A European bank must keep customer PII within eu-central-1, prevent cross-border replication, allow EU-only administrators to manage keys and logs, and demonstrate residency to regulators during audits. Applications run on S3, RDS, and KMS. Which solution enforces data sovereignty controls?
Select an answer to reveal the explanation.
Short Explanation
Regulators don't accept promises, they want guardrails. You'll fence workloads inside one region and lock the gates with policy using data residency controls end to end. Keys, logs, and data never wander across borders.
Full Explanation
The correct solution succeeds because Service Control Policies that deny provisioning outside eu-central-1 give preventive residency enforcement for S3, RDS and KMS, customer managed KMS keys created in and confined to eu-central-1 keep cryptographic control with EU administrators, and CloudTrail Lake with EU-only storage gives queryable audit evidence that regulators can verify without data leaving the boundary. Multi-Region KMS keys fail by concept because they replicate key material into other Regions, which breaks the no cross-border replication requirement even if the data stays pinned. Allowing global administrators fails because it directly breaches the EU-only administrator constraint for keys and logs and undermines sovereignty claims about control-plane access. Short-retention CloudWatch Logs fail because they do not give the long-lived, queryable audit evidence regulators need to demonstrate residency over time, unlike CloudTrail Lake with an appropriate retention period. For exams, distinguish residency controls from availability or convenience designs, since replication, multi-Region keys, and global access often look correct but contradict sovereignty wording. In practice validate with SCP deny-unless-region simulations, key Region and policy review, IAM Access Analyzer findings for administrators, and CloudTrail Lake retention checks.