--- title: AWS European Sovereign Cloud Migration Services | CBTW description: Design, migrate, and operate sovereign cloud environments on AWS ESC — fully compliant with EU law, GDPR, and NIS2. EU-resident operations, zero standing access, and MAP 2.0 funding support. Talk to a CBTW expert. image: https://lp.cbtw.tech/hubfs/aws-european-sovereign-cloud-cbtw.jpeg --- [![Collaboration Betters The World Logo](https://lp.cbtw.tech/hs-fs/hubfs/Primary_Black.png?width=1001&height=244&name=Primary_Black.png "Collaboration Betters The World Logo")](https://cbtw.tech) [Contact →](https://cbtw.tech/contact) AWS # Move Regulated AWS Workloads to AWS European Sovereign Cloud We design, build, and operate sovereign cloud environments on AWS European Sovereign Cloud compliant with EU law, governed by EU residents, and protected from extraterritorial access. Plus a controlled bridge to keep your existing AWS estate working alongside it. [Explore the approach](https://lp.cbtw.tech/aws-european-sovereign-cloud#section-8) ![aws-european-sovereign-cloud-cbtw](https://lp.cbtw.tech/hubfs/aws-european-sovereign-cloud-cbtw.jpeg) Numbers ## Built for Sovereign Cloud Operations Infrastructure, governance, and funding designed for regulated cloud environments €500K+ MAP 2.0 funding eligibility for qualifying migrations +27% CAGR forecast for Sovereign Cloud to 2027 (IDC) 100% EU-resident operations, support, and technical services €7.8B AWS committed investment in European infrastructure, jobs and skills your challenges ## Why Standard Cloud Regions Fall Short GDPR, NIS2, and sector regulations have raised the bar. Region selection alone is no longer a defensible control for regulated workloads. [Assess your readiness](https://lp.cbtw.tech/aws-european-sovereign-cloud#landing-form) ![AWS-European-Sovereign-Cloud](https://lp.cbtw.tech/hubfs/Rovo-Maturity-Assessment-CBTW-1.png) ### US CLOUD Act exposure Under the 2018 CLOUD Act, US authorities can request data from American companies regardless of where it is stored, including EU-based AWS regions.   ![AWS-European-Sovereign-Cloud](https://lp.cbtw.tech/hubfs/Rovo-Usage-Assessment-Atlassian-CBTW-1.png) ### GDPR and NIS2 compliance gaps Standard commercial cloud regions do not satisfy the stricter residency, operator-access, and audit obligations now codified in EU regulation.   ![AWS-European-Sovereign-Cloud](https://lp.cbtw.tech/hubfs/Rovo-Agent-Development-Atlassian-CBTW.png) ### No guarantee of EU data residency For banking, healthcare, and public sector workloads, pointing to a regional endpoint is no longer sufficient proof of data residency.   ![AWS-European-Sovereign-Cloud](https://lp.cbtw.tech/hubfs/Rovo-Training-Hypercare-Atlassian-CBTW-2.png) ### Outage and geopolitical fragility The us-east-1 outage of October 19-20, 2025 showed how far a single foreign-controlled partition can cascade into EU operations through shared IAM and STS.  ![Rovo-Maintenance-Support-CBTW-Atlassian](https://lp.cbtw.tech/hubfs/Rovo-Maintenance-Support-CBTW-Atlassian.png) ### No bridge for your existing AWS estate Moving to a separate partition without a controlled, auditable path back to commercial AWS strands data, identity, and recovery workflows.   what you get ## Sovereign by Design for Compliance, Continuity, and Operational Control [Talk to a cloud architect](https://lp.cbtw.tech/aws-european-sovereign-cloud#landing-form) ### Governed by EU law Workloads run in the Brandenburg, Germany partition under a dedicated German parent company. EU-resident operators only, subject to EU law, with improved extraterritorial protection. ### Working cross-partition bridge A controlled, auditable backup and recovery path between AWS ESC and standard AWS partitions. Already running in our sandbox. ### Sovereign failover by design Architecture built to keep operating independently of the commercial AWS partition during a major regional outage. Separate AWS Organizations, IAM stack, and in-region billing. ### MAP 2.0 funding, fully managed Migrations above €500K qualify for AWS MAP 2.0. Below that, MAP Lite applies. We run the procurement, the Customer Sign-off, and the two-tranche credit flow: first tranche (25%) at €50K spend, second tranche (75%) at migration completion, with credits calculated on account revenue rather than resource tagging. Our Approach ## Four Pillars of Digital Sovereignty Our architecture and operating model address each dimension of sovereign cloud: [Schedule an ESC assessment](https://lp.cbtw.tech/aws-european-sovereign-cloud#landing-form) ![Lock icon representing data residency and secure storage of data within EU sovereign cloud boundaries.](https://lp.cbtw.tech/hubfs/Data%20Sovereignty.svg) ### Data residency ##### Where your data lives - Geographic storage within EU legal boundaries - Cross-border transfer controls at partition level - Data classification and handling requirements - Jurisdictional control over all access ![Shield icon representing controlled operator access, identity management, and data protection in a sovereign cloud environment.](https://lp.cbtw.tech/hubfs/Access%20Control.svg) ### Operator access ##### Who can reach your data - Zero standing access for AWS or any third party - Vault-issued short-lived STS credentials, no static IAM - Full audit trail on every access attempt - Legal protections against unauthorized access ![Cloud icon representing independent cloud operations and sovereign infrastructure management within the European Union.](https://lp.cbtw.tech/hubfs/Cloud%20Infrastructure.svg) ### Resiliency ##### What keeps you running - Operations independent from commercial partition outage - Separate AWS Organizations and billing systems - Tested failover path validated in our live sandbox - Survivability through geopolitical disruption by design ![Government building icon representing legal sovereignty, regulatory compliance, and jurisdictional control over cloud data.](https://lp.cbtw.tech/hubfs/Parliament--Streamline-Core.svg) ### Independence ##### Who governs the environment - Dedicated German parent company, EU leadership - EU-only staffing for operations and support - Complete compliance documentation chain - Full transparency of operations and governance ## Built on Tools Your Team Already Knows ![Amazon\_Web\_Services\_idS5TK0MYh\_0](https://lp.cbtw.tech/hubfs/Amazon_Web_Services_idS5TK0MYh_0.svg) ![Logo Terraform](https://lp.cbtw.tech/hubfs/Terraform%20Logo.svg) ![Hashicorp-Vault-Logo-Vector.svg-](https://lp.cbtw.tech/hubfs/Hashicorp-Vault-Logo-Vector.svg-.png) WHY IT MATTERS > “As a global bank, our customer data must be kept within our home country’s legal jurisdiction. We need iron-clad guarantees around data residency, access controls, and audit trails to meet our compliance obligations.” FAQ ## Find the Most Common Answers Here Which AWS services are currently available on the European Sovereign Cloud? Not all AWS services are available on the ESC yet. AWS regularly updates the list of supported services as the offering expands. You can check the full and up-to-date list of available services directly on the official AWS capabilities page [here](https://builder.aws.com/build/capabilities/explore?f=eJyrVipOzUlNLklNCUpNz8zPK1ayUoqOUUotLU7WTUnVTU0sLtE1jFGKVdKBK3QsS8zMSUzKzMksqQSqdsyrVEARqgUA4l8dog&tab=service-feature).  What exactly is AWS European Sovereign Cloud, and how is it different from a standard EU AWS region? ESC is a separate AWS partition physically located in Brandenburg, Germany, operated under a dedicated German parent company. Unlike a standard EU region, ESC is governed exclusively by EU residents subject to EU law, with an independent control plane, a separate IAM stack, and its own billing systems. It is structurally protected from the US CLOUD Act: because the operating entity is not a US company, US authorities cannot compel data disclosure regardless of where the data is stored. Does moving to ESC mean we lose access to our existing commercial AWS services? Not with our approach. We build and operate a controlled, auditable cross-partition bridge between your ESC environment and your existing commercial AWS partition. Your regulated workloads run in the sovereign environment while your broader AWS estate continues to function alongside it. The bridge uses Terraform, HashiCorp Vault, and short-lived STS credentials, with no static IAM and a full audit trail on every cross-boundary operation. We already have workloads in eu-central-1 or eu-west-1. Do we need to migrate everything? No. ESC is designed as a complement to your existing AWS estate, not a forced replacement. The typical starting point is identifying the specific workloads that carry regulatory risk, those subject to GDPR data residency requirements, NIS2 audit obligations, sector-specific rules, or workloads where CLOUD Act exposure is a board-level concern. We scope the migration around those workloads and build the cross-partition bridge to keep everything else running as-is. How does MAP 2.0 funding work, and do we qualify? AWS Migration Acceleration Program (MAP) 2.0 provides credits to offset the "double-bubble" cost of running old infrastructure and AWS simultaneously during a migration. For ESC migrations, the threshold is €500K in migration scope (meaning the expected AWS revenue from migrated workloads, not consulting fees). Above that, full MAP 2.0 applies with a two-tranche credit model. Below €500K, MAP Lite applies. We manage the entire procurement process on your behalf. What does "zero standing access" mean in practice? It means no one (not AWS, not CBTW, not any system) holds permanent credentials that could be used to access your environment at any time. Instead, our architecture uses HashiCorp Vault to generate short-lived STS credentials on demand, scoped to the exact operation being performed and expiring automatically after use. Every access attempt is logged in a full audit trail. Through AWS Nitro System Hypervisor Architecture not even AWS can have access to company data.   