DynamoDB Global Replication with Data Localization

On the main AWS Region, set services to add items with a localization-authority field into a regional DynamoDB table.

Enable DynamoDB Streams to capture events about mutated items and handle the events with an AWS Lambda event-listener function.

Map localization authorities to Regions with AWS AppConfig. Read the map on the function, then discard changes on items localized in the current Region and items already moved using event filtering.

Raise an event containing the mutated item details and the localization Region to an event bus in EventBridge.

Set up EventBridge rules for cross-Region event routing. Send global items to all Regions. Send remotely localized items only to the localization Region defined on the payload.

On destination Regions, handle received item details with a Lambda replicator function.

Replicate received items in regional DynamoDB tables, then raise an event to the Region of origin indicating that the replication finished.

On the Region of origin, handle the finished event with an anonymizer Lambda function.

Set the function to anonymize sensitive information from localized moved items, stamping them with the localized Region that they moved into. Ignore global items.

When services update items, only update global items and localized items that belong to the same Region where they are stored.

If a localized item to update has already moved to a different Region, make a cross-Region call to the DynamoDB table in the localized Region to update the record.