AWS Disconnected Its European Sovereign Cloud for a Day: 7 Sovereignty Tests to Run on Your Own Stack

Key points:

• AWS's October 24, 2026 exercise validated AWS's side of the boundary. It says nothing about whether your application can be built, deployed, restored or paged under the same cut.
• Your workload's sovereignty is capped by its weakest external dependency: GitHub, Okta or Entra ID, Docker Hub, npm/PyPI, Let's Encrypt, Datadog, PagerDuty and model APIs. None sit inside a sovereign boundary by default.
• The honest proof is a customer-side severance drill. Inventory a week of real egress, block every non-sovereign endpoint in an isolated clone of production, and run seven tests: identity (break-glass in 15 minutes), deploy (green build), TLS (certificate issued without public ACME), data (restore with checksum match), paging (human paged in under 5 minutes), support (zero cross-border escalation) and exit (measured RTO in hours).
• Owning the cloud account is what makes the tests runnable, whether that account is on AWS, GCP, Azure, Scaleway or your own Kubernetes cluster, because you control the VPC, the egress rules, the keys and the exit.

AWS cut its European Sovereign Cloud off from the rest of AWS for several hours on October 24, 2026, and workloads kept running. That is a genuine engineering milestone, and AWS calls it the first public technical exercise of its kind (AWS Security Blog). AWS also chose the variables, the duration and the announcement, which makes it a credible self-test rather than an independent audit. Run the same cut on your own stack, and I would bet most teams could not deploy a single line of code within an hour of doing it.

What exactly did AWS test when it disconnected its European Sovereign Cloud, and what did it not test?

AWS tested whether its own sovereign Region keeps operating with no dependency on infrastructure outside the EU, and it passed. No customer-side dependency was exercised: no customer CI pipeline, no customer IdP, no customer certificate renewal, no customer restore.

On Saturday, October 24, 2026, EU-resident staff switched off both systems that normally link the Region to the outside: the AWS Global Network backbone, and a dedicated system for controlled transfers of operational data. Traffic rerouted over the public internet "for several hours", and "workloads continued running, and customers could still access their data" (AWS Security Blog). The post lists no per-service checks and names no third-party observer, though AWS's design documentation describes independent billing, account and identity systems for the partition (AWS whitepaper).

The Region (eusc-de-east-1, in Brandenburg, Germany) became generally available in January 2026 (Amazon press release), backed by a planned €7.8 billion investment through 2040 (AWS Security Blog). It sits under a German parent, AWS European Sovereign Cloud GmbH, with a five-member advisory board of EU citizens, two of them independent of Amazon (aws.eu governance).

Sovereignty marketing conflates two claims. The provider's control plane can operate independently inside the boundary. A given customer workload can operate independently inside the boundary. The October drill exercised only the first.

A few-hour window also cannot surface slow dependencies: token and certificate lifetimes, license re-validation, full restore cycles, billing, on-call handovers, CVE patch flow and SaaS renewals. The only evidence that changes your risk posture is evidence you generate inside your own account.

Why does a vendor sovereignty drill tell you almost nothing about your own workload?

A vendor drill tests the vendor's control plane, and your sovereignty is capped by your weakest external dependency, which is rarely the cloud provider. It is usually the Git host, the identity provider, the registries, the certificate authority, the observability SaaS or the paging tool.

I call the resulting failure mode the sovereign island. Traffic keeps flowing, but you cannot deploy, rotate, restore or page.

Data sovereignty is where your bytes rest, replicate and get backed up. Operational sovereignty is who can keep the system running, from where, and with which credentials. Jurisdictional sovereignty is which legal system can compel disclosure. Vendors usually sell one and imply all three, which is why "data residency vs operational sovereignty" is the question platform teams ask me most.

Let's Encrypt had about 726 million active certificates on November 1, 2026 (Let's Encrypt stats). Docker Hub caps unauthenticated pulls at 100 per IPv4 address per 6 hours (Docker docs), so a default CI pipeline already depends on it. Amazon, Microsoft and Google hold about 70% of the European cloud market, while European providers hold about 15% (Synergy Research Group).

