Cloud & CDN Dependency · Infrastructure Dependency Atlas

Four of these ten are already over

Fastly's CDN failed for 49 minutes in June 2021. A CrowdStrike update grounded airlines in July 2024; 5,078 flights were cancelled. Those are over. Meanwhile one county in Virginia still holds the control plane for every AWS customer on earth, 49% of domains still resolve through ten providers, and the CLOUD Act still reaches inside Microsoft's EU Data Boundary. Four of these ten are finished events; six are conditions that have not stopped — and the record marks neither.

cases

are outages that ended

are conditions that persist

date fields in the schema

EVIDENCE WINDOW 2021-06-08 → 2026-07-14 CITATIONS 21 CASES 10

● observed · ◌ derived · ▌ interpreted · ⊘ refused — marks appear beside claims; defined under Method.

Primary evidence · derived from sources

Four things that happened. Six things that are still true.

Every case in the atlas on one axis. The outages are marks at a moment; each lasted between 49 minutes and 15 hours, too brief to draw at this scale, so the duration is written instead. The conditions have no recorded beginning — the rail fades in rather than starting — and no recorded end, so it runs to today. ◆ marks a dated moment a standing condition cites inside its own text — and the dashed column marks a month this corpus records in both tenses at once.

December 2021 — recorded twice

Ended · four of 10

Fastly CDN outageCDN concentration

2021-06

49 min

AWS December 2021 outage cascadeOutage cascade

2021-12

7 hr

CrowdStrike July 2024Software supply chain

2024-07

—

AWS us-east-1, 19-20 October 2025Outage cascade

2025-10

15 hr

Still true · six of 10 no recorded start, no recorded end

AWS us-east-1 control plane concentrationControl plane

December 2021

ongoing

EU data sovereigntySovereignty gap

February 2025

ongoing

Loudoun CountyPhysical concentration

ongoing

Epic on Azure/AWSSector dependency

ongoing

DNS concentrationCDN / DNS concentration

October 2021

ongoing

Cloud egress pricingPricing as governance

ongoing

2021 2022 2023 2024 2025 2026 today

n 10 cases · 4 dated · 3 state a duration · 3 moments cited inside conditions
OBSERVED the four outage dates, recorded in the corpus as of the 2026-08 refresh. They were previously inferred from the earliest citation attached to each case — a proxy that placed the October 2025 AWS outage days early and the July 2024 CrowdStrike outage two weeks late. DERIVED the durations, taken as the longest interval stated in a case's own prose, and the ◆ moments, matched as “<Month> <Year>” in a condition's text. STILL UNRECORDED when any of the six conditions began. The rails assert nothing except that the corpus holds no start and no end for them.

Look at the column above December 2021. The AWS cascade is there as a finished event, seven hours long, closed. It is also there as a ◆ on the control-plane rail, cited as evidence that the dependency exists — a rail with no end. The same three weeks are in this corpus twice, once as something that happened and once as proof of something that has not stopped. Nothing in the schema distinguishes the two readings, and the published map draws both as the same dot.

▌Interpreted

Qualification

“Severity” is not measuring severity

The field is called severity and takes two values. Neither is a magnitude. They answer a different question — has this already happened? — and sorting by them ranks nothing.

severity: demonstrated — 4 cases

“Demonstrated failure”. An event with a date, a duration and a casualty list.

AWS December 2021 outage cascade · 7 hr
CrowdStrike July 2024 · —
Fastly CDN outage · 49 min
AWS us-east-1, 19-20 October 2025 · 15 hr

severity: structural — 6 cases

“Structural dependency”. A standing arrangement with no event, no duration, and no end.

AWS us-east-1 control plane concentration
EU data sovereignty
Loudoun County
Epic on Azure/AWS
DNS concentration
Cloud egress pricing

OBSERVED the field values, verbatim. NOT DERIVED any ordering — a 49-minute CDN failure and a control-plane concentration with no recorded end are not two points on one scale, and this page does not place them on one.

A demonstrated failure is better evidenced than a structural one — it has a date, a duration, and named casualties. A structural dependency is arguably the more serious finding and the harder one to prove. Reading the field as severity gets the relationship backwards: it is an axis of proof, not of harm.

▌Interpreted

What the ten records describe

Somebody else's region policy, somebody else's billing model

The corpus's own account of each dependency: what runs through it, what happens when it moves, and who decides. Verbatim.

AWS us-east-1 control plane concentration

Control plane Structural dependency

The dependencyAWS Identity & Access Management (IAM), Route 53 DNS management, CloudFront provisioning, AWS Organizations, and DynamoDB Global Tables all have control planes that require us-east-1. Customers deploying in eu-west-1 or ap-southeast-1 still depend on us-east-1 for authentication, DNS changes, and account management. What happened / what it costsWhen us-east-1 fails, services in other regions can't authenticate, can't update DNS, can't provision new resources. The December 2021 outage proved this: services not explicitly using us-east-1 failed because their control plane dependencies lived there. Who decidesAmazon Web Services. $35B invested in Northern Virginia alone. 65 data centers in Loudoun County. $576M in annual local tax revenue (30%+ of county budget). Same county driving PJM capacity cost explosion. Who is downstreamAll AWS customers globally

AWS December 2021 outage cascade

Outage cascade Demonstrated failure

The dependencyDec 7: us-east-1 network device overload cascaded to EC2, S3, DynamoDB, ELB (7+ hours). Dec 15: us-west-2 impacted Slack, DoorDash, PlayStation, Zoom (1+ hour). Dec 22: us-east-1 power failure took down Slack, Okta, NY Court System. What happened / what it costsBillions in estimated economic losses. Ring doorbells stopped working. Robinhood trading halted. IRS website went down. NY state court filing system offline. Each outage revealed new dependency chains nobody had mapped. Who decidesAWS. Customers had no visibility into the control plane dependency until it failed. Post-incident, AWS published guidance on reducing us-east-1 dependencies — effectively admitting the concentration risk they'd built. Who is downstreamDisney+, Netflix, Slack, Robinhood, Coinbase, Ticketmaster, Venmo, Instacart, Roku, Kindle, IRS, NY Court System

CrowdStrike July 2024

Software supply chain Demonstrated failure

The dependencyCrowdStrike Falcon runs at kernel level on Windows. Channel File 291 defined 21 input parameter fields while the calling code supplied 20; a Rapid Response Content update using a non-wildcard match on the 21st parameter caused an out-of-bounds read and a boot loop. The mismatch passed build validation, stress testing and several prior field deployments. Every organisation running Falcon on Windows was hit simultaneously, with no customer action involved. What happened / what it costs5,078 flights cancelled (4.6% of those scheduled). Hospitals reverted to paper records. Emergency dispatch degraded. Trading disrupted. Remediation required physical access to each machine — there was no remote fix. CrowdStrike added input-count validation and bounds checking on 25 July 2024 and commissioned two independent security reviews. Who decidesCrowdStrike pushed the update. Microsoft's OS architecture allowed kernel-level access. Neither customers nor affected end-users had any lever. The blast radius was set by vendor market share, not by any customer's choice. Who is downstream8.5M Windows systems. Airlines (5,078 flights cancelled), banks, hospitals, stock markets, gas stations, emergency services.

Fastly CDN outage

CDN concentration Demonstrated failure

The dependencyFastly CDN serves as the edge layer between users and origin servers. Bug deployed May 12 lay dormant until triggered June 8 by a valid config change. 85% of Fastly's network returned errors simultaneously. What happened / what it costsMajor news, government, e-commerce, and social platforms unreachable for ~49 minutes. NYT redirected to Google Cloud origin as workaround. UK government services offline. Demonstrated that CDN concentration creates systemic fragility across unrelated organizations. Who decidesFastly. The triggering customer didn't do anything wrong. The bug was in Fastly's own deployment from a month earlier. Every Fastly customer inherited the risk. Who is downstreamReddit, New York Times, The Guardian, Twitch, UK government website, Amazon, eBay, Stack Overflow, Shopify merchants

AWS us-east-1, 19-20 October 2025

Outage cascade Demonstrated failure

The dependencyA latent race condition in DynamoDB's internal DNS management removed the DNS records for its us-east-1 endpoints — not a Route 53 customer-facing failure, but internal automation. 141 AWS services were affected. Ring, smart locks and thermostats depend on that control path with no local fallback. What happened / what it costsThe DNS fault itself was resolved by about 2:40am PDT on 20 October; cascading failures across EC2, load balancing, Lambda and ECS extended full recovery to 2:20pm PDT — roughly 15 hours end to end. 10 million Ring devices went offline: no recording, no motion alerts, no remote access. Roughly 4M end users across 1,000+ companies affected, including Snapchat, Fortnite, Signal, Duolingo and banking apps. IoT devices became inert hardware. Who decidesAWS. Ring is an Amazon subsidiary — even Amazon's own hardware products couldn't survive Amazon's own infrastructure failure. Consumers who bought 'security' devices found their security was downstream of a DNS table. Who is downstream4M users, 1,000+ companies, 141 AWS services. Ring doorbells (10M devices offline), smart locks, thermostats.

