What the Amazon cloud outage reveals about the weaknesses of the internet

Signal messages. A Pokémon hunt. Ticket sales for the much-awaited tour of Spanish pop band La Oreja de Van Gogh. Even the brand Eight Sleep’s smart beds, which became stuck in an inclined position and began to roast customers alive. The services and applications of more than 2,000 companies around the world were affected on Monday by an outage at Amazon Web Services (AWS), Amazon’s cloud computing platform and perhaps the most important site amid the internet’s plumbing. According to the website Downdetector, which monitors web activity, within a few hours there had been up to 8.1 million complaints from users around the globe.

Many of the fallen services were back up and running after a few hours, but a few continued to experience problems throughout the day. On Monday night, Amazon released a statement that AWS had “returned to normal levels.” The problem now, say experts, is knowing to what extent the internet’s global infrastructure has become overly dependent on a handful of cloud service providers — and what, if anything, is to be done about it.

The chaos began at 3:11 a.m. on the East Coast. Amazon data center region US-EAST-1 in North Virginia registered the first failures: increased latency, connection errors and domain name or DNS resolution failures, which allow you to visit a web page when you type its address into your browser. The outages affected thousands of platforms, games, apps and systems (Snapchat, Fortnite, Duolingo, Canva, Alexa, etc.) that rely on AWS. The primary cause was a failure in the DNS resolution of access points to DynamoDB, an internal database on which many AWS services depend. Although the problem was resolved within a few hours, the dependency caused many services to stop working properly, leading to a chain of failures that took many hours to fully mitigate. Amazon has declined to provide further details.

“We can think about the Amazon Web Services cloud as a network of freeways on which thousands of users [in this scenario, businesses] drive every day,” reflects Hervé Lambert, global consumer operation manager at Panda Security. “When one of the key exits of those freeways is interrupted, it doesn’t affect just a single vehicle, but rather all those that have to use that exit, and so backups in the chain occur. That, more or less, is what happened in the AWS outage,” he explains.

But what is AWS and why is it so important to so many applications and services? Amazon Web Services is the largest cloud service provider in the world. Amazon is not the only player on the market; Google and Microsoft also have their own clouds. But it is the most important, and is used by 70 million websites, according to Built With.

Amazon launched its cloud in 2006, leading to a major change on the internet. What the company did was offer on-demand infrastructure to companies and governments. Basically, it put its machines to work so that applications, websites and online services could function without the need for each company to have its own physical servers. Nowadays, the majority of online companies use clouds like that of Amazon due to factors linked to cost, flexibility, maintenance, and security. If they didn’t, they would have to buy physical servers with all the trimmings — networks, software licenses, maintenance, staff, etc. The cloud model has become the norm, and one of the biggest businesses in the 21st century. In 2024, the global cloud computing market earned more than $752 billion, according to estimates from Grand View Research.

But Monday’s interruption demonstrates the global dependence on a handful of companies that are largely concentrated on the East Coast of the United States. Many services and applications depend exclusively on a single cloud, and when it fails, that which was considered a strength (the ability to let an expert manage your business) becomes a crippling weakness.

“We need to spread out where our data is stored, and we can do that by using multiple cloud providers. Google and Microsoft offer alternatives, and whenever possible, companies should implement security systems with other providers. Granted, this is expensive and not always feasible — also, it won’t work for everyone,” says Jake Moore, a specialist at international cybersecurity firm ESET.

“One of the most critical vulnerabilities we see in the use of this kind of hyper-provider are the common components that everyone shares. If the piece that controls access, for example, breaks, half the internet can shut down at once,” says Lambert. But the problem does not only lie in using one provider. There’s also the issue that most providers are located in a single geographic region. “Regional concentration is another issue that needs to be reviewed. A lot of critical databases are located in a single area and if that area experiences an earthquake, the entire customer domain goes down,” says Lambert, who concludes: “The internet is functioning through very few central administrators and a lot of its critical functions are concentrated in very few operators that regulate digital life. If one of those providers fail, it can cause a waterfall effect, like the one we saw on Monday.”

Cori Crider, director of The Future Institute, is very critical of this week’s outage: “It demonstrates that letting large parts of the digital European economy depend on a couple of U.S. monopolies has left us in a dangerous and fragile position, one that we need to get out of as soon as possible.” The digital rights expert reflects that, “This service outage is another reminder that Europe has allowed Silicon Valley monopolies to control too much of our critical technological infrastructure, and that brings with it enormous economic and security risks.”

Excessive dependence on Silicon Valley

But there are also experts who think given the context of the outage, the benefits of the cloud far surpass its risks. “Getting a third of the internet back functioning after just a few hours is, in reality, quite notable and should be a lesson on the global as well as local level,” says Moore. Lydia Leong, an analyst at Gartner, explains: “This is not an unprecedented event, nor is there evidence that the cloud is intrinsically untrustworthy. In fact, it followed a familiar pattern that we have seen among all providers over the last decade: a regional incident that lasted for less than a day,” she says.

Is there a fix for this extreme dependency and — most important of all — should we carry it out? The experts consulted for this article vary in their opinions. “Until there is an adequate alternative, we will continue seeing these problems grow and increase in their seriousness,” says Moore. In Lambert’s opinion, the internet is relying on fewer and fewer private freeways, and that is good “because it allows us to go faster, but when there are backups, it brings almost everyone to a halt.” In his opinion, the solution is not to get off the freeway, but “build emergency exits: alternative routes, copies that are stored off the cloud, a backup key, and regular tests.”

Crider is much more critical: “The most important lesson from what happened is that resilience comes from diversity and local control. The AWS outage demonstrates how the concentration of power makes the internet more fragile. And that’s not only about a technological risk: there is also democratic and political risk.” The response, according to Crider, is “to balance the system. Europe has the talent and capacity to do it, but it will take time and sustained investment.” Leong continues to trust the system: “The cloud outages get media attention because they affect many people at once, but context is important: the public cloud remains the best option for scalable infrastructure if you invest in resilience from the outset.”

A former AWS engineer puts it similarly, but in simpler terms: “This is like a plane crash, which attracts a lot of attention… but in reality, traveling by plane is much safer than traveling by car.”

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition