AWS Europe: Sovereign Cloud Guide for Regulated IT Leaders

Q: Is there a separate Amazon cloud for Europe?

Yes. The AWS European Sovereign Cloud (aws-eusc partition) is a fully independent cloud infrastructure located wholly within the EU, with its own IAM, billing, and operational systems separate from global AWS.

Table of Contents

TL;DR:

The AWS European Sovereign Cloud provides an EU-operated, independent environment for highly sensitive workloads requiring legal and operational autonomy. Standard AWS Regions offer lower-sensitivity services with existing certifications, while the Sovereign Cloud ensures data and metadata residency within the EU and EU-only operator control. Adoption involves a longer procurement cycle, but existing APIs and services remain compatible, easing migration and compliance efforts.

“AWS Europe” now covers two distinct deployment models: the eight standard AWS Regions in Europe and the newly launched AWS European Sovereign Cloud, a sovereign-by-design, EU-operated cloud partition built specifically for public sector and regulated-industry workloads.

The operational differences matter more than the geography:

Data residency: Both models keep customer data in Europe, but the Sovereign Cloud also keeps metadata (IAM roles, permissions, resource labels, configurations) within the EU.
Operator residency: Standard Regions are operated by global AWS staff. The Sovereign Cloud is operated exclusively by EU-resident personnel, with a gradual transition to EU citizens only.
Governance and partitioning: The Sovereign Cloud runs as a separate AWS partition (aws-eusc), with independent IAM, billing, and metering systems that cannot be accessed from outside EU borders.

Recommendation: Use the AWS European Sovereign Cloud for your highest-sensitivity public sector and regulated workloads where operational autonomy and metadata residency are contractual or legal requirements. Use standard European Regions for commercial, lower-sensitivity, or latency-sensitive workloads where existing compliance certifications already satisfy your obligations.

Pro Tip: Run a short pilot in a standard European Region first. The Sovereign Cloud uses the same APIs and Terraform providers, so you can migrate workloads later without rewriting infrastructure-as-code.

What does AWS Europe’s infrastructure look like today?
What is the AWS European Sovereign Cloud?
How does the Sovereign Cloud differ from standard AWS Regions?
Where is AWS infrastructure located in Europe?
What compliance certifications does the Sovereign Cloud carry?
Which AWS services are available in the Sovereign Cloud?
When should you choose the Sovereign Cloud vs. standard Regions?
How does procurement and adoption typically work?
How IT-Magic helps organizations adopt AWS Europe and the Sovereign Cloud
Essential AWS resources and whitepapers to read next
Key Takeaways
What most teams get wrong about cloud sovereignty
IT-Magic’s sovereign-readiness services for AWS Europe
FAQ
Primary sources and further reading

What does AWS Europe’s infrastructure look like today?

Running this on your own AWS setup? IT-Magic is an AWS Advanced Tier Partner — we audit, fix, or fully manage it for you.

Get a free consultation

AWS operates eight standard Regions across Europe alongside the separate Sovereign Cloud partition. The table below maps each model to its geographic scope, operational control, and typical use cases.

Model	Geographic scope	Operational control	Typical use cases
Standard AWS Regions	Frankfurt, Ireland, London, Paris, Stockholm, Zurich, Milan, Spain	Global AWS staff	Commercial apps, SaaS, lower-sensitivity regulated workloads
AWS European Sovereign Cloud	Brandenburg, Germany (initial Region); Local Zones planned in Belgium, Netherlands, Portugal	EU-resident AWS personnel only	Public sector, defense-adjacent, highly regulated industries
Dedicated Local Zones	Customer-specified EU locations	AWS-managed, exclusive to one customer or community	Classified workloads, strict in-country residency
AWS Outposts / AI Factories	On-premises or customer data center	AWS-managed hardware on customer premises	Air-gapped requirements, sovereign AI inference

Three practical points on how the models relate to each other:

Latency and proximity: Standard Regions cover eight countries with multiple Availability Zones each, giving most EU organizations sub-10ms latency to at least one Region. The Sovereign Cloud’s initial footprint is smaller, so latency planning matters more during early adoption.
Compliance baseline: Standard Regions carry ISO/IEC 27001, SOC 1/2/3, BSI C5, and other certifications that satisfy many regulated workloads without sovereign-by-design controls.
Procurement path: Standard Regions are available immediately through existing AWS accounts. The Sovereign Cloud uses a separate partition and billing entity, which requires a distinct contracting step.