How long does a typical ESC migration take? It depends on the scope and complexity of the workloads being moved. A focused migration of one or two regulated workloads can move in weeks. Larger migrations covering multiple teams, data pipelines, and identity systems are typically phased. We start every engagement with a scoping phase to define the migration boundary, assess cross-partition bridge requirements, and produce a phased roadmap before any infrastructure work begins. Is ESC available outside Germany, and which industries are using it? The ESC infrastructure is located in Brandenburg, Germany, and is governed by EU law, accessible to organizations across the EU, not only German companies. AWS has committed to also launching new “Sovereign Local Zones” in Belgium, the Netherlands, and Portugal. Early adopters include regulated sectors: EWE AG (energy and telco, 11,000+ employees), Medizinische Universitat Lausitz - Carl Thiem (state medical university, ~1,200 beds), and Sanoma Learning (K12 EdTech, 11 countries, ~25M students). Banking, healthcare, public sector, and critical infrastructure are the primary verticals seeing immediate regulatory pressure. [Book a discovery call](https://lp.cbtw.tech/aws-european-sovereign-cloud#landing-form) get in touch ## Start Your Sovereign Cloud Conversation Do you want to scope a migration, evaluate ESC for a specific workload, or try to understand your Cloud Act exposure? We can clarify this with you. First name \* Last name \* Corporate email \* Company name Job title \* Country \* Please select Afghanistan Albania Algeria American Samoa Andorra Angola Anguilla Antarctica Antigua and Barbuda Argentina Armenia Aruba Asia/Pacific Region Australia Austria Azerbaijan Bahamas Bahrain Bangladesh Barbados Belarus Belgium Belize Benin Bermuda Bhutan Bolivia Bosnia and Herzegovina Botswana Bouvet Island Brazil British Indian Ocean Territory British Virgin Islands Brunei Bulgaria Burkina Faso Burundi Cambodia Cameroon Canada Cape Verde Caribbean Netherlands Cayman Islands Central African Republic Chad Chile China Christmas Island Cocos (Keeling) Islands Colombia Comoros Congo Cook Islands Costa Rica Cote d'Ivoire Croatia Cuba Curaçao Cyprus Czech Republic Democratic Republic of the Congo Denmark Djibouti Dominica Dominican Republic East Timor Ecuador Egypt El Salvador Equatorial Guinea Eritrea Estonia Ethiopia Europe Falkland Islands Faroe Islands Fiji Finland France French Guiana French Polynesia French Southern and Antarctic Lands Gabon Gambia Georgia Germany Ghana Gibraltar Greece Greenland Grenada Guadeloupe Guam Guatemala Guernsey Guinea Guinea-Bissau Guyana Haiti Heard Island and McDonald Islands Honduras Hong Kong Hungary Iceland India Indonesia Iran Iraq Ireland Isle of Man Israel Italy Jamaica Japan Jersey Jordan Kazakhstan Kenya Kiribati Kuwait Kyrgyzstan Laos Latvia Lebanon Lesotho Liberia Libya Liechtenstein Lithuania Luxembourg Macau Macedonia (FYROM) Madagascar Malawi Malaysia Maldives Mali Malta Marshall Islands Martinique Mauritania Mauritius Mayotte Mexico Micronesia Moldova Monaco Mongolia Montenegro Montserrat Morocco Mozambique Myanmar (Burma) Namibia Nauru Nepal Netherlands Netherlands Antilles New Caledonia New Zealand Nicaragua Niger Nigeria Niue Norfolk Island North Korea Northern Mariana Islands Norway Oman Pakistan Palau Palestine Panama Papua New Guinea Paraguay Peru Philippines Pitcairn Islands Poland Portugal Puerto Rico Qatar Romania Russia Rwanda Réunion Saint Barthélemy Saint Helena Saint Kitts and Nevis Saint Lucia Saint Martin Saint Pierre and Miquelon Saint Vincent and the Grenadines Samoa San Marino Sao Tome and Principe Saudi Arabia Senegal Serbia Seychelles Sierra Leone Singapore Sint Maarten Slovakia Slovenia Solomon Islands Somalia South Africa South Georgia and the South Sandwich Islands South Korea South Sudan Spain Sri Lanka Sudan Suriname Svalbard and Jan Mayen Swaziland Sweden Switzerland Syria Taiwan Tajikistan Tanzania Thailand Togo Tokelau Tonga Trinidad and Tobago Tunisia Turkey Turkmenistan Turks and Caicos Islands Tuvalu U.S. Virgin Islands Uganda Ukraine United Arab Emirates United Kingdom United States United States Minor Outlying Islands Uruguay Uzbekistan Vanuatu Vatican City Venezuela Vietnam Wallis and Futuna Western Sahara Yemen Zambia Zimbabwe Åland Islands Phone +32 Subject \* Message Collaboration Betters The World is committed to protecting and respecting your privacy, and we’ll only use your personal information to administer your account and to provide the information you requested from us. In order to process your request and contact you, please tick box below to consent for the processing of your personal information.   