DEA-C01 Question 546
Select 2A multinational company is designing a data lake on Amazon S3 to store sensitive customer data collected from multiple countries. Some countries have strict data sovereignty laws requiring that customer data must not leave their borders. Which of the following approaches ensures compliance with these regulations while maintaining a centralized data processing setup?
- A
Use S3 bucket policies to restrict access to data based on the requester’s IP address.
- B
Use Amazon S3 Multi-Region Access Points to route data requests to buckets in the same region as the customer data origin.
- C
Create separate S3 buckets in each region where data sovereignty laws require local storage and process data locally within those regions.
- D
Enable Amazon S3 Transfer Acceleration to reduce latency for cross-border data access.
- E
Leverage AWS Lake Formation with fine-grained permissions to enforce access controls based on compliance requirements.
Show answer and explanation
Correct answers: B, C
Explanation
To comply with data sovereignty laws, sensitive data must remain in the required geographic region. Using S3 Multi-Region Access Points ensures data requests are routed to the correct region, while creating separate S3 buckets per region ensures data storage complies with local regulations. Other options either address different concerns or do not directly address the issue of ensuring geographic data residency.
- A. Incorrect.
Restricting access based on IP addresses does not ensure compliance with data sovereignty laws since the data could still be stored outside the required region.
- B. Correct.
Amazon S3 Multi-Region Access Points allow traffic routing to the appropriate region, which can help comply with data sovereignty laws by ensuring data requests stay within the designated region.
- C. Correct.
Creating separate S3 buckets in regions where data must remain ensures compliance with data sovereignty laws, as the data is stored locally within the required geographic boundaries.
- D. Incorrect.
Amazon S3 Transfer Acceleration is used to reduce latency for data transfers but does not address data sovereignty requirements.
- E. Incorrect.
AWS Lake Formation can enforce access controls but does not inherently resolve the issue of ensuring data remains within specific geographic regions.