What is the AWS European Sovereign Cloud?

The AWS European Sovereign Cloud is an independent cloud partition located wholly within the EU, built and operated through EU-incorporated legal entities. It is not a feature added to an existing Region. It is a separate infrastructure environment with its own governance stack, designed from the ground up for organizations that need operational autonomy on top of data residency.

The governance model has several concrete layers. Parent and subsidiary entities are incorporated in Germany. Day-to-day operations, data center access, technical support, and customer service are handled only by EU-resident AWS employees, with a stated transition path toward EU citizens exclusively. The partition runs its own IAM, billing, and usage metering systems, independent from global AWS infrastructure. Even if connectivity between the Sovereign Cloud and the rest of AWS were interrupted, the partition is designed to continue operations indefinitely with no critical dependencies on non-EU infrastructure.

The Region naming convention reflects this separation: the first Region is eusc-de-east-1, located in the State of Brandenburg, Germany. AWS has committed substantial capital investment to this build-out, a signal of long-term commitment rather than a pilot program.

Public sector and regulated-industry organizations typically consider the Sovereign Cloud for these reasons:

Legal or contractual requirements that restrict operational access to EU residents or citizens
National sovereignty policies that go beyond GDPR data residency to include metadata and operational control
Procurement frameworks (e.g., national security classifications) that require auditable, EU-only operator access
Regulated industries (finance, health, energy) where supervisory authorities expect demonstrable operational autonomy

How does the Sovereign Cloud differ from standard AWS Regions?

The distinction is governance and operator residency, not just physical location. Both models keep customer data in Europe. The Sovereign Cloud adds a layer that standard Regions do not provide: legally binding operational autonomy enforced through separate infrastructure, separate legal entities, and EU-resident-only personnel controls.

Control and governance model:

Standard Regions: operated by global AWS staff under AWS’s standard terms; no restriction on operator nationality or location.
Sovereign Cloud: operated exclusively by EU-resident personnel; parent and subsidiary entities incorporated in Germany; separate partition (aws-eusc) with no operational dependencies outside the EU.

Data and metadata residency:

Standard Regions: customer data stays in the chosen Region; metadata (IAM roles, permissions, resource labels) may traverse global AWS systems.
Sovereign Cloud: both customer data and all metadata remain within the EU, enforced at the infrastructure level through dedicated IAM and billing systems.

Service and API compatibility:

The Sovereign Cloud uses the same APIs, SDKs, and Terraform providers as standard Regions. Engineering teams can reuse existing infrastructure-as-code with minimal changes. The service portfolio at launch covers the core categories (compute, containers, databases, AI, storage, networking, security), and AWS expands it based on customer demand.

Pro Tip: During vendor due diligence, request the published Sovereign Cloud capability matrix and ask for the third-party audit reports (ISO/IEC 27001 certificate, SOC reports, BSI C5 attestation) specific to the Sovereign Cloud partition, not the global AWS certificates.

Where is AWS infrastructure located in Europe?

Standard AWS Regions

AWS operates eight standard Regions in Europe: Frankfurt (Germany), Ireland, London (UK), Paris (France), Stockholm (Sweden), Zurich (Switzerland), Milan (Italy), and Spain. Each Region contains multiple Availability Zones, each built with independent power, networking, and physical security.

