ReleaseBytes
aws AWS Security Blog ·

Architecting a Secure Landing Zone in the AWS European Sovereign Cloud

blogsecurityawsarchitect
announcement

This article details how to architect a secure, scalable landing zone within the AWS European Sovereign Cloud (EUSC), an independent cloud partition for Europe. It covers critical architectural layers including account structure, governance, identity management as infrastructure as code, centralized logging, data protection, network design, CI/CD, and incident response. The guidance helps organizations understand the EUSC's distinct partition boundaries and align their deployments with the AWS Security Reference Architecture and Well-Architected Framework. It is relevant for those evaluating or implementing solutions requiring European data sovereignty.

  • →Understanding the AWS European Sovereign Cloud Partition
  • →Cross-Partition Infrastructure as Code (IaC)
  • →Account Structure and Governance
  • →Identity Management with IAM Identity Center as IaC
Notes (4) ›
  • Understanding the AWS European Sovereign Cloud Partition

    The AWS European Sovereign Cloud operates as a distinct partition (aws-eusc), physically and logically separate from existing AWS Regions, with its own control plane, IAM, billing, and service endpoints. This independence means cross-partition features like S3 Cross-Region Replication or IAM credentials do not work across the EUSC and commercial AWS boundaries.

  • Cross-Partition Infrastructure as Code (IaC)

    The post provides examples of partition-aware Terraform and AWS CloudFormation IaC snippets, demonstrating how to construct Amazon Resource Names (ARNs) dynamically. This pattern allows the same infrastructure code to work across different AWS partitions, including the standard `aws` partition and the `aws-eusc` partition.

  • Account Structure and Governance

    AWS Control Tower is recommended for setting up and governing a multi-account environment in the EUSC, following the AWS Security Reference Architecture (SRA) model. This involves using a management account for governance, deploying universal security guardrails via Service Control Policies (SCPs), and managing services like CloudTrail across member accounts.

  • Identity Management with IAM Identity Center as IaC

    AWS IAM Identity Center is available independently within the AWS European Sovereign Cloud partition and can connect to external identity providers using SAML/SCIM. The article shows how to manage permission sets, groups, and account assignments as code, ensuring automated access updates based on IdP group membership without direct management account access.

Read the original announcement →

https://aws.amazon.com/blogs/security/architecting-a-secure-landing-zone-in-the-aws-european-sovereign-cloud/

Related releases