EU data sovereignty

Sovereignty gap Structural dependency

The dependency120+ countries now have data protection laws. EU GDPR requires data residency. But the US CLOUD Act (2018) compels US-based providers to produce data regardless of storage location. Microsoft's EU Data Boundary addresses residency but explicitly does not override CLOUD Act obligations. What happened / what it costsGaia-X — the EU's sovereign cloud initiative — was diluted after US hyperscalers lobbied for inclusion. EU organisations on AWS, Azure or GCP have data residency but not data sovereignty. Three US companies hold 63% of the global cloud infrastructure market as of Q1 2026 (AWS 28%, Microsoft Azure 21%, Google Cloud 14%), on $129B of quarterly spend. Who decidesUS government (via CLOUD Act) and US hyperscalers (via market dominance). EU Data Boundary is a geographic feature, not a legal one. Executive agreements with UK (2019) and Australia (2021) formalize the access mechanism. Who is downstreamEU governments, enterprises, and citizens using US cloud providers

Loudoun County

Physical concentration Structural dependency

The dependency115 data centres in one county; AWS alone has 65 across 500+ acres. Data centres drove 63% of PJM's $9.3B capacity cost increase and 94% of projected 32 GW demand growth. The 2025/2026 capacity auction cleared at $269.92/MW-day against $28.92 the year before — an 833% rise, which IEEFA described as roughly a factor of ten. Both describe the same auction. The same physical concentration that makes us-east-1 a cloud chokepoint makes it a grid chokepoint. What happened / what it costsCloud users worldwide depend on infrastructure in one county, and PJM ratepayers across 13 states pay for its power. Prices have stayed at or near the cap since: $329.17/MW-day for 2026/2027 and $325/MW-day for 2028/2029, the latter still 6,831 MW short of PJM's reliability requirement. $576M in annual tax revenue leaves the county government fiscally dependent on continued data centre growth. The dependency runs in every direction. Who decidesHyperscalers (investment decisions), PJM (market rules), Loudoun County (permitting), Virginia (state policy). No single entity governs the compound exposure. The atlas's US infrastructure cases and cloud cases converge here. Who is downstreamGlobal cloud users (via control planes) + 67M PJM ratepayers (via capacity costs)

Epic on Azure/AWS

Sector dependency Structural dependency

The dependencyEpic Systems dominates the US hospital EHR market. KLAS's 2024 study found 30 health systems running Epic on public cloud, roughly 90% of them on AWS. That split has since moved: Epic shifted its Nebula and Cogito offerings to Microsoft Azure, and 2026 reporting indicates Azure now has more live Epic deployments by count than AWS. No current published total for health systems on public cloud could be found, so the 30 figure remains as of 2024. Epic stopped Google Cloud integrations, leaving two viable providers. Healthcare cloud market: $79.5B (2024) projected to $309.5B (2033). What happened / what it costsPatient records, clinical workflows, medication ordering, and billing all run through one EHR vendor on one or two cloud providers. A cloud outage becomes a clinical safety event. Migration costs and vendor lock-in make exit prohibitively expensive. Who decidesEpic Systems (EHR), AWS/Azure (infrastructure). Health systems choose Epic but inherit cloud vendor dependency. Patients have no say in any of it. Regulatory oversight (HIPAA) covers data handling, not infrastructure concentration. Who is downstream30 North American health systems, millions of patient records

DNS concentration

CDN / DNS concentration Structural dependency

The dependencyDNS is the phone book of the internet. 49% of all domains depend on Top 10 NS providers. 98% of domains use a single NS provider — no redundancy. 5% of indirect resolvers support 90% of all forwarding. BGP routing errors cascade through DNS: one misconfiguration can make entire networks unreachable. What happened / what it costsFacebook October 2021: BGP routing error → authoritative DNS failure → 3.5 billion users offline for 6 hours. Internal tools also went down, preventing engineers from fixing it remotely. Demonstrated that DNS concentration creates systemic risk invisible to users. Who decidesA handful of DNS/CDN providers. No single authority verifies BGP route announcements. Domain owners choose one NS provider and inherit its failure modes. End users have no visibility into which DNS provider serves the sites they use. Who is downstream49% of all domain names. 90% of DNS forwarding through 5% of resolvers.