Single dependencies cascade. In October 2025, an empty DNS record for the DynamoDB endpoint in us-east-1 cascaded into roughly 14 hours of impact across dependent AWS services (AWS post-event summary). On October 29, 2025, an Azure Front Door configuration fault degraded services including Entra ID for about eight and a half hours (Azure PIR YKYN-BWZ). When the DST Root CA X3 certificate expired in 2021, monitoring and gateway services flagged healthy servers as down (Scott Helme).

AI adds new egress: model APIs (OpenAI, Anthropic, Mistral), embedding endpoints and hosted vector databases, usually outside any sovereign boundary and on the request path.

The US CLOUD Act (18 U.S.C. §2713) requires US providers to produce data in their control "regardless of whether such communication, record, or other information is located within or outside of the United States" (Cornell LII). An EU-controlled operating entity changes that analysis. How much is a question for your counsel.

What are the 7 sovereignty tests you should actually run yourself?

Deny all egress from an isolated clone of your sovereign environment to non-sovereign endpoints, then attempt seven operations (identity, deploy, DNS/TLS, data restore, observability, operator access, exit) and record which fail and how long each takes. Every failure is a sovereignty gap you own and can fix.

1. Identity. A named break-glass account logs in and performs a privileged action within 15 minutes with your IdP unreachable. The usual failure is cluster RBAC bound to an external OIDC issuer.
2. Deploy from scratch. With egress blocked, you get a green build and a successful rollout, with runners, images, packages and Helm charts resolving in-boundary. In October 2025, a third-party outage delayed or failed nearly 10% of GitHub's larger-runner jobs for hours (GitHub Availability Report).
3. DNS and TLS. Force a renewal and get a certificate issued and deployed with public ACME unreachable, plus a rehearsed path to re-delegate your zone at the registrar. This test matters more every year, because maximum certificate lifetime drops to 200 days in March 2026, 100 days in March 2027 and 47 days in March 2029 (CA/Browser Forum SC-081v3).
4. Data. Prove residency for primary data, snapshots, replicas, logs, traces and error payloads (Sentry-style breadcrumbs leak data people forget). The pass is a production-sized restore completed in-boundary, with a checksum match and a recorded wall-clock time.
5. Observability and paging. An alert fires from an in-boundary stack (Prometheus, Grafana, Loki) and reaches an on-call human through an in-region route in under 5 minutes. Datadog plus PagerDuty with no fallback fails this every time.
6. Operator access and support. A support ticket gets resolved with zero cross-border escalation, and you hold the vendor's escalation runbook in writing before the drill.
7. Exit. Rebuild the whole environment from code in a second provider or your own Kubernetes cluster, and time it. The pass is a measured RTO in hours with a signed-off runbook. An exit plan without that number is untested.

Tests 4, 6 and 7 map directly onto regulation. DORA requires exit strategies for critical ICT services that are "comprehensive, documented" and "sufficiently tested" (Art. 28(8)), alongside business continuity (Art. 11), backup and restoration (Art. 12) and resilience testing (Art. 24 to 27) (Regulation (EU) 2022/2554). NIS2 Article 21(2) requires backup management, disaster recovery, crisis management and supply-chain security (Directive (EU) 2022/2555). A measured RTO counts as evidence for a DORA exit strategy. A vendor certificate does not.

How do you run an egress-block severance drill without breaking production?

Run the egress block drill in a disposable, production-shaped environment rebuilt from code, after a full business week of egress inventory, and never on production the first time.

The method has seven steps:

1. Rebuild production from code into an isolated account or cluster.
2. Inventory actual egress with VPC Flow Logs, Route 53 Resolver query logs and egress proxy logs for at least a full business week.
3. Write the deny list from observed traffic, never from assumptions.
4. Apply the block.
5. Run the seven tests.
6. Log every failure with a timestamp and a named owner.
7. Fix and re-run.

Spend most of your effort on step 2. Teams routinely find undocumented endpoints such as SDK telemetry beacons, license checks, CDN calls, auto-update pings and crash reporters, which flow logs show and architecture diagrams never do.

A sustainable cadence is an automated subset on every pull request (block egress in a preview environment and check the build passes), a targeted drill each quarter and one full-day drill a year. If spinning up a production-shaped environment takes two weeks of platform work, the drill becomes annual theatre.

