Organisations outside the US considering the use of Cloud services have been faced with a hard choice. All the major providers, including AWS, Azure, and Google, are based in the US and fall under US legal jurisdiction.
Companies in the EU or EU-adjacent locations (especially the UK) must consider GDPR and other data regulations. Typically, these regulations state that an organisation in one of these locations should limit the use of outside third parties unless those parties can guarantee parity with EU requirements. For simplicity, I'll refer to EU organisations for the rest of this article.
Working with US organisations, there have been attempts to simplify and reassure these parity requirements. Initially, we had the Safe Harbour agreements, which allowed US companies to self-certify that they could match EU data protection standards, allowing them to process data from the EU without the need for individual agreements between the EU and US companies. However, the European Court of Justice declared these agreements invalid in 2015 ruling that the US surveillance programs were not proportionate to what the EU considered necessary, and that there was limited redress for EU citizens.
These concerns, where governmental data requests can override the guarantees from US companies, have continued, and indeed expanded, primarily because of legal instruments such as the US CLOUD (Clarifying Lawful Overseas Use of Data) Act, which states that the US government could compel US tech providers to hand over data, including that from EU/UK-based organisations.
Recently, Microsoft confirmed in a statement to a French Court that it could be forced by the US authorities to hand over data from EU organisations. AWS has , stating that it knew its customers needed to control how and where their data was stored and managed. At that time, though, it suggested that the capabilities in the standard AWS offerings, such as multiple geographical regions, encryption functionality, and the limited access that AWS had to customer data, met those needs.
Amazon believed that European customers could host data in European regions, such as Frankfurt, Paris, and Dublin, provided by AWS, and that, combined with the functionality mentioned above, would provide sufficient controls to reassure European data regulators. However, as was pointed out, even if the data was now hosted in European data centers, those centers still belonged to a US company, which could be compelled to provide data access via the CLOUD Act.
A new approach
However, in 2023, Amazon announced a change in direction, that the new provider, the European Sovereign Cloud, or ESC, was now available to its customers.
So what does the new Cloud provide?
Legal isolation - the ESC is run by a new legal entity based in Germany, with German managing directors, and a board of EU citizens, including two independent third-party representatives, to provide additional oversight and expertise on sovereignty matters. Whilst the current workforce is all EU residents, new hiring conditions mean that only EU citizens will be hired in the future.
Physical Isolation - the new service is hosted on completely isolated hardware, meaning no access to AWS staff in the US and no data within the service traversing US networks.
New 'global' services - previously global services, such as IAM, Route53, and Certificate Management, are now delivered from within the sovereign cloud.
Access to 'global AWS' development resources - the source code that implements AWS services is available to the new region, allowing services to be deployed and updated.
There was also a new aspect that was confirmed on launch - whilst the new service is aimed at EU organisations, or those operating within the EU, it's actually available to customers located anywhere in the world, meaning that it may be of significant interest to those operating in an EU-adjacent manner, such as those in the UK.
So is all rosy with the new ESC?
Whilst the new provider is a significant step forward in delivering an EU-based service and reducing the data privacy issues, there are still some concerns:
Service parity - as with many new regions announced within the main AWS cloud, the ESC will need to catch up with services delivered in other regions. Whilst most services are available at launch, there are some significant missing pieces in the puzzle:
CloudFront - AWS's Content Delivery Network (CDN) is not currently available, although expected shortly. This may be of less concern due to the limited geographical market, but it does mean that organisations already deploying to the main AWS cloud may need to make some changes to their architectural designs.
Identity Centre - AWS generally recommends that its users use this service, allowing organisations to manage their user access to AWS via a centralised Identity Provider (IdP) such as Microsoft Azure.
Code 'star' services - AWS offers several services typically used in CI/CD deployments, such as repositories, pipelines, etc., which are not available in the European offering.
PrivateLink - one of Amazon's main security mitigations is the use of Virtual Private Clouds (VPCs). These can be used to isolate network traffic and access, either in public subnets that have access to the Public Internet, or in private subnets that have much more limited access. These private subnets may be impacted due to the lack of PrivateLink, which is used to provide access to AWS or organisational services without traversing the Public Internet.- A full list of services implemented in the ESC is available here.
Geographical resilience - within the main AWS cloud, users can mitigate the risk of losing services deployed in a region by deploying their services across multiple geographical regions. Currently, there is only a single region available in the ESC, although there are multiple availability zones, and more regions are expected shortly.
Changes to infrastructure naming - the new service is delivered via what AWS calls a new partition (similar to Gov Cloud, for example). This means that the internal identifiers for resources, known as Amazon Resource Numbers or ARNs, take a slightly different format. If users have assumed a particular format and hard-coded it in their Infrastructure as Code configurations, this will require some rework to deploy as is.
True legal independence - this is probably the biggest regulatory concern. The new provider is a completely separate legal organisation, but it remains a subsidiary of Amazon. There is concern that pressure could be placed on Amazon if a data request were made via the COURT Act, or if the US government imposed sanctions on the new organisation.
Conclusion
Whilst the new service is aimed at companies based or operating in Europe, its availability to those outside the EU will be attractive to other organisations, especially those with concerns around geopolitical stability.
However, the concerns listed above, especially the ownership of Amazon, mean that end users will still need to carefully consider the implications of using the new provider. However, global organisations operating in Europe now have a compliant path to delivering services within the EU, whilst still having access to most of the services available in the AWS ecosystem.
SOCIAL SHARE CARD GENERATOR