AWS Becomes First Cloud Provider Approved for NATO Restricted Workloads

On Tuesday, September 22, 2026, Amazon Web Services secured a blanket approval to host "NATO Restricted" data across all 32 member states of the North Atlantic Treaty Organization. The certification, granted after a multi-year audit led by Spain’s National Cryptographic Centre (CCN), makes AWS the first commercial hyperscaler cleared to process the alliance's sensitive military information on a bloc-wide scale.[1][2][6]

Rather than a new software capability, the milestone is a regulatory skeleton key. It establishes a pre-assessed security baseline that allows individual European defense ministries to bypass the initial stages of their own compliance audits when moving workloads to Amazon's servers. For a defense sector historically bogged down by redundant national certifications, the unified approval removes a primary barrier to cloud adoption.[1][4]

"NATO Restricted" (NR) operates as the alliance's lowest classification tier. It covers information that is not strictly classified but whose public disclosure could harm allied operations or interests. While it does not clear AWS to host top-secret intelligence or active targeting data, the designation covers the vast majority of routine logistical, administrative, and command-system data that modern militaries generate daily.[1][4]

To secure the accreditation, AWS had to document its compliance against NATO's D32 technical directive, the framework that governs public-cloud security for the alliance. Because NATO delegates the actual auditing process to member nations, Spanish authorities conducted the technical evaluation. The CCN validated 28 specific AWS services—including core Amazon EC2 computing and Amazon S3 storage—before sharing the approved findings with the rest of the alliance.[1][2][5]

Simultaneously, AWS secured Spanish national approval to handle information at the "Limited Dissemination" (DL) level within its Europe (Spain) region, whose data centers are located in Aragón. That dual clearance demonstrates how the NATO baseline interacts with national laws: the overarching NR approval satisfies the alliance, while the DL clearance satisfies the host nation's specific intelligence requirements.[2][5]

The approval itself does not automatically award Amazon any new defense contracts or guarantee immediate revenue. Individual member nations must still conduct their own system-level accreditations under local policies, such as Spain's CCN-STIC-004 framework, before deploying specific applications. However, the bloc-wide baseline drastically shortens a procurement timeline that typically stretches for years, moving AWS closer to the actual point of sale.[4][5]

For military planners, the shift is driven by the sheer volume of information modern forces must process. As European militaries increasingly fuse radar telemetry, satellite imagery, and acoustic sensors to track threats like Russian drones, the bottleneck is rarely the availability of computing power. Instead, it is the legal and technical friction of moving that sensitive data onto commercial infrastructure capable of running advanced artificial intelligence models.[4][6]

"Strengthening NATO's ability to securely leverage commercial technology is key to build a more resilient and agile Alliance," said Dylan Browne, general manager of the NATO Communications and Information Agency (NCIA). "The availability of commercial products that meet NATO's security requirements expands the technology options available for the Alliance and supports our ability to adopt modern technologies while maintaining the security and resilience on which our operations depend."[1][3]

By outsourcing the underlying infrastructure security to a commercial provider, defense agencies can focus their engineering budgets on application development rather than server maintenance. AWS currently operates 15 data center regions within NATO countries, including seven in mainland Europe and two in the United Kingdom. This footprint gives defense clients the ability to process data locally, fulfilling national data residency requirements while inheriting the new compliance standard.[1][6]

The company already counts more than 15,000 government agencies among its global customer base, but the defense sector remains a highly contested growth market. AWS and its primary rival, Microsoft, are locked in a fierce competition for military cloud contracts, with both firms investing heavily in localized infrastructure to meet stringent government demands.[1][6]

The accreditation also highlights a persistent tension in European defense strategy. While the European Union's 2024 Data Act pushes to insulate European data from foreign jurisdictions—specifically US court orders—NATO's military infrastructure remains deeply reliant on American technology. AWS and Microsoft have spent billions building localized "sovereign cloud" regions to satisfy EU regulators and assuage fears of foreign surveillance.[6]

By securing the first alliance-wide approval, Amazon has demonstrated that US firms can successfully navigate Europe's tightening data sovereignty requirements. The milestone suggests that despite political rhetoric advocating for technological independence, commercial American cloud architecture is cementing itself as a permanent, structural fixture in NATO's future operational planning.[6]