AWS Tackles Open Source Security Infrastructure Costs With Promotional Credits
Amazon Web Services, a founding member of the OpenSSF, is helping maintainers overcome the computational burden of securing open source projects through its promotional credit program, which covers testing, artifact distribution, and enterprise-grade security tools.
The Infrastructure Challenge in Open Source Security
Maintaining secure open source software demands far more than competent code. The work requires substantial computational resources to power continuous integration systems, fuzzing operations, and networks that safely distribute software artifacts. For many maintainers, the expense of infrastructure quickly becomes the limiting factor in their security efforts.
AWS, which serves as both a founding and Premier Member of the Open Source Security Foundation, plays an active role in shaping the ecosystem's security posture. The company participates across OpenSSF working groups and its governing board, helping establish security standards that benefit the entire community.
Beyond its broader funding commitments and standards work, AWS operates the AWS Open Source Promotional Credit Program as a separate initiative. This program directly tackles the infrastructure constraints that open source security researchers and tool developers encounter in their daily work.
Scaling Security Testing Without Fixed Constraints
Infrastructure limitations should never prevent projects from running comprehensive security assessments. When maintainers need to execute extensive static analysis or continuous performance evaluations, they require computing power that expands and contracts with demand. Similarly, projects distributing plugins or security utilities need dependable, high-capacity delivery systems to safeguard the integrity of the software supply chain.
The AWS Open Source Promotional Credit Program grants eligible projects credits to offset these infrastructure expenses. By eliminating the financial barriers, teams can implement enterprise-level security and distribution systems.
Two recent cases demonstrate the program's impact:
- Gradle Build Tool: Each code submission to Gradle initiates hundreds of individual builds and executes tens of thousands of tests. Using AWS credits, Gradle transitioned from fixed server hardware to a dynamically scaling setup built on Amazon EC2 and EKS. The infrastructure now adjusts capacity automatically based on actual needs, accelerating build completion and automated security scanning. Gradle also relies on Amazon S3 to reliably distribute the Gradle Plugin Portal, which handles approximately 200 million downloads monthly.
- Compiler Explorer: The Compiler Explorer project employs the AWS Open Source Promotional Credit Program to manage its infrastructure scaling efficiently. The program's support enables the project to handle the processing demands of delivering a high-performance platform for open source developers.
Running on AWS infrastructure also grants projects access to built-in security capabilities that reduce implementation burden. Teams can establish keyless authentication through GitHub OIDC, securely retrieve temporary credentials from AWS Secrets Manager, and deploy services like Amazon GuardDuty for identifying threats. These capabilities help fortify the build environment itself against supply chain compromises.
Freeing Maintainers to Focus on Core Work
When open source maintainers no longer carry the weight of funding infrastructure or managing unexpected traffic surges, they redirect their energy toward their primary mission: developing secure code, creating better tools, and strengthening the overall ecosystem.
Maintainers of open source security projects or community-focused tools are invited to investigate the AWS Open Source Promotional Credit Program. Application information is available on the AWS Open Source blog, the official program resource, along with case studies showing how projects including Compiler Explorer, Gradle, and Read the Docs have implemented the program.
About the Author
Mila Zhou serves as Senior Technical Program Manager at Amazon Web Services, overseeing funding programs that deliver essential resources to open source initiatives. Her background spans Digital Media Technology, Economics, and Taxation, combining technical expertise with financial perspective. Zhou's work managing large-scale open source funding initiatives and assessing their outcomes has shaped how enterprise leadership measures and demonstrates program success.