Acceptable Use Policy

An Acceptable Use Policy, commonly abbreviated AUP, sets the boundaries for how customers and their users may use a provider’s services. In cloud computing, these boundaries apply to activities performed through resources such as virtual machines, storage, websites, and messaging systems. The policy operates alongside service agreements and applicable law; it is not a substitute for either. Its purpose includes protecting other customers, internet users, and the provider’s infrastructure from harmful or unlawful activity.

Common prohibited activities include distributing malware, operating phishing sites, sending unsolicited bulk messages, and compromising systems without authorization. The exact restrictions depend on the provider’s published policy and service-specific requirements. Engineers should check those requirements before launching workloads involving security testing, bulk email, or other activities that could resemble abuse. An authorized penetration test is not automatically prohibited, but it must remain within the provider’s testing rules and the scope authorized by the system owner.

Customers must also address misuse originating from compromised resources. For example, an attacker might steal credentials and launch a virtual machine that scans external systems or hosts a phishing page. The customer should investigate, contain the activity, preserve relevant evidence, remove unauthorized access, and correct the underlying weakness. The fact that an attacker initiated the activity does not eliminate the need for the account owner to respond.

For AWS, the AWS Trust and Safety team is the appropriate contact for reporting suspected abuse of AWS resources. Examples include spam originating from AWS infrastructure, an AWS-hosted phishing site, or malicious network traffic associated with an AWS resource. Reports can be submitted through the AWS Report abuse form or sent to abuse@amazonaws.com. A reporter does not need a paid AWS Support plan to report suspected abuse.

A useful report includes the suspected source IP address or URL, timestamps with a time zone, a description of the activity, and supporting evidence. Depending on the incident, that evidence might include relevant network logs or complete email headers. Include enough information to investigate without unnecessarily disclosing credentials, personal information, or unrelated confidential data. An AWS-associated IP address is a useful lead, not proof that AWS itself initiated the activity.

AWS Trust and Safety handles abuse reports and coordinates appropriate action; it is not the general troubleshooting destination for application failures or billing questions. Likewise, reporting an abuse case does not replace incident response within your own account. If AWS sends an abuse notice about your resources, investigate promptly, stop the offending activity, and respond through the channel identified in the notice with your remediation details.

Applying an AUP involves balancing legitimate functionality against opportunities for misuse. Restrictive outbound access and email controls can reduce abuse but may also interrupt valid integrations. Logging supports investigation but introduces storage costs and privacy considerations. Use proportionate controls, clear ownership, and tested response procedures. Finally, distinguish an AUP from an identity and access management policy: an IAM policy controls which actions an identity can perform, while an AUP defines which uses are acceptable. Technical permission to perform an action does not make that action acceptable.