Security, Compliance, and Governance · Topic 7 of 8
Data Protection, Sovereignty and Residency
Layer encryption, access control and audit logs to protect data, keep it in approved Regions with SCPs, and meet sovereignty through key control.
- 5 min
- Residency is about location; sovereignty is about legal and operational control.
- An SCP on
aws:RequestedRegionenforces Regions, but must exempt global services. - Control Tower Region deny is the managed version of that SCP.
What it is
Data protection is the combined design that keeps data confidential, intact and available: encryption, access control, audit logging and recoverable copies. Regulators then add two narrower demands.
Data residency is about location: data must be stored and processed only in approved countries or Regions. Data sovereignty is about control: the data stays subject to the laws of a jurisdiction, and the customer, not the provider or a foreign authority, controls access to it and to its keys.
How it works
Layered data protection
Start by classifying data, because the controls follow from the class. Then apply each layer.
| Layer | Typical controls |
|---|---|
| Encryption at rest | KMS customer managed keys; S3 default encryption with SSE-KMS and S3 Bucket Keys |
| Encryption in transit | TLS everywhere; deny S3 requests where aws:SecureTransport is false |
| Access control | Least-privilege IAM, key policies, RCPs, S3 Block Public Access, VPC endpoint policies |
| Audit logging | CloudTrail with data events, S3 server access logs, KMS key use in CloudTrail |
| Integrity and recovery | S3 Versioning and Object Lock; AWS Backup with Vault Lock and cross-account copies |
Using a customer managed KMS key gives a second access check. A principal needs both permission on the data and permission to use the key, so a bucket policy mistake alone does not expose the content.
Residency: keep resources in approved Regions
The standard control is an SCP that denies actions when aws:RequestedRegion is outside the approved list. It must exempt global services (such as IAM, AWS Organizations, CloudFront, Route 53 and AWS Support), usually with NotAction, or it breaks them.
AWS Control Tower offers the same thing as the Region deny control, applied to the landing zone or to OUs. Choose it when the organization already runs Control Tower, because it avoids maintaining a custom SCP.
Regions launched after March 2019 are disabled by default and must be opted in. Not enabling a Region is a simple extra layer, but the SCP is still the enforced control.
Transfer restrictions
Residency also covers copies. Check every feature that moves data across Regions.
| Feature | Residency question |
|---|---|
| S3 Cross-Region Replication | Is the destination Region approved? |
| DynamoDB global tables, Aurora Global Database | Are all replica Regions approved? |
| KMS multi-Region keys | Replicas only in approved Regions |
| AWS Backup cross-Region copy | Copy only to an approved Region |
| Amazon Bedrock cross-Region inference | Use a geographic inference profile, not a global one |
| CloudFront | Caches content at edge locations worldwide; keep regulated data off the CDN unless edge caching is allowed |
A geographic inference profile keeps Bedrock processing within a geography such as the US or the EU, while a global profile can route requests to any supported commercial Region.
Sovereignty: control of keys and operators
Sovereignty requirements usually target who could access the data. The strongest controls are about keys.
| Requirement | Choose |
|---|---|
| Keys under the customer's own policy and audit | KMS customer managed keys |
| Key material in single-tenant HSMs the customer controls | KMS custom key store backed by AWS CloudHSM |
| Key material must stay outside AWS, under the customer's control | KMS external key store |
| Infrastructure physically in the customer's country or facility | AWS Outposts or AWS Local Zones |
| A European cloud operated independently of other Regions | AWS European Sovereign Cloud |
The AWS European Sovereign Cloud has its first Region in Brandenburg, Germany, in a separate partition (aws-eusc). It operates independently from other AWS Regions, which suits public sector and regulated customers in the EU.
An external key store gives the customer a kill switch: if the external key manager stops serving the key, AWS services can no longer decrypt the data. The trade-off is that availability and latency now depend on the customer's key manager.
How the exam asks about this
- "All accounts must be limited to two EU Regions, including administrators, with the least operational overhead." -> Control Tower Region deny control, or an SCP on
aws:RequestedRegionwith global service exemptions. - "A regulator requires the bank to hold encryption keys outside AWS and be able to revoke AWS's ability to decrypt." -> KMS external key store.
- "Generative AI requests must be processed only in the EU, but the team wants extra throughput." -> Bedrock cross-Region inference with an EU geographic inference profile.
What to remember for the exam
- Residency is about location; sovereignty is about legal and operational control.
- An SCP on
aws:RequestedRegionenforces Regions, but must exempt global services. - Control Tower Region deny is the managed version of that SCP.
- Check every replication or copy feature for the destination Region.
- External key store keeps key material outside AWS; custom key store keeps it in your CloudHSM.
- A customer managed key adds a second permission check on top of data access.
A Region deny SCP without exemptions for global services can break IAM, Organizations and support access across the whole OU. Always include the exemption list and test on a small OU first.
Common mistakes
Relying on not opting in to Regions. Older Regions are enabled by default, and opt-in status is not a policy. Use an SCP or the Control Tower Region deny control.
Forgetting replicas and backups. A workload can sit in an approved Region while a global table replica or backup copy sits outside it, which breaks residency.
Picking CloudHSM when the key must leave AWS. CloudHSM still runs in AWS data centers. Only an external key store keeps key material outside AWS.
Check yourself
What is the difference between data residency and data sovereignty?
Residency is where data is stored and processed, while sovereignty is which jurisdiction's laws apply and who controls access to the data and keys.
Why must a Region deny SCP exempt services such as IAM and CloudFront?
Global services handle their requests in a fixed Region such as US East (N. Virginia), so a blanket deny on other Regions would block them.
Which KMS feature lets a customer keep key material outside AWS?
An external key store, which uses a key manager the customer runs outside AWS.
Topic 7 of 8 in Security, Compliance, and Governance
Test yourself on Security, Compliance, and Governance
The full AWS SAP-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.