Amazon Web Services (AWS) infrastructure in Aragon has added a new strategic capability after obtaining the necessary authorizations to host and process information classified as NATO RESTRICTED and Spain’s Difusión Limitada. The company announced on September 22 that its Spanish cloud region, deployed across the provinces of Zaragoza and Huesca, has become the first to jointly attain both approval levels, broadening the potential use of its services by public administrations, defense agencies, and companies handling sensitive information.
The authorizations were granted in Spain by the National Cryptologic Center (CCN) and the National Security Office (ONS), bodies under the National Intelligence Center. They allow AWS to offer infrastructure that has been pre-assessed for certain types of classified-information processing, although organizations using its services must individually accredit their own systems before operating with such data.
The scope of the approval extends beyond the Spanish market. According to AWS, its NATO RESTRICTED-authorized services may be used as the basis for systems at that classification level in the company’s regions located in NATO member countries, in accordance with applicable accreditation procedures. The assessment conducted in Spain therefore provides a common security benchmark for other allied countries.
Strategic infrastructure based in Aragon
The AWS Europe (Spain) Region began operations in November 2022 and has three Availability Zones distributed across the provinces of Zaragoza and Huesca. This infrastructure provides data storage, processing, and cloud computing services to Spanish and international businesses and public administrations.
The new accreditation opens up an area of activity that is particularly demanding from a security standpoint. Defense-related organizations require systems capable of protecting sensitive information, ensuring service availability, and meeting specific requirements for data access and handling.
To obtain the authorizations, AWS had previously earned certification under Spain’s National Security Framework at the HIGH category and approval for 28 services and capabilities in the CCN’s ICT Security Products and Services Catalog. These include security services and core computing and storage components such as Amazon EC2 and Amazon S3.
These assessments have been supplemented by specific requirements for handling information classified as Difusión Limitada and NATO RESTRICTED, including a security assessment of the data centers. The approval applies to the provider’s infrastructure and services, meaning it does not automatically authorize every customer or every type of classified information.
The distinction is important because it defines the news’ actual scope. AWS now has an authorized technology foundation on which certain organizations can deploy their systems, provided they complete the procedures required by the relevant authorities.
New opportunities for technology companies
The availability in Aragon of cloud infrastructure with these approvals could be significant for companies developing solutions for security, defense, and public administrations. Activities such as software development, cybersecurity, systems integration, and the handling of sensitive information require technological environments subject to high levels of protection.
For companies participating in defense programs, having providers whose services have undergone security assessments may make it easier to design solutions compatible with their clients’ requirements. However, the effective use of these services will depend on the conditions of each program and any additional accreditations required.
The news coincides with the development of Aragon’s defense industrial ecosystem, which includes companies specializing in electronics, communications, engineering, and dual-use technologies. The presence of advanced digital infrastructure is an additional asset for that environment, although no specific contracts stemming from AWS’s new authorizations have yet been announced.
The recognition also comes during a period of expansion for the company in Aragon. In March 2026, AWS announced that it would increase its planned investment in Spain to €33.7 billion to expand its data center infrastructure in the region. The company estimates that the program will generate economic and employment effects in the coming years, subject to the effective rollout of the investments.
With the new security approvals, the Aragon cloud region adds to its commercial and technological functions the ability to serve as infrastructure for systems related to defense and national security. Its importance will now depend on how public administrations, companies, and authorized bodies incorporate these capabilities into their projects.
