Amazon Key stands as a transformative solution in the logistics industry, addressing a persistent challenge: how to ensure timely and secure package deliveries in access-controlled environments. Every year, Amazon Key unlocks more than 100 million doors for verified delivery associates, spanning residential and commercial properties across four continents and over ten countries. The technology behind this system is both robust and scalable, designed to adapt to the complexities of modern last-mile delivery.

The Challenge of Access-Controlled Deliveries

Modern buildings and gated communities are equipped with a variety of access control systems, each with unique hardware and protocols. These systems were not originally designed with delivery logistics in mind, leading to fragmented solutions and unreliable network access. As a result, delivery drivers frequently encountered locked gates and inaccessible entrances, causing delays, missed deliveries, and frustrated customers.

Before Amazon Key, drivers had to rely on customers, property managers, or other residents to grant access—a process that often failed, especially at odd hours or when no one was available. The inability to reliably enter access-controlled areas became a significant bottleneck as delivery volumes and customer expectations for speed increased.

The Genesis of Amazon Key

The idea for Amazon Key was born out of a need to bridge the gap between legacy access control systems and modern logistics requirements. The project began as an internal initiative to solve a related problem: underutilized parking spaces in apartment buildings. The original concept involved a cloud-connected universal key that could interface with any electrically controlled lock, but the focus soon shifted to address the broader challenge of building access for deliveries.

Early efforts involved a small, Ethernet-connected device that integrated with existing access control hardware. When a delivery associate arrived, they could use the Amazon Flex app to trigger a cloud command, which would unlock the gate or door via AWS IoT. This initial design was simple and effective for a limited number of properties, but as Amazon Key expanded, new challenges emerged.

Scaling the Solution: Hardware and Connectivity

As Amazon Key grew from a handful of installations to thousands across multiple countries, the limitations of the original hardware became apparent. Many installation points, such as call boxes and mail rooms, had limited space and lacked reliable Ethernet connectivity. Running new cables was often impractical, requiring significant modifications to building infrastructure.

To overcome these challenges, Amazon Key engineers developed a compact, cellular-enabled device. This new hardware was small enough to fit into tight spaces and robust enough to operate in diverse environments. With multi-carrier support spanning over 70 countries, the device could maintain connectivity even in areas with poor or intermittent signal, ensuring reliable operation without relying on local building infrastructure.

Evolving the Backend: From Serverless to Containers

The initial backend architecture relied on AWS Lambda for handling unlock requests. While this approach was quick to implement, it struggled with scalability and latency, especially as the number of devices and regions expanded. Java-based Lambdas, in particular, suffered from cold start times that were unacceptable for time-sensitive delivery operations.

To address these issues, Amazon Key transitioned to a containerized backend using Amazon ECS Fargate. This move provided persistent device connections, low latency, and guaranteed CPU availability—critical for real-time unlocks. Fargate’s ability to scale based on concrete indicators like outstanding request count and CPU usage made it a cost-effective and operationally efficient choice compared to managing EC2 instances.

Building a Modular, Service-Oriented Architecture

With the backend now running on ECS Fargate, Amazon Key adopted a modular, service-oriented architecture. The system was broken down into several key services, each responsible for a specific aspect of the platform:

• Provisioning App: Simplified the installation process and supported onboarding new properties.
• Key Gateway Service: Handled requests from the Flex App and managed region-specific traffic routing.
• Access Management Service: Maintained relationships between gates, properties, and devices, and managed workflows for installation and maintenance.
• Device Management Service: Provided a wrapper for device commands and streamed performance metrics for analysis.
• AMZL Onboarding Service: Integrated properties into the Amazon Logistics system for routing and delivery workflows.
• OTA Management Service: Managed firmware updates for devices in the field.
• Flex App: Used by delivery associates to initiate access requests.

This modular approach enabled Amazon Key to evolve rapidly, supporting new features and integrations without disrupting core operations.

Ensuring Reliability in the Field

Switching to cellular connectivity introduced new challenges, as device performance could vary based on location and environmental factors. To address this, Amazon Key developed the Intelligent Connection Manager (ICM), which continuously monitors device performance and triggers automated corrective actions when issues are detected. ICM ensures that devices remain available and responsive during critical delivery windows, even in the face of connectivity fluctuations.

Expanding the Platform: Third-Party Integrations

As Amazon Key matured, its scope expanded beyond internal delivery operations. The platform was opened to third-party delivery providers, starting with Grubhub in 2023. To support this expansion, Amazon Key introduced the Partner Gateway Service, which provides a stable API for external partners to request access to secure properties. This service handles authentication, authorization, and rate limiting, ensuring that system integrity and performance are maintained as the platform grows.

Security and Access Control

Security is a cornerstone of Amazon Key’s design. For internal delivery flows, authentication is performed by Amazon Logistics services, and access is granted via short-lived tokens. For third-party providers, mutual TLS (mTLS) is used to authenticate partners and secure communications. Access is always time-bound and can be revoked if necessary, ensuring that only authorized personnel can unlock gates or doors.

Results and Impact

Today, Amazon Key supports over 100 million successful unlocks annually, with high system availability and low end-to-end latency. The platform has significantly improved first-attempt delivery success rates and reduced defects per building. These improvements have led to more efficient deliveries, lower support costs, and a seamless access control experience for property owners, residents, and guests.

Key Learnings

• Evolve as You Scale: Start with simple solutions, but be prepared to rearchitect as requirements grow.
• Measure What Matters: Focus on availability during critical periods, not just overall uptime.
• Standardization Enables Speed: Use consistent technology stacks and infrastructure as code for maintainability and reuse.
• Plan for Imperfect Environments: Design for resilience in the face of hardware, network, and environmental variability.
• Operate Based on Data: Centralize metrics and analytics to proactively identify and address issues.
• Use Tools Where They Fit: Choose the right tool for each job, whether it’s Lambda for stateless tasks or ECS for stateful workflows.
• Design for Growth: Build extensibility into the platform to support future integrations and use cases.

Conclusion

Amazon Key has transformed the way deliveries are made in access-controlled environments, enabling secure, reliable, and efficient access for millions of customers worldwide. By continuously evolving its hardware and software architecture, Amazon Key has set a new standard for logistics technology, proving that innovation and scalability can go hand in hand.

Read more such articles from our Newsletter here.