The Definitive Guide to GxP Compliance in AWS Cloud (2026 edition)

What Is GxP and Why Does It Apply to Cloud Infrastructure?

GxP is a collective term for the Good Practice quality guidelines that govern pharmaceutical, biotechnology, and medical device organisations. The 'x' is a placeholder for the specific practice — GMP (Manufacturing), GLP (Laboratory), GCP (Clinical), and GDP (Distribution). All GxP frameworks share a core requirement: any computerised system involved in a regulated process must be validated, controlled, and auditable.

When a life sciences company uses AWS — whether for hosting a LIMS, running clinical data management systems, storing batch records, or processing research data — the cloud infrastructure itself becomes subject to GxP scrutiny. The FDA's 2003 Guidance on Part 11 and the EMA's Annex 11 (2011 revision) both explicitly address computerised systems used in regulated activities, including cloud-hosted platforms.

The AWS Shared Responsibility Model in a GxP Context

Understanding GxP compliance on AWS begins with the Shared Responsibility Model. AWS secures the physical infrastructure, hypervisor, and managed service components — what Amazon calls 'security of the cloud'. Your organisation is responsible for 'security in the cloud': operating systems, applications, data, network configuration, and access controls.

In a GxP context, this division matters enormously. AWS provides the secure, validated foundation — physical access controls, environmental monitoring, hardware integrity — but cannot validate your application, your data processes, or your access management practices on your behalf. The responsibility for Computer System Validation (CSV) sits firmly with you.

Computer System Validation (CSV) on AWS

Computer System Validation is the documented process that demonstrates a system consistently performs its intended use and meets predetermined specifications. For cloud systems, CSV requires a lifecycle approach covering:

• User Requirements Specification (URS): What the system must do, including performance, security, and compliance requirements
• Functional Specification (FS): How the system will meet those requirements technically
• Installation Qualification (IQ): Evidence the system is installed and configured correctly in the AWS environment
• Operational Qualification (OQ): Testing that the system functions as specified under normal and edge-case conditions
• Performance Qualification (PQ): Evidence the system performs consistently in the live environment with real data

For AWS-hosted systems, IQ documentation typically includes VPC configuration records, IAM policy documentation, encryption settings, and evidence of software version installation. OQ testing covers functional scenarios in a validated test environment before promotion to production.

Key AWS Services Used in GxP Environments

Identity and Access Management (IAM)

IAM is the cornerstone of GxP access control on AWS. GxP regulations require unique user identification — no shared accounts — and role-based access aligned with the principle of least privilege. IAM policies must be documented, reviewed periodically, and updated through formal change control. Multi-factor authentication (MFA) should be enforced for all human users, particularly those with administrative access.

AWS CloudTrail

CloudTrail provides the comprehensive audit trail that GxP mandates. Every API call to AWS — who made it, when, from where, and what the result was — is logged to CloudTrail. For GxP compliance, CloudTrail logs should be delivered to an S3 bucket with Object Lock enabled to prevent tampering, and log file integrity validation should be enabled to detect any modification.

Amazon S3 with Object Lock

For immutable data storage — batch records, audit files, validated reports — S3 with Object Lock provides WORM (Write Once Read Many) capability that meets GxP data integrity requirements. Objects can be locked in Compliance mode, preventing deletion by any user including account root, for a specified retention period.

AWS KMS (Key Management Service)

Encryption of GxP data at rest is a regulatory expectation under both Annex 11 and 21 CFR Part 11. AWS KMS enables AES-256 encryption with customer-managed keys, providing full control over key rotation policies and access. All key usage is logged via CloudTrail, providing an additional audit trail layer.

Annex 11 Requirements and AWS Controls

EU GMP Annex 11 governs computerised systems in pharmaceutical manufacturing across seven key areas, each of which has a corresponding AWS control:

• Validation: AWS Config provides continuous compliance monitoring against defined configuration rules, supporting ongoing validation evidence
• Data: S3 with versioning and Object Lock, DynamoDB with point-in-time recovery, RDS automated backups
• Printouts: Audit-ready reports generated from CloudTrail and AWS Config data
• Audit Trails: CloudTrail plus application-level logging to CloudWatch
• Change and Configuration Management: AWS Systems Manager Change Manager with approval workflows
• Periodic Evaluation: AWS Security Hub continuous compliance assessments
• Business Continuity: Multi-AZ deployments, Cross-Region Replication, RTO/RPO-defined recovery strategies

21 CFR Part 11 on AWS

21 CFR Part 11 governs electronic records and electronic signatures for FDA-regulated systems. Key requirements and their AWS implementations include:

• Unique user identification: AWS IAM users and Cognito identity pools with unique credentials
• Audit trails capturing who changed what and when: CloudTrail plus application-level logging to CloudWatch Logs
• System-generated timestamps: CloudTrail timestamps are system-generated and tamper-evident
• Controls preventing unauthorised record modification: S3 Object Lock, RDS parameter group controls
• Electronic signature controls: Application-layer implementation required; AWS Cognito supports strong authentication as the underlying mechanism

Change Control for Cloud Infrastructure

One of the most operationally challenging aspects of GxP compliance on AWS is change control. Every change to validated infrastructure — even a security patch or instance type resize — must be documented, risk-assessed, approved, and tested before deployment to production.

AWS Systems Manager Change Manager provides a structured change control workflow with approval gates, scheduled deployment windows, and automated rollback capabilities. Infrastructure as Code (IaC) tools — particularly Terraform or AWS CloudFormation — enable version-controlled infrastructure changes with full audit trails of what changed, when, and by whom.

Building Your GxP-Compliant AWS Architecture

A recommended baseline GxP-compliant AWS architecture includes: a dedicated GxP production account separate from development/test environments; a VPC with private subnets for all GxP workloads; no direct internet access from GxP systems (all egress via NAT Gateway or AWS PrivateLink); CloudTrail enabled with log file integrity validation; AWS Config with rules for critical configuration controls; AWS Security Hub for continuous compliance visibility; and all GxP data encrypted at rest (KMS) and in transit (TLS 1.2+).

The Supplier Qualification Challenge

Annex 11 Section 3.2 requires assessment of the supplier or service provider when a system is not developed in-house. For AWS, this means conducting a supplier qualification of Amazon Web Services itself. AWS supports this process by providing:

• AWS Compliance Center with GxP-specific documentation
• AWS Audit Manager with GxP-mapped control frameworks
• Third-party audit reports (SOC 1, SOC 2, ISO 27001) available under NDA via AWS Artifact
• AWS GxP Guidelines whitepaper (2023)

Your qualification documentation should reference these AWS-provided materials alongside your own assessment of the specific AWS services used in your validated environment.

Conclusion

GxP compliance on AWS is achievable and increasingly standard practice among leading life sciences organisations. Success requires a clear understanding of the Shared Responsibility Model, a disciplined CSV programme, well-designed infrastructure using the right AWS services, and robust change control processes. skyPurple Cloud specialises in this exact combination — delivering validated AWS environments that satisfy regulatory expectations without sacrificing the agility and cost benefits that cloud provides.