AWS European Sovereign Cloud footprint

Location	Type	Status
Brandenburg, Germany	Sovereign Cloud Region (`eusc-de-east-1`)	Generally available
Belgium	Sovereign Local Zone	Announced
Netherlands	Sovereign Local Zone	Announced
Portugal	Sovereign Local Zone	Announced

Beyond the Sovereign Cloud, AWS offers Dedicated Local Zones for exclusive single-customer or community deployments at customer-specified sites, Outposts for on-premises AWS hardware, and AI Factories for sovereign AI inference at scale.

Key implications for planning:

In-country residency: If national law requires data to remain within a specific EU member state, Sovereign Local Zones or Dedicated Local Zones in that country are the relevant options once available.
Latency: The Brandenburg Region serves Central European workloads well. Organizations in Iberia or Benelux will benefit from the announced Local Zones.
Extension strategy: Start in the Brandenburg Region, then extend to Local Zones as they launch to meet in-country requirements without rebuilding architecture.

What compliance certifications does the Sovereign Cloud carry?

The Sovereign Cloud is built to support the compliance obligations that European public sector and regulated-industry organizations face most often. AWS references the following attestations for the Sovereign Cloud:

ISO/IEC 27001 certification
SOC 1, SOC 2, and SOC 3 reports
BSI C5 attestation (the German Federal Office for Information Security’s cloud security catalog)
CISPE Code of Conduct compliance (over 100 AWS services certified)

The Sovereign Cloud’s data residency and metadata residency controls directly support GDPR obligations around data location and processor accountability. The operational control model, where only EU-resident personnel access systems, addresses the supervisory authority expectations that have emerged from post-Schrems II enforcement discussions across EU member states.

For organizations with national sovereignty requirements beyond GDPR, the combination of EU-incorporated legal entities, EU-resident operators, and a separate partition with no non-EU dependencies provides a stronger contractual and technical basis than standard Regions alone.

What to request from AWS during procurement: independent third-party audit reports scoped specifically to the aws-eusc partition, the capability matrix confirming which services are covered by each attestation, and contract clauses that explicitly bind the EU-resident operator requirement.

For a detailed view of how these certifications map to enterprise security frameworks, the IT-Magic AWS compliance checklist covers SOC 2, ISO, and HIPAA controls in a step-by-step format.

This article is general information, not legal advice. Validate your specific compliance obligations with qualified legal counsel and the relevant supervisory authority.

Which AWS services are available in the Sovereign Cloud?

The Sovereign Cloud launches with a broad initial service portfolio covering the categories engineering teams need for critical workloads. Key services announced for the Sovereign Cloud include:

AI and machine learning: Amazon SageMaker, Amazon Bedrock, Amazon Q
Compute: Amazon EC2, AWS Lambda
Containers: Amazon EKS, Amazon ECS
Databases: Amazon Aurora, Amazon DynamoDB, Amazon RDS
Networking: Amazon VPC
Security: AWS KMS, AWS Private Certificate Authority
Storage: Amazon S3, Amazon EBS

The AWS Nitro System underpins all EC2 instances in the Sovereign Cloud, providing the same hardware-enforced security boundary that prevents even AWS employees from accessing customer workloads. The Nitro System’s security design has been independently validated by NCC Group.

Architectural compatibility means your existing Terraform modules, CDK stacks, and CI/CD pipelines work in the Sovereign Cloud with account and partition configuration changes rather than rewrites. For teams already using Amazon Bedrock for generative AI, the service is available in the Sovereign Cloud, so regulated organizations do not have to choose between AI capabilities and sovereignty controls.

Pro Tip: Before committing to the Sovereign Cloud, run a dependency audit against the published capability matrix. Some specialized managed services and edge integrations are phased in after Region launch, and discovering a missing dependency mid-migration is expensive.

When should you choose the Sovereign Cloud vs. standard Regions?

The right model depends on your workload’s sensitivity, your regulatory obligations, and your operational constraints. Use this checklist to map requirements to the appropriate model.

