Data Privacy & Sovereignty on AWS

*Data Privacy & Sovereignty *​on AWS

In the previous post I started to wrote about the physical infrastructure of AWS, introducing the basic concepts for the upcoming new Region in Zurich.

Now I would like to spent few lines about a delicate topic, privacy and data sovereignty, with a focus on the last one.

Where is my data and who can move my data?

When you design and create your infrastructure is important to think about which kind of data you will use, and how you will use them. Storing data in resources that are placed in a public subnet (even if this resource does not have a public IP attached) is slightly different from placing them in a private subnet and could expose your infra from unexpected behaviour, as using an S3 bucket with the public endpoint and public access disabled by ACL/policies instead to use S3 access point. So keep in mind everything and remember that you choose the Region (where) when you create a storage resource and you define the IAM policies (who) associated.

AWS assure you that the services will respect your choices, this is the basic principle of the Shared Responsibility Model.

Can the US Government see my data?

We are aware of the existance of the CLOUD Act (Clarifying Lawful Overseas Use of Data). This is a law that provide to the US Government the right to challenge requests that conflict with foreign laws or national interests​. AWS must respond to this request, but this does not means that the US Government automatically has a direct access to our data. AWS is committed to notifying customers of requests for content to extent allowed, also examines each request individually to assess potential conflicts.

If you are interested to get more information on this process and the results you can take a look to the Information Request Report, following the link at the end of that page you can access to the report history and consult the PDFs, you can notice the following statement

How many requests resulted in the disclosure to the U.S. government of enterprise or government content data located outside the United States?
None.

Can I be compliant with data protection laws and regulations if I use AWS?

AWS supports more security standards and compliance certifications than any other offering, including FedRAMP, GDPR, CS, and NIST 800–171, helping customers satisfy compliance requirements for virtually every regulatory agency around the globe.​

​These controls strengthen your customers compliance and certification programs, while also offering access to tools that they can use to reduce costs and time to run their own specific security assurance requirements.​

​Swiss Data Protection Law, Swiss Professional Secrecy Laws and FINMA are included.​

Can AWS access customer data?

Rember what we said before: customer control who can access their data.

AWS prohibit, and their systems are designed to prevent, remote access by AWS personnel to customer data for any purpose, including service maintenance, unless requested by a customer, required to prevent fraud and abuse, or to comply with the law.​

You have 2 types of safeguards:

Technical safeguards

• Data encryption (encryption at rest)
  -​ AWS CloudHSM and AWS Key Management Service (KMS)​

• Access control​

• IAM and Control Tower data residency guardrails​

• Monitoring and logging​

• AWS CloudTrail and Amazon CloudWatch​

• AWS Nitro system​

• With the AWS Nitro System, there’s no mechanism for any system or person to log in to EC2 servers (the underlying host infrastructure), read the memory of EC2 instances, or access any data store on instance storage and encrypted Amazon Elastic Block Store (Amazon EBS) volumes.​

Contractual safeguards

• Customer Agreement (CA)​

• Data Processing Addendum (DPA)​

• Supplementary Addendum​

• Standard Contractual Clauses (SCCs)

Opt-out your data

If you want to check which kind of control (encryption, deletion, etc) you have on your data, take a look to the privacy page.

You can use AWS services with the confidence that your customer data stays in the AWS Region you select. A small number of AWS services involve the transfer of customer data, for example, to develop and improve those services, where you can opt-out of the transfer, or because transfer is an essential part of the service (such as a content delivery service).

Conclusions

Ok, now you should have more information, or at least some usefull links :). If you still need further support does not hesitate to reach me out or contact an AWS Partner like us.

Original post here