Amazon is famous for its two-pizza team rule, a company philosophy where each of its internal teams should be small enough that it can be fed with no more than two pizzas. Less famous is an authentication system from the tech giant that adds a little 7Up to the mix, in a manner of speaking.

The solution in question is Midway, the internal authentication and single-sign on (SSO) platform for all 1.5 million-plus of Amazon’s employees. As Eric Brandwine, VP and distinguished engineer at Amazon, explained, as Amazon has grown through scale and acquisition over the years, its technology strategy was piecemeal in nature, a common refrain with large enterprises.

“It’s often a benefit that diversity of thought and implementation leads you to spot opportunities that if you had a monoculture, wouldn't be visible to you," Brandwine said.
"But we were having problems with our existing authentication systems, for at least a set of our most important systems.”

Midway began life in Amazon Web Services (AWS), where the customer relationship is fundamentally different from the rest of the Amazon business.

“We have all sorts of interesting, sensitive information and deep rich interfaces and relationships with our customers across the company, but nothing like AWS, where we say, 'please give us all of your data and all of the computation on that data,'" Brandwine noted. “And so we built Midway in AWS. And the idea was that for these very important systems, we would require ubiquitous hardware multifactor authentication (MFA). Every single authentication, no questions asked, would require hardware MFA.”

Smart cards were chosen as the initial authentication token, resulting in an “absolutely terrible user experience,” Brandwine said.

“We technically achieved our security goals with this system, but it was not beloved. It was not beloved by the users, it was not beloved by the administrators. It was not beloved by me,” Brandwine continued. “When we first launched smart cards, I was possibly the most hated person in the company. Obviously, I'm still employed here, like I survived the experience, but earning trust back after that ... for a while everyone was like, ‘oh, Midway! Run in fear, stay away!’”

Back to the drawing board for the pizza-eating team, which resulted in a system based on Yubico YubiKeys, and a decision to move away from special, high‑bar systems to a combination of hardware‑backed authentication and ongoing device posture as the default for everything.

“For Midway we've got multiple constituencies, but the two most important are ... the end users sitting at their laptop or their phone or whatever that are being asked to authenticate, and in the ideal state, they don't even realize they're authenticating. It's just pure magic," Brandwine explained. "But the other constituency that's incredibly important are application owners. If I have to go and stand on their desk and say, ‘you need to schedule this six month block of software development work so you can check the box on the security initiative,’ I'm going to be fighting an uphill battle all day, every day. If the application owners are like, ‘you should integrate with Midway because it's the easiest thing to do,' then I don't even have to talk to them.”

Midway and the 'unfabric'

Aligning with zero trust principles, Midway enforces strong authentication, role-based or attribute-based access controls, short-lived credentials, and policy checks before granting access to internal applications or infrastructure. The solution is built into Amazon’s common app hosting frameworks, and is the front door for authentication via connectors/SSO integrations when accessing third-party applications in Amazon environments. This means even if attackers guess passwords against third‑party identity surfaces, they can’t use them to access Amazon’s tenant.

Midway also emits fine‑grained telemetry for every action, helping to spot suspicious patterns, evaluate detection rules, and learn about adversary behavior.

“We started this quite a few years ago, but it's what people now call zero trust,” Brandwine said, stressing that while neither he nor the team invented zero trust, he was responsible for establishing Amazon’s zero-trust posture way back when.

“Hand-in-hand with Midway is another effort that we have. I called it the 'unfabric,' because I am old enough to remember the old 7Up commercials where they built 7-Up as the 'uncola.' It was not a great name, I did not know my audience. I had to explain the name way too often, which means it's not a good name. But what it winds up being is effectively our zero trust effort, the different networks we have in the company. We call them fabrics. … The definition of a network fabric is there's things that are on the fabric and things that are off the fabric.

Brandwine continued: “Amazon is a massive company with over a million employees. And so the Amazon corporate network is gigantic. There's this huge population that has access to it. And so thinking of it as a safe, secure ‘inside’ is not the right mental model. It's a different network than the internet, but it's not necessarily a safer one. And so because we have all of this application side stuff in Midway, it's very easy for someone in the company to build an application that we can allow to face the internet, and we don't have to go through a separate application security review. And as Midway is easy to adopt, the default for new services is Internet facing.”

While Midway has been around a long while for Amazon, it wasn’t until the “acid test” of COVID-19 pushed it into the form it assumes today, with the pandemic pushing Brandwine and team to quickly improve how they shipped and set up client devices remotely, as well as securely establish an Amazon identity for employees who had never set foot in an Amazon office.

Indeed, the new age of remote working has led to increased, creative attacks against Midway and onboarding flows with the system.

“One of the reasons I love working in security is the creativity of some of our adversaries is just awe inspiring," Brandwine said. "And there were some very interesting things that people tried to do to Midway that we had not anticipated. You know, trying to bootstrap clients that were not officially owned by Amazon, that were not issued to an Amazon employee, and the level of effort that they were willing to go to and learn based on talking to Amazon candidates or former Amazon employees.

“We watched them as they were doing it, and as I respected them for their ingenuity and their determination. We shut those doors, we put an end to that activity," Brandwine added.

Some of that activity has included multiple actor-based attacks, including some named nation state campaigns.

“There was a big password spraying attack against Microsoft 365 a couple of years ago, and we've actually gone to great lengths to make sure that only the authentication interfaces that we want to have enabled on our third parties are enabled, and so they were able to submit passwords to Microsoft Entra but none of those passwords, even if they were guessed correctly, could be used to authenticate to our tenant, because we're 100% Midway,” Brandwine said.