Ministry of Electronics and Information Technology

• Amazon Web Services India Private Limited a reseller of AWS Cloud Services, has cloud service provider (CSP) empanelment from MeitY for cloud services offered from the AWS Asia-Pacific (Mumbai) and AWS Asia Pacific (Hyderabad) Regions. AWS Asia-Pacific (Hyderabad) Region is the second AWS Region in India to be fully empaneled by MeitY. In 2017, AWS India became the first global CSP in India to receive full empanelment for its cloud service offerings after the AWS Asia-Pacific (Mumbai) Region completed MeitY’s STQC (Standardization Testing and Quality Certification) audit.
• AWS Regions are designed to be autonomous and each AWS Region consists of a minimum of three, isolated, and physically separate Availability Zones (AZs) within a geographic area. Each AZ, a group of logical data centres, has independent power, cooling, and physical security. All AZs in an AWS Region are interconnected with high-bandwidth, low-latency networking, over fully redundant, dedicated metro fiber providing high-throughput, ultra-low-latency networking between AZs. All traffic between AZs is encrypted. AZs are located in separate and distinct geographical locations, far enough from each other to support customers’ business continuity, and near enough to provide low latency for high availability applications that use multiple data centres.
• The network performance is sufficient to accomplish synchronous replication between AZs. AZs make partitioning applications for high availability easy. If an application is partitioned across AZs, agencies are better isolated and protected from issues such as power outages, lightning strikes, tornadoes, earthquakes, and more. AZs are physically separated by a meaningful distance, many kilometers, from any other AZ, although all are within 100 km (60 miles) of each other. AZs give customers the ability to operate production applications and databases that are more highly available, fault tolerant, and scalable than would be possible from a single data center. AWS customers focused on high availability can design their applications to run in multiple AZs to achieve even greater fault-tolerance.
• AWS Regions meet the highest levels of security, compliance, and data protection. The empanelment affirms that AWS meets government standards of quality, availability, and security, and provides government organisations, public sector undertakings (PSUs), statutory bodies, and financial institutions mandated by the Securities and Exchange Board of India (SEBI) more scope to innovate with the world’s most comprehensive and broadly adopted cloud. Government organisations can improve e-governance standards and enable on-demand digital services for citizens and businesses across India. Similarly, financial services organisations can benefit from agile, efficient, and security-compliant cloud solutions at scale, providing consumers faster and secure digital banking, insurance, and payment innovations.

• MeitY empanelment has become an important criterion for procurement by Government Departments / Ministries / Agencies / Autonomous Institutions / Statutory Bodies / Offices under Government of India or States or UTs or Local Governments or PSUs or Nationalized Banks within India (herein after referred to as Government Department) and Financial Institutions. The empanelment helps customer ensure that the empaneled CSPs meet the minimum technical and security guidelines defined by MeitY.
• The Agencies can procure the Cloud Services either directly from CSP or indirectly through a Managed Service Provider (MSP) including cloud & managed services or from a System Integrator for end-to-end services.
• Customers can store data in either Asia Pacific (Mumbai) or Asia Pacific (Hyderabad) Regions to comply with the MeitY’s data localization requirements. As a customer, you maintain full control of your content that you upload to the AWS services under your AWS account, and responsibility for configuring access to AWS services and resources. AWS will not move or replicate customer’s content outside of their chosen AWS Region(s) except where legally required or in accordance with the terms governing your AWS account. AWS provides capabilities that allow customers to encrypt, delete, and monitor the processing of their customer data. For more information, see the AWS Privacy webpage.
• We prohibit, and our systems are designed to prevent, remote access by AWS personnel to customer data for any purpose, including service maintenance, unless access is requested by customer, is required to prevent fraud and abuse, or to comply with law. Please refer to Privacy Feature of AWS Services for more information on controls.

• Security and Compliance is a shared responsibility between AWS and the customer. AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates and is responsible for protecting the infrastructure, including hardware, software, networking, and facilities, that runs all of the services offered in the AWS Cloud. AWS Regions meet the highest levels of security, compliance, and data protection. The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall.
• While MeitY has defined the minimum security requirements (“Security of the Cloud”) that need to be complied by the CSPs to get empaneled, government agencies are responsible for specifying the security services and features (“Security in the Cloud”) that need to be deployed and configured for their workloads depending on the services used, application risk profile and applicable laws and regulations.
• AWS is architected to be one of the the most secure global cloud infrastructure on which to build, migrate, and manage applications and workloads. AWS offers breadth of Security, Identity, & Compliance services that the customer can use to manage and reduce security risk, and protect their networks and data.
• AWS Well-Architected helps cloud architects build secure, high-performing, resilient, and efficient infrastructure for a variety of applications and workloads. Built around six pillars—operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability—AWS Well-Architected provides a consistent approach for customers and partners to evaluate architectures and implement scalable designs. Please visit Best Practices for Security, Identity & Compliance and AWS Trust Center page for further details.

The empanelment letters are available on AWS Artifact: AWS Asia Pacific (BOM) and AWS Asia Pacific (HYD). For more information, including the current status of the empanelment of AWS cloud services, please refer Empanelment extension letter. AWS current empanelment status  is available on the MeitY website. AWS Artifact is a self-service central resource for on-demand access to security and compliance reports from AWS. Sign in to AWS Artifact in the AWS Management Console to download auditor-issued reports, certifications, accreditations, and other third-party attestations of AWS.