Cloud egress pricing

Pricing as governance Structural dependency

The dependency$0.08-0.12/GB to move data out. 6-12% of typical cloud bills (20-40% for data-heavy orgs). Cross-region pricing incentivizes co-location in one region (reducing resilience). Reserved instances lock organizations into multi-year commitments. 2025: providers reduced egress fees under regulatory pressure, but cross-AZ/NAT gateway costs unchanged. What happened / what it costsOrganizations cannot afford to leave — migration cost exceeds switching benefit. Architecture decisions driven by billing rather than resilience. Cross-AZ pricing discourages the very redundancy that would protect against outages. The pricing model enforces concentration. Who decidesAWS, Azure and GCP set the prices. The three hold 63% of the global cloud infrastructure market as of Q1 2026 (AWS 28%, Azure 21%, Google 14%). Cloud infrastructure spend reached $129B in Q1 2026 alone, up 35% year on year. Egress pricing is not regulated as a switching cost anywhere. Who is downstreamAll organizations using hyperscaler cloud services

OBSERVED reproduced verbatim from the corpus, per-case citations

Case evidence

The ten

Case	Category	Mode	Provider	Location
AWS us-east-1 control plane concentration	Control plane	Structural	AWS	Loudoun County, Virginia
IAM, Route 53, and CloudFront control planes all run in one county in Virginia — every AWS customer worldwide is downstream of us-east-1 whether they deploy there or not.
AWS December 2021 outage cascade	Outage cascade	Demonstrated	AWS	us-east-1 / us-west-1 / us-west-2
Three major AWS outages in three weeks (Dec 7, 15, 22). The first took down Netflix and Disney+ for 7 hours. The blast radius proved that most of the internet is one region failure away from dark.
CrowdStrike July 2024	Software supply chain	Demonstrated	CrowdStrike / Microsoft Windows	Global (Windows systems worldwide)
A faulty Falcon sensor update from one security vendor crashed 8.5 million Windows machines worldwide on 19 July 2024 — 5,078 flights cancelled, hospitals on paper, emergency dispatch degraded. Widely described at the time as the largest IT outage on record.
Fastly CDN outage	CDN concentration	Demonstrated	Fastly	Global (Fastly CDN network)
A valid customer config change triggered a latent bug in Fastly's CDN. For 49 minutes, Reddit, NYT, UK government, Twitch, and Amazon were unreachable. One CDN vendor = one point of failure for half the visible internet.
AWS us-east-1, 19-20 October 2025	Outage cascade	Demonstrated	AWS	us-east-1, Northern Virginia
A latent race condition in DynamoDB's DNS automation removed the endpoint records at 11:48pm PDT on 19 October 2025. Full recovery came at 2:20pm PDT on the 20th — about 15 hours, 141 AWS services, 10 million Ring doorbells inert. Your doorbell is downstream of a database in Virginia.
EU data sovereignty	Sovereignty gap	Structural	AWS / Azure / GCP (all US-based)	European Union
Microsoft completed its EU Data Boundary in February 2025. The data stays in Europe. The CLOUD Act still applies. Residency is not sovereignty.
Loudoun County	Physical concentration	Structural	AWS, Microsoft, Google, Meta, and others	Loudoun County, Virginia
World's largest data centre concentration: 115 data centres, the AWS us-east-1 control plane, $576M in local tax revenue, and the county at the centre of PJM's capacity price surge. Cloud dependency and grid dependency are the same place.
Epic on Azure/AWS	Sector dependency	Structural	Epic Systems / Microsoft Azure / AWS	United States (30 health systems)
30 major health systems now run Epic on AWS or Azure. Epic stopped Google Cloud integrations. Your medical records are downstream of two cloud vendors and one EHR monopoly.
DNS concentration	CDN / DNS concentration	Structural	Cloudflare, AWS Route 53, Akamai, and others	Global (DNS infrastructure)
49% of all domain names rely on 10 nameserver providers. 98% use a single NS provider. When Facebook's BGP misconfiguration took out its DNS in October 2021, 3.5 billion users lost access for 6 hours.
Cloud egress pricing	Pricing as governance	Structural	AWS, Azure, GCP	Global (all cloud customers)
Moving 50TB out of AWS costs $3,500-7,000 in egress fees. Cross-AZ pricing discourages resilient architectures. The billing model is a governance layer that shapes what you can build and whether you can leave.

AuditEverything below is the page checking itself.

Audit · what the marks mean

● Observed

Read off a cited source. Has a unit and a receipt.

