AWS forms EU-based cloud unit as customers fret
theregister.com
theregister.com
To answer some questions here in one go - for the European Sovereign Cloud, EU laws always apply. The only people with operational control or access (physical, or logical) are EU people in the EU, and decisions about how lawful orders are handled are also made by EU people in the EU. This is one of the biggest pieces of what it means to be a "Sovereign Cloud" and comes directly from the requirements of our customers. Another is that there are no technical dependencies on non-EU infrastructure.
Of course another answer is that for data access it's also great to build systems like KMS, Nitro, Wickr, CMK encryption, etc ... where we as an operator simply have no access to customer data in the first place. And those protections stand too.
> Regardless of Amazon's data sovereignty pledge, the parent company remains under American ownership, and may still be subject to the Cloud Act, which requires US companies to turn over data to law enforcement authorities with the proper warrants, no matter where that data is stored.
How does that work with "decisions about how lawful orders are handled are also made by EU people in the EU"? Will the EU cloud division go rogue once the US attempts to use the CLOUD Act or something?
Nothing changed.
"The General Court orders the Commission to pay damages to a visitor to its ‘Conference on the Future of Europe’ website as a result of the transfer of personal data to the United States" - https://curia.europa.eu/jcms/upload/docs/application/pdf/202...
From further research, it looks like the Amazon data transfer issue was litigated and resolved at the EU level, with the court finding Amazon's practices were lawful under the contracts in place.
If company is owned by US entity (AWS/Amazon), can it also block customers by the US government request, similar to how MSFT blocked ICC access to its email service?
Disclaimer: Not a lawyer or PR person.
Encryption does not protect data at runtime. Otherwise AWS is just glorified backup storage of e2ee data.
"The FISA Court’s only jurisdiction is “to hear applications for and grant orders approving electronic surveillance anywhere within the United States.” 50 U.S.C. § 1803 (a) (1)."
"AWS re:Invent 2023 - AWS European Sovereign Cloud: A closer look (SEC216)" - https://youtu.be/qNHWeDf-fTQ
In certain EU countries, data center sovereignty criteria require the management and beneficiaries to also NOT be citizens of another state.
That would be enough reason for non-EU customers to set up there!
just like airlines: the licensing regime for very large cloud providers should require majority control by european shareholders
hopefully those writing the "sovereign service audit checklists" are competent enough to see through this subterfuge
MS tried same with their Azure.
This BS on another level.
Use OVH, Hertzner, Scaleway, etc.
Need managed services beyond scope of the above? There will be plenty of business (smaller and larger) offer you managed solution on top of other cloud providers.
This whole setup collapses when Bezos calls someone and says "you're fired if you don't do as I say", which he might if Trump leans heavily on him or threatens to take control.
The above quote implies that the threat from Bezos should have no effect. Then again, I have no experience in corporate politics. Are you saying that even with that quote the "AWS European Sovereign Cloud" setup is pointless in practice?
An advisory board is very different from a governing board.
At worst it sounds like a canary.
What about them? It can be as independent and legally obligated to focus on whatever set of interests you want, if its only an advisory board, then it has no real power. (And, unless there is some guarantee of information other than what the management of the main org feels like giving it to support its advisory function, it can't even serve as a reliable canary.)
Depends if PR is pointless.
A particular question I'll ask is if they see tariffs potentially increasing the price of their services both in USA and worldwide. After all, if tariffs make goods more expensive in USA, that could propagate to the services they export.
At AWS it runs really deep that we don't increase prices. We're like Costco with the hot dog. I've been amazed at the lengths we've gone to over the last few years. As all of our fundamental costs like energy, land, salaries, have experienced inflation globally, we've prioritized cost-savings and efficiency programs that meant we haven't had to pass that on as price increases. We did introduce a new fixed-price for IPv4 addresses, but it's not a significant charge for most customers and is just driven by the finite and now dwindling availability of IPv4 addresses.
"France singles out digital services for EU’s tariff response" - https://www.euractiv.com/section/tech/news/france-singles-ou...
Lots of comments talking about “but US subsidiary, still has to follow US laws if mandated”
If I added the amount of sources where the EU imposes something on a non-EU company here it would crash the server.
You want to handle our data?
Obey our rules.
I wish EU/US et al wouldn’t do this but they do. Let’s further the comments outside this point.
Always has been, always will be.