Choose the Sovereign Cloud when:

Legal or contractual terms require EU-resident-only operator access
Supervisory authority guidance or national security policy mandates metadata residency within the EU
Your procurement framework requires auditable, EU-incorporated legal entities as the cloud provider
Workloads involve classified or highly sensitive personal data where operational autonomy is non-negotiable

Standard Regions are sufficient when:

Existing ISO, SOC, and BSI C5 certifications satisfy your compliance framework
No contractual restriction limits operator nationality or location
Time-to-market or feature parity with the full AWS service catalog is a priority
Cost optimization is a primary driver and the additional controls of the Sovereign Cloud are not required

Workload type	Recommended model	Rationale
Critical regulated services (public sector, defense-adjacent, national health)	Sovereign Cloud	Requires EU-resident operators, metadata residency, separate legal entities
Financial services with DORA/NIS2 obligations	Sovereign Cloud or standard Region	Depends on supervisory authority guidance; standard Region may suffice with contractual controls
Commercial customer-facing applications	Standard Region	Full service catalog, lower cost, faster deployment
AI/ML development and experimentation	Standard Region (initially)	Broader service availability; migrate to Sovereign Cloud when production-ready
In-country residency requirements	Sovereign Local Zone or Dedicated Local Zone	Specific member-state residency needs

A tiered workload strategy reduces both cost and risk: reserve the Sovereign Cloud for your most sensitive workloads and use standard Regions for everything else. This approach balances compliance, feature parity, and procurement timelines.

How does procurement and adoption typically work?

Adopting the Sovereign Cloud follows a longer procurement cycle than spinning up a standard Region account, primarily because of the separate partition, distinct legal entities, and contracting requirements. A realistic timeline for a public sector organization looks like this:

Initial pilot (weeks 1–8): Deploy non-sensitive workloads in a standard European Region using the same APIs and IaC you plan to use in the Sovereign Cloud. Validate architecture patterns and team readiness.
Capability audit (weeks 4–10): Run a dependency audit against the Sovereign Cloud capability matrix. Map every service your workloads consume to its Sovereign Cloud availability status.
Procurement and contracting (weeks 8–20): Engage AWS through EMEA entities. Negotiate contract clauses covering EU-resident operator requirements, metadata residency assurances, and audit rights. Multi-currency billing and sovereign assurance commitments need explicit terms.
Integration and testing (weeks 16–28): Configure the aws-eusc partition, migrate IAM and billing automation, and run security and compliance tests against the new environment.
Staged migration (weeks 24–40+): Move workloads in priority order, starting with the least operationally complex. Validate compliance attestations at each stage.
Operational handover: Confirm on-call rotations, escalation paths, and support SLAs reflect EU-resident support staff. Standard global escalation paths do not apply in the Sovereign Cloud.

Artifacts to prepare before procurement kicks off:

Capability matrix cross-reference (your services vs. Sovereign Cloud availability)
Data flow maps identifying all metadata and customer data flows
Security and compliance test plans scoped to aws-eusc
Land-and-expand migration plan with rollback procedures

AWS has committed significant capital investment to the Sovereign Cloud build-out in Germany, which signals a long-term infrastructure commitment rather than a temporary offering. That matters for procurement teams writing 5–10 year contracts.

Pro Tip: Contract through local EMEA AWS entities and explicitly negotiate the EU-resident operator requirement as a binding service commitment, not just a policy statement. Request the specific contract clauses AWS uses to enforce this, and have legal counsel review them against your national sovereignty framework.