◌ Derived

Computed here. Shows its rule; carries no receipt.

▌ Interpreted

Authored judgment. Publishable — and not evidence.

⊘ Refused

Declined or unavailable. Shown, not omitted.

What this page does not claim. That any of these outages will recur, or that a structural dependency will fail. That one case is worse than another. That the four dated events are representative of anything — they are the ones somebody wrote about.

Audit · boundary conditions

What this page does not show

An atlas of ongoing dependency, whose only precise records are of things that stopped.

The four event dates are recorded; the six start dates do not exist. Event dates were added to the corpus in the 2026-08 refresh, replacing a proxy that had placed one outage days early and another two weeks late. Nothing comparable is available for the standing conditions: the schema still has no way to say when one began.
Durations come from prose, not fields. 3 of the 4 events state one somewhere in their own text. Nothing enforces that they are measured the same way.
Selection is invisible. Four outages appear out of the many that occurred in this period. The corpus records no criterion for inclusion, so the set cannot be read as a sample of anything.
The conditions are not unmeasured — they are undated. Their prose carries plenty of figures (49% of domains, 115 data centres, $576M in county tax revenue). What none of them has is a date, a duration, or a field to put either in. The schema has no slot for when a standing arrangement began.
The event/condition split is the corpus's, and it leaks. The DNS concentration case is marked structural, yet its own prose contains a dated, timed event — Facebook's October 2021 BGP misconfiguration, “3.5 billion users offline for 6 hours”. The duration rule on the figure above is applied only to cases the corpus marks demonstrated, so that event gets no tick. Tense collapse happens inside single records too, not only across them.
Nothing records how sure anyone was. This atlas has no confidence field at all, so every case is presented at the same footing regardless of how well attested it is.

Audit · method

What is computed here

The corpus now records when the four outages happened. It still has no way to record when any of the six standing conditions began.

Event date — read from the corpus's event_date, added in the 2026-08 refresh for the four cases marked demonstrated. Duration — the longest interval matched by regex in a case's own prose. The still-running band — drawn for every structural case, and it asserts nothing except that the corpus records no end. The evidence window (2021-06-08 → 2026-07-14) is min/max of all citation dates.

severity is reproduced, never ordered. Its two values distinguish an evidential mode, not a magnitude, so nothing on this page sorts or colours by it as though it were a scale.

There is no map because this atlas's cases are global services and concentration facts. Placing “us-east-1” as a dot in Virginia would add a geography that carries almost none of the argument.

Audit · sources

Source material

All 21 citations — exactly two per case.

7 of these 21 citations carry a retrieval date — the ones re-checked in the 2026-08 refresh. The rest carry none rather than a manufactured one. No citation in this corpus has an archive snapshot, so nothing here is preserved against removal. Publication dates record when someone wrote about a case, which for the four outages is near the event and for the six conditions is not related to when they began.

Supports	Publisher	Published
AWS us-east-1 control plane concentrat	AWS	2024-01-01
AWS us-east-1 control plane concentrat	Data Center Dynamics	2025-06-01
AWS December 2021 outage cascade	CNBC	2021-12-07
AWS December 2021 outage cascade	Catchpoint	2021-12-15
CrowdStrike July 2024	CrowdStrike	2024-08-06
CrowdStrike July 2024	TechTarget	2024-08-01
Fastly CDN outage	Fastly	2021-06-08
Fastly CDN outage	ThousandEyes	2021-06-15
AWS us-east-1, 19-20 October 2025	ThousandEyes (Cisco)	2025-10-20
AWS us-east-1, 19-20 October 2025	PCWorld	2025-10-21
EU data sovereignty	Synergy Research Group	2025-12-01
EU data sovereignty	Akave	2025-06-01
Loudoun County	IEEFA	2025-03-18
Loudoun County	PJM Interconnection	2026-07-14
Loudoun County	Data Center Frontier	2025-01-01
Epic on Azure/AWS	KLAS Research	2024-08-01
Epic on Azure/AWS	EHC Consulting	2026-01-01
DNS concentration	Cloud Security Alliance	2025-11-21
DNS concentration	MDPI Applied Sciences	2023-05-01
Cloud egress pricing	Synergy Research Group	2025-12-01
Cloud egress pricing	CloudOptimo	2025-01-01

Built from docs/cloud/data/cases.geojson by tools/build_atlas_cloud.py. Case prose is reproduced verbatim from the corpus; every derived value states its rule on the page.
Hormuz · Insurance · All atlases