were not authorized or anticipated. 2. GOVERNANCE EXPOSURE: High. The indemnification obligation covering all end user activity and third-party claims related to customer content is broad in scope. The additional obligation to reimburse AWS hourly staff rates for subpoena response, which is not subject to the aggregate damages cap in Section 9.2, creates an uncapped cost exposure category for enterprise customers. 3. JURISDICTION FLAGS: EU and EEA customers may find that certain elements of this indemnification clause interact with consumer protection directives and data protection obligations in ways that limit enforceability. In jurisdictions with statutory limitations on contractual indemnification scope, the clause's application may be constrained by applicable law as acknowledged by the agreement's own qualifying language. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement and legal teams should assess whether this indemnification obligation is reflected in downstream agreements with end users and whether adequate insurance coverage is in place. The subpoena reimbursement obligation at AWS hourly rates warrants specific review, as it falls outside the Section 9.2 damages cap and could represent material uncapped liability in the event of significant legal proceedings involving customer accounts. 5. COMPLIANCE CONSIDERATIONS: Organizations should review their end user agreements to ensure adequate pass-through indemnification provisions and should assess whether their cyber liability or commercial general liability insurance policies cover indemnification obligations of this scope. Legal teams should confirm whether the subpoena reimbursement obligation at AWS's then-current hourly rates has been evaluated as part of total cost of ownership and risk assessment for AWS deployments.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision requires customers to bear the cost of defending AWS against third-party claims arising from customer account activity, including unauthorized use by third parties, end user conduct, and customer content. The obligation to reimburse AWS hourly staff time in response to subpoenas creates a potential cost exposure that is not capped by the damages limitation in Section 9.
Under this clause, customers assume responsibility for defending AWS against third-party claims connected to their account activity, end user actions, and content, including reimbursing AWS at its then-current hourly rates for time spent responding to legal process related to those claims. The agreement states this obligation applies to the extent permitted by applicable law.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by AWS.