DEA-C01 Question 549
Select 2Your company operates in multiple countries, each with strict data sovereignty laws that mandate customer data must remain within their respective countries. You are designing a data lake on AWS to meet these compliance requirements. Which of the following approaches will ensure compliance with data sovereignty laws while providing scalability and cost-effectiveness?
- A
Use AWS Regions located in each country to store data locally and leverage Amazon S3 bucket policies to restrict access to the respective region.
- B
Store all customer data in a single, centralized Amazon S3 bucket in the region with the lowest costs and use IAM policies to allow specific users from other countries to access the data.
- C
Use Amazon S3 Multi-Region Access Points to replicate data across multiple regions and ensure compliance with data sovereignty laws.
- D
Set up separate Amazon S3 buckets in each country and use AWS Glue to process the data locally within each region.
- E
Use Amazon CloudFront to cache customer data in edge locations near each country while keeping the original data in a single, centralized Amazon S3 bucket.
Show answer and explanation
Correct answers: A, D
Explanation
To comply with data sovereignty laws, customer data must remain within the boundaries of each respective country. Using AWS Regions located in each country with S3 bucket policies or setting up separate S3 buckets in each country with local processing using AWS Glue ensures compliance. Centralized storage or caching solutions like CloudFront do not meet these legal requirements.
- A. Correct.
Correct: Using AWS Regions located in each country to store data locally ensures compliance with data sovereignty laws, while bucket policies provide additional security to restrict access.
- B. Incorrect.
Incorrect: Storing data in a single, centralized S3 bucket does not comply with data sovereignty laws that require data to remain within specific countries.
- C. Incorrect.
Incorrect: Amazon S3 Multi-Region Access Points improve performance and availability but do not guarantee compliance with data sovereignty laws since data may be replicated across prohibited regions.
- D. Correct.
Correct: Setting up separate S3 buckets in each country ensures that data stays within the required geographic boundaries, and AWS Glue enables local processing to comply with data sovereignty laws.
- E. Incorrect.
Incorrect: Amazon CloudFront is a caching service and does not replace the need to store data within the specific countries mandated by data sovereignty laws.