Data Residency & Sovereignty

# SCP: Restrict EC2 and RDS to EU regions only
aws organizations create-policy \
  --name "EUDataResidency" \
  --type SERVICE_CONTROL_POLICY \
  --content '{
    "Version": "2012-10-17",
    "Statement": [{
      "Sid": "RestrictToEURegions",
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances",
        "rds:CreateDBInstance",
        "s3:CreateBucket",
        "lambda:CreateFunction"
      ],
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "aws:RequestedRegion": [
            "eu-west-1",
            "eu-west-2",
            "eu-west-3",
            "eu-central-1",
            "eu-central-2",
            "eu-north-1",
            "eu-south-1",
            "eu-south-2"
          ]
        }
      }
    }]
  }'

# S3 Object Lock for compliance retention
aws s3api put-object-lock-configuration \
  --bucket my-gdpr-bucket \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {
      "DefaultRetention": {
        "Mode": "COMPLIANCE",
        "Years": 7
      }
    }
  }'

# Restrict S3 replication to same region only
# (Prevent cross-region replication to non-EU regions)

# Azure Policy: Restrict resource locations to EU only
az policy assignment create \
  --name "restrict-to-eu" \
  --display-name "Restrict Resources to EU Regions" \
  --scope "/providers/Microsoft.Management/managementGroups/EU-Workloads" \
  --policy "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c" \
  --params '{
    "listOfAllowedLocations": {
      "value": [
        "westeurope",
        "northeurope",
        "germanywestcentral",
        "francecentral",
        "swedencentral",
        "switzerlandnorth",
        "norwayeast"
      ]
    }
  }'

# Azure Policy: Deny storage replication to non-EU
az policy definition create \
  --name "deny-non-eu-replication" \
  --display-name "Deny Storage Replication Outside EU" \
  --mode Indexed \
  --rules '{
    "if": {
      "allOf": [
        {"field": "type", "equals": "Microsoft.Storage/storageAccounts"},
        {"field": "Microsoft.Storage/storageAccounts/sku.name", "in": ["Standard_GRS", "Standard_RAGRS"]}
      ]
    },
    "then": {"effect": "deny"}
  }'

# Organization Policy: Restrict resource locations
gcloud org-policies set-policy --organization=ORG_ID - << 'EOF'
constraint: constraints/gcp.resourceLocations
listPolicy:
  allowedValues:
    - in:eu-locations
EOF

# This restricts ALL resources in the organization to EU regions only

# Assured Workloads: Create a sovereign workload environment
gcloud assured workloads create \
  --organization=ORG_ID \
  --location=europe \
  --display-name="EU Sovereign Workload" \
  --compliance-regime=EU_REGIONS_AND_SUPPORT \
  --billing-account=BILLING_ACCOUNT_ID

# Assured Workloads enforces:
# - Resources only in EU regions
# - Support only from EU-based personnel
# - Customer-managed encryption keys stored in EU
# - Data Access Transparency logging

# VPC Service Controls (restrict API access to prevent data exfiltration)
gcloud access-context-manager perimeters create eu-data-perimeter \
  --title="EU Data Perimeter" \
  --resources="projects/eu-project-1,projects/eu-project-2" \
  --restricted-services="storage.googleapis.com,bigquery.googleapis.com" \
  --access-levels="accessPolicies/POLICY_ID/accessLevels/eu-only"

# The perimeter prevents data from being accessed outside the boundary
# even by authorized users, unless explicitly allowed

# OCI: Subscribe to specific regions only
oci iam region-subscription create \
  --region-key FRA \
  --tenancy-id TENANCY_OCID

# OCI Dedicated Region: Full cloud in your data center
# Oracle deploys a complete OCI region on-premises
# Fully air-gapped from public cloud if needed
# Same APIs, services, and pricing as public OCI

# OCI EU Sovereign Cloud
# Separate from public OCI, operated by EU entity
# Data never leaves EU, operated by EU-resident staff
# Same services as public OCI
# Available in Frankfurt and Madrid

# Create a policy restricting data to specific compartments
oci iam policy create \
  --compartment-id TENANCY_OCID \
  --name "eu-data-policy" \
  --statements '[
    "Allow group EU-DataTeam to manage object-family in compartment EU-Data where request.region = eu-frankfurt-1",
    "Deny group EU-DataTeam to manage object-family in compartment EU-Data where request.region != eu-frankfurt-1"
  ]'

# AWS: Create a regional KMS key
aws kms create-key \
  --description "EU data encryption key" \
  --region eu-central-1 \
  --key-usage ENCRYPT_DECRYPT \
  --origin AWS_KMS

# GCP: Create a regional key ring with Cloud HSM
gcloud kms keyrings create eu-keys \
  --location=europe-west1

gcloud kms keys create data-key \
  --keyring=eu-keys \
  --location=europe-west1 \
  --purpose=encryption \
  --protection-level=hsm

# GCP: Enable Key Access Justifications
# (Requires Assured Workloads + KAJ enabled)
# Provides audit trail of every Google access to your keys
# You can configure auto-deny for specific justification codes

# Azure: Create a Key Vault in EU region
az keyvault create \
  --name my-eu-vault \
  --resource-group eu-rg \
  --location germanywestcentral \
  --sku premium  # HSM-backed

# OCI: Create a Vault in EU region
oci kms management vault create \
  --compartment-id COMPARTMENT_OCID \
  --display-name "eu-vault" \
  --vault-type DEFAULT

# Verify no resources exist outside allowed regions

# AWS: Check for resources in non-EU regions
for region in $(aws ec2 describe-regions --query 'Regions[].RegionName' --output text); do
  if [[ ! "${region}" =~ ^eu- ]]; then
    count=$(aws ec2 describe-instances --region "${region}" \
      --query 'length(Reservations[].Instances[])' --output text 2>/dev/null)
    if [ "${count}" -gt 0 ]; then
      echo "WARNING: ${count} instances found in ${region}"
    fi
  fi
done

# GCP: Check for resources outside EU
gcloud asset search-all-resources \
  --scope=organizations/ORG_ID \
  --query="NOT location:europe*" \
  --format="table(name,assetType,location)"

# Azure: Find resources outside EU
az resource list \
  --query "[?!starts_with(location, 'europe') && !starts_with(location, 'germany') && !starts_with(location, 'france') && !starts_with(location, 'sweden') && !starts_with(location, 'switzerland') && !starts_with(location, 'norway')].{Name:name,Type:type,Location:location}" \
  --output table