How IT-Magic helps organizations adopt AWS Europe and the Sovereign Cloud

IT-Magic is an AWS Advanced Tier Services Partner with over 700 projects delivered since 2010, covering cloud architecture, DevOps, Kubernetes implementation, and compliance engineering. For organizations moving to the Sovereign Cloud or optimizing their existing European AWS footprint, IT-Magic provides:

Sovereign-readiness assessments: Audit your current workloads against the Sovereign Cloud capability matrix and identify gaps before procurement begins.
Migration planning and execution: Design and execute staged migrations to aws-eusc, including IAM and billing partition reconfiguration.
EKS and container implementation: Deploy and operate Amazon EKS clusters within the Sovereign Cloud, with the same Kubernetes expertise applied to standard Regions.
Compliance engineering: Map AWS certifications (ISO/IEC 27001, SOC 2, BSI C5) to your regulatory framework and prepare audit evidence packages.
Cost optimization: Identify the right workload placement across Sovereign Cloud and standard Regions to avoid paying for sovereign controls where they are not required. See IT-Magic’s AWS cost optimization services for details.
24/7 managed support: Ongoing infrastructure monitoring and incident response for sovereign-ready AWS environments.

Pro Tip: Engage a certified AWS partner early in the procurement cycle, not after contracts are signed. Partner involvement during capability audits and contract negotiation often surfaces requirements that would otherwise cause delays during migration.

Essential AWS resources and whitepapers to read next

Every technical, legal, and procurement team involved in a Sovereign Cloud evaluation should review these primary sources:

AWS European Sovereign Cloud main site (aws.eu): The primary product page. Technical teams and procurement leads should start here for governance documentation and service overviews.
Opening the AWS European Sovereign Cloud (AWS News Blog): The general availability announcement with technical controls, initial service roadmap, and partition details. Required reading for architects and security leads.
AWS European Sovereign Cloud User Guide: The authoritative technical reference for partition naming, service differences, and operational procedures. Engineering teams should bookmark this before any migration work.
European Digital Sovereignty FAQ: Covers the most common procurement and legal questions. Legal counsel and compliance officers should review this alongside their own regulatory obligations.
AWS Global Infrastructure Regions page: Current list of standard Regions and Availability Zones. Use this for latency planning and standard Region compliance baseline research.

“The AWS European Sovereign Cloud is the only fully-featured, independently operated sovereign cloud, backed by strong technical controls, sovereign assurances and legal protections designed to meet the needs of European governments and enterprises.” — AWS European Digital Sovereignty FAQ

Key Takeaways

The AWS European Sovereign Cloud is the right choice for public sector and regulated workloads that require EU-resident-only operators, metadata residency within the EU, and legally binding operational autonomy through EU-incorporated entities.

Point	Details
Two distinct models	Standard AWS Regions and the Sovereign Cloud serve different compliance tiers; choose based on workload sensitivity and regulatory obligations.
Metadata residency matters	The Sovereign Cloud keeps both customer data and metadata (IAM roles, permissions, labels) within the EU, which standard Regions do not guarantee.
Same APIs, separate partition	The Sovereign Cloud uses the same APIs and Terraform providers as standard Regions, reducing migration effort; the `aws-eusc` partition requires separate account and billing setup.
Procurement takes longer	Expect a 20–40 week adoption timeline for public sector organizations; start capability audits and contract negotiations early.
IT-Magic accelerates adoption	As an AWS Advanced Tier Services Partner, IT-Magic provides sovereign-readiness assessments, migration execution, EKS implementation, and compliance engineering for Sovereign Cloud deployments.

What most teams get wrong about cloud sovereignty

The most common mistake in Sovereign Cloud evaluations is treating data residency as the finish line. It is not. Data residency, meaning where bytes physically sit, has been achievable in standard AWS Regions for years. What the Sovereign Cloud actually adds is operational autonomy: the guarantee that a non-EU employee cannot access your data center, your support ticket, or your IAM configuration, even in response to a foreign government request or a global incident.

That distinction matters enormously in practice, not in theory. Post-Schrems II, several EU supervisory authorities have signaled that contractual data transfer mechanisms are not sufficient when the cloud provider’s parent company is subject to non-EU law. The Sovereign Cloud’s EU-incorporated legal entities and EU-resident-only operators are a direct architectural response to that concern.

