Architecting a Secure Landing Zone in AWS European Sovereign Cloud

Introduction to AWS European Sovereign Cloud

The AWS European Sovereign Cloud is an independent cloud infrastructure designed for Europe, operating entirely within the European Union. It is physically and logically distinct from existing AWS Regions, functioning as its own AWS partition named 'aws-eusc'. This new cloud provides the same services, features, and APIs as commercial AWS Regions but maintains separate control planes, AWS Identity and Access Management (IAM), billing, consoles, and service endpoints.

Architecting a Secure Landing Zone

The article outlines how to build a secure and scalable landing zone within the AWS European Sovereign Cloud. Key architectural considerations include account structure and governance, identity management implemented as infrastructure as code (IaC), centralized logging to a security information and event management (SIEM) tool, and robust data protection strategies. It also addresses network and perimeter design, secure continuous integration and delivery (CI/CD) processes, artifact distribution, and incident response protocols.

The proposed design aligns with the AWS Security Reference Architecture (AWS SRA) and the AWS Well-Architected Framework. It differentiates between platform boundaries inherent to a sovereign partition and configurable choices available to users.

Compliance and Partition Boundaries

For organizations evaluating compliance readiness, a companion post discusses aligning with C5:2020 criteria, offering an independent assessment report and compliance workbook. A foundational concept for the AWS European Sovereign Cloud is its status as a distinct partition. AWS organizes Regions into partitions, each with independent IAM instances, creating a hard boundary between Regions in different partitions.

The AWS European Sovereign Cloud forms the 'aws-eusc' partition, with its first Region located in Brandenburg, Germany (eusc-de-east-1). This separation impacts functionalities like billing roll-ups, single sign-on (SSO), cross-account roles, AWS Direct Connect, and image distribution, which must be managed within the partition's boundaries.