Write the results up as a sovereignty posture report listing failed tests, owners and target dates. Recovery gaps are common: 82% of IT leaders told Veeam their teams cannot restore as fast as the business needs (Veeam), and 54% of operators said their latest serious outage cost more than $100,000 (Uptime Institute). The report is what answers a customer security questionnaire and what a DORA reviewer expects to see.

How do the sovereign cloud options compare if you are choosing today?

No sovereign cloud wins outright, because each option trades jurisdiction, key custody, managed-service depth and exit speed differently. Measured exit time is the one axis that makes a wrong bet reversible.

The AWS European Sovereign Cloud is a serious engineering and governance effort, and the open question is dependency breadth across your own stack. Microsoft splits a Sovereign Public Cloud with built-in controls from a Sovereign Private Cloud that can run "fully disconnected" on Azure Local (Microsoft). Google offers Data Boundary controls on its public cloud, partner-operated Google Cloud Dedicated (run by S3NS in France), and Google Distributed Cloud air-gapped, which "cannot be remotely shut down by Google" (Google Cloud).

OVHcloud and Scaleway win cleanly on jurisdiction and usually on price, and OVHcloud states its SecNumCloud offers are operated exclusively by personnel based in Europe (OVHcloud). Their narrower catalogues push operational work back onto your team. Self-managed Kubernetes on EU infrastructure gives maximum portability and maximum operational burden.

Choose by regulated-data exposure, team size and the exit time you can defend to an auditor. If your exit RTO is untested, treat every row in this table as unverified.

How does running your platform in your own cloud account change what you can test?

You can only run a severance drill if you own the account, the network and the deployment definition. Heroku, Vercel, Render and Fly.io run your app inside their account, so you cannot read their flow logs, apply your own deny rules, hold your own keys or rebuild the same definition elsewhere. A BYOC platform deploys into an account that is already yours, which makes all seven tests runnable.

Qovery deploys and operates applications inside your own AWS, GCP, Azure or Scaleway account, or inside your existing Kubernetes cluster (self-managed, on-prem, any distribution), with equal support for each. The cloud bill, the VPC, the IAM roles, the keys and the data stay in your name.

Your flow logs feed the inventory, your security groups enforce the block, your IAM holds break-glass, your snapshots feed the restore, and the same declarative definition rebuilds the environment in a second provider for Test 7. Qovery adds the pieces that keep drills cheap: ephemeral preview environments per pull request, auto-stop so idle drill environments stop costing money, per-environment RBAC to scope break-glass operators, and managed cluster upgrades so the sovereign cluster stays patched without a dedicated DevOps engineer.

Qovery does not make you sovereign and is not a certification. It removes the Kubernetes operational burden and keeps your workload portable as containers plus declarative config, which makes the exit real. The DIY path of Terraform plus Argo CD plus Crossplane is entirely viable too, but you then staff a platform team to maintain the drill harness as well as the platform.

How do I run this with Qovery from Claude Code or Cursor?

Install the Qovery agent skills once, then ask your coding agent to clone production into an isolated environment in your own cloud account, run the egress-block drill and tear it down. The agent proposes each action and you approve it before anything runs.

curl -fsSL https://skill.qovery.com/install.sh | bash

# Or scoped to the repository you are drilling against
curl -fsSL https://skill.qovery.com/install.sh | bash -s -- --project

# Qovery MCP Server in Claude Code (OAuth, read-only by default)
claude mcp add --transport http qovery https://mcp.qovery.com/mcp --callback-port 4242

# Write access, only when you want the agent to act (also enable it in the Qovery Console)
claude mcp add --transport http qovery "https://mcp.qovery.com/mcp?read_write=true" --callback-port 4242

The skills (qovery-onboard, qovery-deploy, qovery-troubleshoot, qovery-optimize, qovery-speedup, qovery-preview, qovery-terraform) do the work, and the MCP Server inspects what already exists. Then ask in plain language, for example "clone my production environment into an isolated preview environment in my own AWS account so I can run an egress-block drill". See the AI agent quickstart and the Claude Code integration.