Data Residency
Data ProtectionData Residency (or data sovereignty) refers to the requirement that data must be stored and processed in specific geographic locations. Many regulations mandate that certain data types never leave a particular country or region.
AWS Controls for Data Residency
- Region Selection: choose AWS regions that align with regulatory requirements
- SCPs: use
aws:RequestedRegioncondition to prevent resource creation in unauthorized regions - S3 Object Lock: prevent data from being moved or deleted
- VPC Endpoints: ensure data stays on the AWS network without crossing the internet
- AWS Outposts: AWS hardware in your data center for data that must stay on-premises
Regulatory Frameworks
- GDPR: EU personal data requires appropriate safeguards for non-EU transfers
- CCPA: California consumer privacy regulations
- Data Protection Acts: country-specific laws (France, Germany, Australia, Brazil LGPD)
- Government Cloud: AWS GovCloud (US) for ITAR/EAR-regulated data
Related Terms
Meeting regulatory requirements and industry standards (SOC 2, HIPAA, GDPR, PCI DSS, CIS) for data protection, access control, and security practices in the cloud.
Protecting stored data by encrypting it on disk so that it cannot be read without the encryption key, even if the storage media is compromised.
An organization-wide guardrail that restricts what actions member accounts can perform, regardless of their IAM policies.
The framework defining that AWS is responsible for security of the cloud (infrastructure), while customers are responsible for security in the cloud (data, access, configuration).
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.