DRHCSEC03-BP01 Implement controls that enhance your digital sovereignty governance posture
Consider implementing controls which are not data residency specific as these controls help enable a defense in depth approach to security and are often easy to enable without requiring customization.
Desired outcome: Preventative controls deny storage of data in locations that lack compliance with data residency regulations.
Common anti-patterns:
-
Attempting to author and maintain all the controls within your organization rather than using controls maintained by AWS, AWS partners, or others who invest continuously in maintaining controls focused on digital sovereignty
Benefits of establishing this best practice: Rigorously tested controls are deployed through automated procedures that improve your ability to securely scale more rapidly and cost-effectively.
Level of risk exposed if this best practice is not established: High
Implementation guidance
-
Enable the AWS Control Tower digital sovereignty group of controls. Evaluate each control's applicability to your scenario, as some controls have very limited use cases where they should be applied. One of the most commonly deployed controls is the OU Region deny control.
-
While the same set of preventative and detective controls can be reproduced without deployment through Control Tower, it is highly recommended to use Control Tower to eliminate the undifferentiated heavy lifting of maintaining these controls yourself. This practice also facilitates easier deployment of new controls as they become available.
-
-
Disable any Local Zones (at the account level) that are currently enabled but not required.
-
Deploy an SCP to deny the ec2:ModifyAvailabilityZoneGroup IAM action to all principals that do not have explicit approval to opt in to Local Zones for the account.
-
Establish a data perimeter as discussed in SEC03-BP08 Share resources securely within your organization, as controlling which principals have access to data is a foundational step to controlling the location where data can be stored.
-
Deploy encryption controls to enforce usage of encryption. Where supported, require AWS KMS customer-managed keys, and implement fine grained AWS KMS key policies to promote security-in-depth and add another level of data access control.
Resources
Related best practices:
Related documentation:
