Skip to content

PATTERN Cited by 1 source

Cryptographic boundary recovery

Shape

Replicate encrypted backups or data to a recovery Region in a geopolitically compatible country, then make the ability to decrypt a separately authorized recovery action. On AWS, the data path is S3 Cross-Region Replication or AWS Backup cross-Region copy; the access boundary is a customer-controlled KMS key policy that explicitly denies decryption in the recovery Region until authorized. (Source: sources/2026-08-13-aws-recovery-strategies-to-meet-data-residency-requirements)

Controls

  • Use AWS KMS keys to encrypt the replicated data.
  • Deny decryption in the recovery Region by policy until a recovery decision changes that policy.
  • Restrict policy mutation to named IAM principals with condition keys.
  • Separate approval from operator credentials with MFA, or use IdP-issued session tags for conditional policy-change access.
  • For self-managed client-side S3 backups, use the AWS Encryption SDK or multi-Region KMS keys when equivalent key material across Regions is needed.

When it fits

Use this pattern when the regulator accepts encrypted data in the recovery geography and recovery RTO favors conventional multi-Region AWS primitives. It has lower operational complexity than maintaining local hardware or a second-cloud recovery plane.

Limits

Encryption is a compensating control, not a substitute for residency approval. The decryption-release workflow is itself on the critical recovery path and must be rehearsed. A synthetic-data drill validates mechanics but cannot demonstrate that production data can be legally decrypted and recovered.

Seen in

Last updated · 622 distilled / 1,953 read