AWS to Sever European Sovereign Cloud from Global Backbone for Sovereignty Test

October 24 exercise aims to demonstrate independent operation of EU-based cloud region

By LineZotpaper
Published
Read Time2 min
On Saturday, October 24, AWS will disconnect its European Sovereign Cloud from the AWS Global Network backbone for several hours to demonstrate that the region can operate independently. The test, which aligns with the EU Cloud Sovereignty Framework and Germany's BSI C3A criteria, is designed to prove that critical services remain functional without connectivity to the global infrastructure.

The exercise involves cutting off two systems: the Global Network backbone, which moves operational data between AWS locations, and a dedicated channel for limited data transfers that will be switched off entirely. Traffic will then fall back to the public internet via the region's own links from European ISPs. Customers may experience short disruptions while routes reconverge.

Stéphane Israël, managing director of the AWS European Sovereign Cloud, stated that the region is operated by a team composed entirely of EU residents working in the EU, using hardware and software in data centers in Brandenburg that hold a local copy of the source code. Customer content and customer-created metadata remain within the EU, though some operational data may leave the region.

AWS has acknowledged that neither of the disconnected systems is operation-critical, which is why the region can survive without them. The company has not claimed certification from the exercise but says customers can use the results in their compliance packages, and regulators will be informed afterward.

Fadi Dasus, a senior cloud security architect, offered a nuanced assessment: "Sovereignty on a US-owned cloud in the EU comes down to two areas. The technical one: does the service stop if the link to the US is cut? The legal one: can US law order it to hand over your data, or to stop serving you? If the test goes as planned, the first area is no longer entirely in American hands. The second still runs through the US parent. So, this is real progress for resilience. It just isn't sovereignty."

§

Analysis

Why This Matters

  • The test directly addresses concerns about foreign control over EU data in cloud services, a key issue for regulated industries and government agencies.
  • A successful demonstration could accelerate adoption of sovereign cloud offerings, but a failure might undermine trust in such projects.
  • The distinction between technical resilience and legal sovereignty highlighted by observers may shape future regulatory requirements.

Background

AWS announced its European Sovereign Cloud in 2023 to meet strict EU data sovereignty requirements. The region is physically located in Brandenburg, Germany, and is operated exclusively by EU residents. Unlike standard AWS regions, it restricts data movement to comply with frameworks such as the EU Cloud Sovereignty Framework and Germany's BSI C3A criteria. The upcoming test is the first public demonstration of its ability to run autonomously from the global network.

Key Perspectives

AWS and the European Sovereign Cloud team: The exercise proves that the region can operate independently, providing resilience and compliance benefits for customers. The company positions it as part of its commitment to meeting European sovereignty standards. Fadi Dasus and technical skeptics: The test addresses technical independence but does not resolve legal vulnerabilities stemming from AWS's US parent company, which could be subject to US law such as the CLOUD Act. The exercise is progress for resilience, not full sovereignty. European regulators: They will likely scrutinize the results to determine whether the region meets stated sovereignty criteria. The framework expects demonstrable independence from non-EU control, including both technical and legal dimensions.

What to Watch

  • Whether AWS publishes detailed results of the test and any independent audits of the outcome.
  • Reactions from European regulators, particularly in Germany and at the EU Commission, who may update their sovereignty frameworks based on the demonstration.
  • Customer migration patterns to the sovereign cloud versus standard AWS regions, indicating market confidence in the offering's independence.

Sources

Checked

12 claims in this story checked against 1 source: 10 supported.

Show each claim
  1. SupportedAWS to Sever European Sovereign Cloud from Global Backbone for Sovereignty TestInfoQ: “On Saturday, October 24, AWS will cut its European Sovereign Cloud off from the AWS Global Network backbone for several hours.”
  2. SupportedOctober 24 exercise aims to demonstrate independent operation of EU-based cloud regionInfoQ: “AWS Will Run Its European Sovereign Cloud Without the Global Backbone for Several Hours”
  3. SupportedOn Saturday, October 24, AWS will disconnect its European Sovereign Cloud from the AWS Global Network backbone for several hoursInfoQ: “On Saturday, October 24, AWS will cut its European Sovereign Cloud off from the AWS Global Network backbone for several hours.”
  4. SupportedThe test aligns with the EU Cloud Sovereignty Framework and Germany's BSI C3A criteriaInfoQ: “Israël writes that the exercise is built to line up with the EU Cloud Sovereignty Framework and Germany’s BSI C3A criteria.”
  5. Partly supportedThe test is designed to prove that critical services remain functional without connectivity to the global infrastructureInfoQ: “The region is expected to keep running.”
  6. SupportedThe exercise involves cutting off two systems: the Global Network backbone, which moves operational data between AWS locations, and a dedicated channel for limited data transfers that will be switched off entirelyInfoQ: “Two systems come out. One is the Global Network backbone, the private network that moves operational data between AWS locations. The other is a dedicated channel for limited data transfers, switched off entirely.”
  7. SupportedTraffic will then fall back to the public internet via the region's own links from European ISPsInfoQ: “Traffic then falls back to the public internet over the region’s own links from European ISPs.”
  8. SupportedCustomers may experience short disruptions while routes reconvergeInfoQ: “Customers may see short disruptions while routes converge at either end.”
  9. SupportedStéphane Israël, managing director of the AWS European Sovereign Cloud, stated that the region is operated by a team composed entirely of EU residents working in the EU, using hardware and software in data centers in Brandenburg that hold a local copy of the source codeInfoQ: “Stéphane Israël, managing director of the AWS European Sovereign Cloud, says a team 'composed entirely of EU residents working in the EU' will run it on the region’s own hardware and software, out of data centers in Brandenburg that hold a local in-EU copy of the source code.”
  10. SupportedCustomer content and customer-created metadata remain within the EU, though some operational data may leave the regionInfoQ: “Customer content and customer-created metadata stay in the EU . Some operational data leaves.”
  11. SupportedAWS has acknowledged that neither of the disconnected systems is operation-critical, which is why the region can survive without themInfoQ: “The caveat comes from AWS. Neither system is operation-critical. That is why the region survives without them.”
  12. Not in the sourcesFadi Dasus, a senior cloud security architect, offered a nuanced assessment: 'Sovereignty on a US-owned cloud in the EU comes down to two areas. The technical one: does the service stop if the link to the US is cut? The legal one: can US law order it to hand over your data, or to stop serving you? If the test goes as planned, the first area is no longer entirely in American hands. The second still runs through the US parent. So, this is real progress for resilience. It just isn’t sovereignty.'InfoQ: “Fadi Dasus , a senior cloud security architect, split the question in two: Sovereignty on a US-owned cloud in the EU comes down to two areas.”

Zotpaper

Written by software from the reporting listed above, scored by an automated standards desk, and published without a person reading it first. If something here is wrong, tell the editor and it will be put right.

How we workSubscribe