By Mila Zhou
Summary
How can open source projects maintain secure infrastructure without financial strain? OpenSSF Premier Member, Amazon Web Services (AWS) addresses this by providing critical funding and scalable compute resources. Through initiatives like the AWS Open Source Promotional Credit Program, maintainers access enterprise-grade security tools and automated testing, ensuring the global software supply chain remains resilient, hardened, and efficient for everyone.
Why Does Open Source Security Need Infrastructure Investment?
Securing open source software requires more than writing good code. It takes serious compute power to run continuous integration pipelines, fuzzing engines, and secure artifact distribution networks. Infrastructure costs can quickly become a bottleneck for maintainers.
As a founding and Premier Member of the Open Source Security Foundation (OpenSSF), AWS is a key contributor to the security of the open source ecosystem. We actively collaborate across OpenSSF working groups and the governing board to help build security standards from which everyone benefits.
Beyond large-scale funding to open source and collaborative standards, AWS also offers practical, day-to-day support for maintainers through the AWS Open Source Credit Program. While this is an independent AWS initiative rather than an OpenSSF program, it directly addresses the infrastructure constraints that open source security researchers and tool creators face.
How Can Projects Solve the Infrastructure Bottleneck?
Security testing should never be limited by a fixed pool of servers. When projects want to run extensive static analysis (SAST) jobs or continuous performance testing, they need scalable compute. Furthermore, projects that distribute plugins or security tools need a highly available delivery mechanism to protect the integrity of the software supply chain.
The AWS Open Source Promotional Credit Program provides credits to eligible open source projects to cover these infrastructure costs. By removing financial friction, projects can adopt enterprise-grade security and delivery architectures.
Two recent examples highlight how projects use this support:
- Gradle Build Tool: Every commit to Gradle triggers hundreds of separate builds and tens of thousands of tests. By leveraging AWS credits, Gradle moved from dedicated servers to an auto-scaling architecture using Amazon EC2 and EKS. Their capacity now automatically grows with demand, allowing builds and automated vulnerability scanning to finish faster. They also use Amazon S3 to securely host the Gradle Plugin Portal, which serves around 200 million downloads a month.
- Compiler Explorer: Compiler Explorer uses the AWS Open Source Promotional Credit Program to scale their infrastructure efficiently. This support helps them manage the compute demands of providing a high performance environment for open source developers.
Additionally, building on AWS allows projects to utilize built-in security features without the heavy lifting. Projects can implement keyless authentication via GitHub OIDC, securely pull short-lived credentials from AWS Secrets Manager, and utilize services like Amazon GuardDuty for threat detection. This ensures the build environment itself remains hardened against supply chain attacks.
How Does This Program Support Maintainers?
When open source maintainers do not have to worry about funding their build queue or surviving a sudden traffic spike, they can focus their time on what truly matters: writing secure code, building better tools, and protecting the broader ecosystem.
If you maintain an open source security project or build tools that benefit the community, we encourage you to explore the AWS Open Source Promotional Credit Program. You can find the application details on the AWS Open Source blog (which remains the official hub for the program) or read more about how projects like Compiler Explorer, Gradle and Read the Docs have implemented it.
About the Author
Mila Zhou is a Senior Technical Program Manager at Amazon Web Services (AWS), leading funding initiatives that provide crucial support to open source projects. Drawing from her multidisciplinary background in Digital Media Technology, Economics, and Taxation, Mila brings a unique blend of technical knowledge and financial acumen to her role. Her expertise in managing large-scale open source funding programs and measuring their impact has proven invaluable in setting metrics and providing successful examples for enterprise leadership.