Three AWS Strategies for Disaster Recovery Under Data Residency Requirements

Data residency regulations and disaster recovery architecture pull in opposite directions. Residency requirements constrain where data can go; effective DR requires redundant copies somewhere else. The reconciliation isn’t a single answer — it’s a choice among three architecturally distinct approaches, each with a different risk and complexity profile.

The Framework

AWS’s Architecture Blog guidance maps the three strategies along a spectrum from operational simplicity to absolute data sovereignty. The right choice depends on the regulatory regime, the organization’s recovery time objectives, and the acceptable operational overhead.

Strategy 1: Cryptographic Boundary

Data is replicated cross-region using standard AWS services (S3 Cross-Region Replication, AWS Backup) but protected by KMS key policies that explicitly deny decryption in the recovery region. The data is physically present elsewhere; it is cryptographically inaccessible without customer authorization.

This approach has the lowest operational complexity and the best recovery performance of the three strategies — the infrastructure exists and is ready. The tradeoff is that “data doesn’t leave the country” is technically untrue, even if access doesn’t. For regulatory regimes that require physical data location (not just cryptographic control), this strategy may not satisfy the compliance requirement.

Use this when: the regulatory requirement is access-based rather than location-based, and when recovery speed is critical.

Strategy 2: Data Boundary via AWS Outposts

Backups are stored on AWS Outposts infrastructure within customer-controlled on-premises facilities. Data access occurs over the local network, not through AWS’s external data planes. AWS DataSync or database-native replication tools handle the backup workflow.

This approach satisfies physical location requirements because the hardware is on-premises — the data genuinely doesn’t transit to a remote region. The operational overhead is significantly higher: Outposts must be provisioned, maintained, and monitored on-premises, and the DR workflow adds complexity compared to fully-managed cloud replication.

Use this when: the regulatory regime requires physical data location within customer-controlled facilities, and the organization has the operational maturity to run Outposts infrastructure.

Strategy 3: Strict Local Autonomy

Two sub-variants: (a) fully on-premises backup and recovery infrastructure with no cloud data planes involved, or (b) a lifeboat pattern using a separate cloud provider for a minimal, purpose-built recovery environment. The canonical example is Monzo Bank’s implementation — a separate cloud environment supporting only critical functions (card payments, balance queries) at intentionally degraded capability.

The lifeboat variant is the most rigorous separation: “the stand-in shares no code and no infrastructure with the primary system.” This eliminates shared-fate failure modes but requires maintaining a parallel environment indefinitely. Operational complexity is highest in this tier; recovery capability may also be intentionally limited to essential functions only.

Use this when: regulatory requirements prohibit any cloud provider data processing, or when risk management requires zero shared infrastructure dependencies between primary and recovery environments.

Testing Is Not Optional

All three strategies require end-to-end recovery testing that validates backup integrity, resource launch, and synthetic traffic under recovery conditions. AWS’s guidance is explicit: testing must include “validating the integrity and consistency of backups, launching compute and database resources.” A backup strategy that hasn’t been tested under production-equivalent load is an assumption, not a recovery plan.

This is particularly important for the cryptographic boundary strategy, where the decryption authorization flow under actual incident conditions must be validated — not just the replication pipeline.

Source: AWS Architecture Blog

Content created with AI assistance and reviewed for accuracy.