The second mistake is assuming the Sovereign Cloud means sacrificing modern capabilities. Amazon SageMaker, Amazon Bedrock, and Amazon EKS are all available in the initial service portfolio. Regulated organizations no longer have to run legacy infrastructure to stay compliant. The tiered workload strategy, Sovereign Cloud for the most sensitive services, standard Regions for everything else, is how mature organizations get both compliance and velocity.

One practical caution: the procurement cycle is genuinely longer. Teams that underestimate contracting complexity, especially around binding EU-resident operator clauses, end up delaying migrations by months. Start the legal and procurement work in parallel with the technical pilot, not after it.

IT-Magic’s sovereign-readiness services for AWS Europe

For regulated organizations that need to move fast without cutting corners on compliance, IT-Magic offers a direct path from evaluation to production on the AWS European Sovereign Cloud.

IT-Magic’s sovereign-readiness assessment maps your current workloads against the Sovereign Cloud capability matrix, identifies compliance gaps, and produces a migration plan with clear timelines and cost projections. From there, IT-Magic handles EKS and container deployment, IAM partition configuration, compliance engineering for ISO/IEC 27001 and BSI C5, and ongoing cost optimization across your Sovereign Cloud and standard Region footprint. With 700+ AWS projects delivered and certified expertise in DevOps, security, and networking, IT-Magic operates as your dedicated cloud infrastructure partner throughout the entire lifecycle.

To get a scoping call or request a sovereign-readiness assessment, visit IT-Magic’s AWS cost optimization services page or contact the team directly at itmagic.pro.

FAQ

Where is the AWS European Sovereign Cloud located?

The first Sovereign Cloud Region is in the State of Brandenburg, Germany (eusc-de-east-1). AWS has announced plans to add sovereign Local Zones in Belgium, the Netherlands, and Portugal.

Does Europe use standard AWS Regions?

Yes. AWS operates eight standard Regions across Europe: Frankfurt, Ireland, London, Paris, Stockholm, Zurich, Milan, and Spain, each with multiple Availability Zones for high availability and compliance support.

What is the EU version of AWS?

The AWS European Sovereign Cloud is the EU-specific, sovereign-by-design cloud partition. It is separate from standard AWS Regions, operated exclusively by EU-resident personnel, and governed through EU-incorporated legal entities.

Is there a separate Amazon cloud for Europe?

Yes. The AWS European Sovereign Cloud (aws-eusc partition) is a fully independent cloud infrastructure located wholly within the EU, with its own IAM, billing, and operational systems separate from global AWS.

How does the Sovereign Cloud differ from standard AWS Regions for compliance?

The Sovereign Cloud adds metadata residency within the EU, EU-resident-only operator access, and EU-incorporated legal entities on top of the standard compliance certifications (ISO/IEC 27001, SOC reports, BSI C5) that both models carry.

Primary sources and further reading

AWS European Sovereign Cloud official site — primary product and governance documentation
Opening the AWS European Sovereign Cloud, AWS News Blog — general availability announcement and technical controls
AWS European Sovereign Cloud User Guide — authoritative technical reference for partition and service details
European Digital Sovereignty FAQ, Amazon Web Services — procurement and legal questions answered by AWS
European Digital Sovereignty, Amazon Web Services — overview of all sovereignty options including Dedicated Local Zones and Outposts
AWS Regions and Availability Zones, AWS Documentation — current standard Region list and Availability Zone details
IT-Magic AWS compliance checklist — step-by-step enterprise compliance guide covering SOC 2, ISO, and HIPAA
IT-Magic AWS Advanced Tier Services Partner — IT-Magic partner credentials and service overview

“Everything needed to operate the AWS European Sovereign Cloud is in the EU: the talent, the technology, the infrastructure, and the leadership.” — AWS European Sovereign Cloud User Guide

AWS Europe: Sovereign Cloud Guide for Regulated IT Leaders

Alexander Abgaryan

Table of Contents

What does AWS Europe’s infrastructure look like today?

What is the AWS European Sovereign Cloud?

How does the Sovereign Cloud differ from standard AWS Regions?