Amazon Web Services launched a new independent cloud service aiming to address European customer concerns around digital sovereignty last week. But while analysts believe it will help European customers meet regulatory compliance demands, there are questions around how much sovereignty it provides in practice.

The AWS European Sovereign Cloud data center is located in Brandenburg, Germany, with plans for additional facilities in Belgium, the Netherlands, and Portugal. The AWS European Sovereign Cloud provides access to 90 AWS services but is “physically and logically separate” from AWS’s existing public cloud Regions, the company said.

AWS established a new legal entity to operate the European Sovereign Cloud under a separate governance and operational model. The new company is incorporated in Germany and run exclusively by EU residents, AWS said. It operates under a governance structure led by EU citizens that are obligated to comply with European laws and, said AWS, the service has “no critical dependencies” on non-EU infrastructure and is designed to “continue operations indefinitely, even in the event of a communications disruption with the rest of the world.”

Still US-owned

However, the German subsidiary is still owned by AWS, a US company, which exposes it to certain risks.

“This is the elephant in the room,” said Rene Buest, senior director analyst at Gartner.

There are two main concerns regarding the operation of AWS’s European Sovereign Cloud for businesses in Europe. The first relates to the 2018 US Cloud Act, which could require AWS to disclose customer data stored in Europe to the United States, if requested by US authorities. The second involves the possibility of US government sanctions: If a business that uses AWS services is subject to such sanctions, AWS may be compelled to block that company’s access to its cloud services, even if its data and operations are based in Europe.

There are examples of similar scenarios in recent years. The International Criminal Court’s chief prosecutor was reportedly shut out of Microsoft applications following the imposition of US sanctions, for example. Other instances include Adobe cutting off Venezuelan customers in compliance with US sanctions against that country in 2019, while Microsoft temporarily blocked access to apps such as Teams and Outlook for Indian energy firm Nayara last year.

The creation of a separate legal entity is an attempt to mitigate such risks, but it’s unclear what protection it would provide in practice should the parent request the German subsidiary to take certain actions.

It’s an open question at this stage, said Dario Maisto, senior analyst at Forrester. “Cases will have to be tested in court before we can have a definite answer,” he said. “The legal ownership does matter, and this is one of the points that may not be addressed by the current setup of the AWS sovereign cloud.”

AWS’s European Sovereign Cloud represents one of several ways that European business can approach the challenge of digital sovereignty. Gartner identifies a spectrum that ranges from global hyperscaler public cloud services through to regional cloud services that are based on non-hyperscaler technology. Each has its own advantages and trade-offs.

Local partnerships

To address growing European customer concerns around digital sovereignty, some hyperscalers have partnered with European cloud providers — Google and Thales, for instance, or Microsoft and Bleu, a joint venture between Orange and Capgemini. This involves the hyperscaler providing access to its technology, while the two companies remain independent. Buest said the arrangement provides a higher level of “operational sovereignty” compared to AWS European Sovereign Cloud, though it still involves some level of technological dependence on the hyperscaler.

In the end, most customers will opt for strategies that comprise a mix of sovereignty levels depending on their needs.

While there are questions around the implications of the ownership structure, AWS’s European Sovereign Cloud still provides a greater level of sovereignty compared to its standard public cloud service in terms of enabling regulatory compliance, according to analysts. This could appeal to European organizations, they said, depending on their sovereignty requirements.

AWS cited several early customers, including German energy supplier EWE AG, and Medizinische Universität Lausitz — Carl Thiem (MUL-CT), a medical hospital.

Analysts noted growing demand from European organizations for services that address digital sovereignty. “There has been a pivotal shift in the last few months; we have seen a fundamental switch from just interest in sovereign solutions to actual buying behaviors,” said Maisto. “The demand is there. Organizations are investing money into sovereign migration projects, and we have not seen this before,” he said.

“The AWS European Sovereign Cloud is a step in the right direction. It signals that they acknowledge the problem.”