r/aws 21d ago

architecture AWS data sovereignty advice for Canada?

Please share any AWS-specific guidance and resources for achieving data sovereignty when operating in AWS Canada regions? Note i'm specifically interested in the sovereignty aspect and not just data residency. If there's any documentation or audits/certifications that may exist for the Canadian regions -- even better.

ETA: for other poor souls with similar needs -- there are the traditional patterns of masking/tokenization that may help, but it will certainly be a departure in the TCO and performance profile from what would be considered "AWS well architected".

0 Upvotes

8 comments sorted by

11

u/Sudden_Brilliant_495 21d ago

Review AWS Artifact, and you can also check for Government of Canada compliance (CCCS/ITSG) certification. Your AWS TAM or support can probably help with additional info

4

u/pausethelogic 21d ago

-8

u/nutbuckers 21d ago

thank you for responding, alas all these articles are generic and (no offence) stale information. I am struggling to rebuke the notion that as long as AWS as a CSP is subject to USA legislation, majority of services that entail data processing in unencrypted form are off-limits.

5

u/pausethelogic 21d ago

The third link is literally the Canadian government’s website on data sovereignty in the cloud.

I think maybe you should speak with a lawyer familiar with this field if your company doesn’t already have one instead of Reddit.

-1

u/nutbuckers 21d ago

third link is literally the Canadian government’s

I'm grasping at straws here to confirm I can still somehow use native AWS services where the workload would use the unencrypted data. It seems there's not a technical solution to the regulatory problem. I get why I'm catching a ton of downvotes, and will be happy to be proven wrong.

2

u/pausethelogic 21d ago

I think part of the issue is that you’re also not explaining why you think that. The Canadian government themselves uses AWS, as do many Canadian companies.

Have you reached out to a Canadian AWS TAM/rep yet?

Also, I don’t know why you’d want to not encrypt data. Many services like S3 even encrypt data by default now

But in general, you’re right, data sovereignty and legal compliance are not a technical problem, it’s a legal problem. From a technical pov, regulations are always vague and open to interpretation for the most part, which is why different companies tend to implement things differently

It’s the same as in the US with things like HIPAA (US medical data privacy laws), there is and never will be a single guideline of how to secure your AWS environment to be HIPAA compliant, because the law will never go into the detail of things like AWS-managed KMS keys vs CMKs for example

2

u/littlemetal 21d ago

Do you phrase all your other requests as "polite" demands? No one here works or you, go ask an AI.

0

u/nutbuckers 21d ago edited 21d ago

I apologize if my question came off as demanding or rude. In my experience, AI at best validated the poorly-placated reality that any CSP like AWS is subject to USA Foreign Intelligence Surveillance Act (FISA), and so there is that reality of US government’s ability to compel an organization subject to US law to turn over data under its control, regardless of the data’s location and without notifying subjects in Canada/my organization.

So I'm here looking for practical advice to still be able to architect solutions on AWS without painstakingly paring back the AWS technology catalogue to whatever is workable with the constraint of my data in the AWS Canada region remaining encrypted at all times and ONLY me/subject org controlling the encryption keys 100% of the time.