A contract requires customer data to remain in a specific Region.
Backups, logs, and derived data must not be copied elsewhere unintentionally.
Which governance approach is most appropriate?
Inventory primary, derived, backup, and log locations and enforce allowed Regions with organization and resource policies.
Detailed explanation
SCPs and resource policies can restrict copies while the inventory covers derived assets.
SCPs and resource policies can restrict copies while the inventory covers derived assets.
A backup may violate the residency contract.
A backup may violate the residency contract.
A name does not enforce where data is replicated or backed up.
A name does not enforce where data is replicated or backed up.
An API Region and a data or log location may differ.
An API Region and a data or log location may differ.
Check official documentation
Compare the following points with the official documentation.
AWS data residency、Organizations SCP region restriction、S3 replication、AWS Backupの公式説明を確認する。
What to confirm
バケット名・APIリージョンと実データの所在地制御の違いを説明できる。
Key points
- Data residency
- Region restriction
- SCP
- Backup
Notes
- Environment: AWS公式DEA-C01試験ガイドと各サービスの公式ドキュメントの確認
- Confirm current AWS service behavior in the official DEA-C01 documentation.
Foundation review
Derived assets
Include temporary files, query results, logs, metadata, and features in the inventory.
Exceptions
Document DR, support, and key-management exceptions against the contract.