A landmark security clearance raises questions about digital sovereignty and dependence.
BRUSSELS
Amazon Web Services has become the first commercial cloud provider approved to support NATO RESTRICTED workloads across all member countries of the North Atlantic Treaty Organization. The authorization represents a significant step toward integrating commercial computing infrastructure into allied defense systems, while raising questions about cybersecurity, technological dependence and control over sensitive information.
Announced by AWS on September 22 and attracting renewed attention in October, the approval allows NATO bodies, member governments and defense industry partners to use designated cloud services for information classified at the alliance’s NATO RESTRICTED level.
That classification is the lowest of NATO’s classified information categories. Unauthorized disclosure could harm alliance interests, but the authorization does not extend automatically to more sensitive classifications such as NATO CONFIDENTIAL, NATO SECRET or COSMIC TOP SECRET.
The approval followed a security assessment involving Spain’s National Cryptologic Centre and National Security Office. AWS demonstrated compliance with NATO’s D32 technical requirements, which govern the processing of restricted information in public cloud environments.
The assessment established a common security baseline that other allied countries can use when evaluating AWS infrastructure. It does not eliminate their responsibility to authorize individual systems according to applicable national and NATO requirements.
Spain played an important role in the process. AWS’s cloud region in the country also received authorization to handle information classified under Spain’s Difusión Limitada designation, strengthening the national infrastructure available for approved defense and government applications.
According to AWS, its infrastructure includes 15 cloud regions located in NATO member countries, seven of them in continental Europe. Eligible workloads can use approved services in qualifying regions, subject to the necessary security controls.
The company identifies AWS Trusted Secure Enclave – Sensitive Edition as part of the technical framework supporting sensitive government and defense applications.
For NATO, the development could reduce the time and expense involved in evaluating commercial technology. Shared assessments may also improve interoperability between allied organizations that need to exchange information securely.
However, cloud accreditation is not equivalent to transferring every NATO system to Amazon. The decision creates an approved technological option rather than an exclusive contract or a requirement for member states to abandon existing infrastructure.
The strategic implications extend beyond operational efficiency. Modern defense institutions increasingly depend on cloud computing for data processing, cybersecurity monitoring and collaboration across geographically distributed organizations.
Commercial platforms can provide advanced capabilities, but their adoption also introduces concentration risks. Relying heavily on a small number of technology suppliers may create challenges involving service continuity, procurement flexibility and long-term institutional autonomy.
Those concerns are especially significant when infrastructure supports national security functions. Governments must consider not only whether a system satisfies current technical requirements, but also how operational control and resilience will be maintained over time.
Amazon’s approval therefore represents both a commercial milestone and a broader shift in the relationship between private technology companies and military institutions.
The immediate achievement is a shared accreditation framework for a defined category of information. The longer-term test will be whether NATO members can benefit from commercial cloud capabilities while retaining meaningful control over their sensitive systems.
Where Innovation Meets Responsibility.