I agree to the [Privacy Policy](https://cbtw.tech/legal/privacy-policy/) and the [General Terms of Use](https://cbtw.tech/legal/terms-of-use) Thank you for submitting your details. An expert will contact you shortly. Book a discovery call Services Overview - [Software Engineering](https://cbtw.tech/service-overview/software-engineering/) - [AI & Data Platforms](https://cbtw.tech/service-overview/ai-data-platforms/) - [Cloud & Enterprise Platforms](https://cbtw.tech/service-overview/cloud-and-enterprise-platforms/) - [Cybersecurity](https://cbtw.tech/service-overview/cybersecurity/) - [Strategy, Product & Transformation](https://cbtw.tech/service-overview/strategy-product-transformation/) Sectors - [Banking & Finance](https://cbtw.tech/sectors/banking-and-finance/) - [Energy & Utilities](https://cbtw.tech/sectors/energy-utilities/) - [Luxury](https://cbtw.tech/sectors/luxury/) - [Manufacturing & Industry](https://cbtw.tech/sectors/manufacturing-industry/) - [Telecommunications & Media](https://cbtw.tech/sectors/telecommunications-media/) Partners - [Ecosystem](https://cbtw.tech/partners/) About - [Company](https://cbtw.tech/about/) Insights - [Insights](https://cbtw.tech/insights?categories=insights) - [Case Studies](https://cbtw.tech/insights?categories=case-studies) - [Resources](https://cbtw.tech/insights?categories=resources) Careers - [Culture](https://cbtw.tech/careers/) - [Open Positions](https://jobs-collaborationbetterstheworld.icims.com/jobs/search?hashed=-625911731) [![Instagram](https://lp.cbtw.tech/hubfs/insAsset-1@2x.png)](https://www.instagram.com/collaborationbetterstheworld/) [![LinkedIn](https://lp.cbtw.tech/hubfs/lkAsset-2@2x.png)](https://www.linkedin.com/company/collaboration-betters-the-world) [![YouTube](https://lp.cbtw.tech/hubfs/youtubeAsset-3@2x.png)](https://www.youtube.com/@collaborationbetterstheworld) ## Team Member Name ![team-member](https://cdn2.hubspot.net/hubfs/5377389/theme/images/stock-images/team-member-1.png) Team member bio information. ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "AWS European Sovereign Cloud (ESC) is a separate AWS partition physically located in Brandenburg, Germany, operated under a dedicated German parent company. Unlike a standard EU region, ESC is governed exclusively by EU residents subject to EU law, with an independent control plane, a separate IAM stack, and its own billing systems. It is structurally protected from the US CLOUD Act: because the operating entity is not a US company, US authorities cannot compel data disclosure regardless of where the data is stored." }, "name" : "What exactly is AWS European Sovereign Cloud, and how is it different from a standard EU AWS region?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not with CBTW's approach. We build and operate a controlled, auditable cross-partition bridge between your ESC environment and your existing commercial AWS partition. Your regulated workloads run in the sovereign environment while your broader AWS estate continues to function alongside it. The bridge uses Terraform, HashiCorp Vault, and short-lived STS credentials, with no static IAM and a full audit trail on every cross-boundary operation." }, "name" : "Does moving to ESC mean we lose access to our existing commercial AWS services?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "No. ESC is designed as a complement to your existing AWS estate, not a forced replacement. The typical starting point is identifying the specific workloads that carry regulatory risk - those subject to GDPR data residency requirements, NIS2 audit obligations, sector-specific rules, or workloads where CLOUD Act exposure is a board-level concern. CBTW scopes the migration around those workloads and builds the cross-partition bridge to keep everything else running as-is." }, "name" : "We already have workloads in eu-central-1 or eu-west-1. Do we need to migrate everything?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, ESC carries a cost premium over standard AWS regions such as eu-central-1 (Frankfurt). Based on early pricing calculator data, the uplift sits at roughly 15% across common services. AWS MAP 2.0 migration funding can offset a significant portion of transition costs for qualifying migrations above €500K in scope." }, "name" : "Is AWS European Sovereign Cloud more expensive than a standard AWS region?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "AWS Migration Acceleration Program (MAP) 2.0 provides credits to offset the cost of running old infrastructure and AWS simultaneously during a migration. For ESC migrations, the threshold is €500K in migration scope - meaning the expected AWS revenue from migrated workloads, not consulting fees. Above that threshold, full MAP 2.0 applies with a two-tranche credit model: first tranche (25%) at €50K spend, second tranche (75%) at migration completion. Below €500K, MAP Lite applies. CBTW manages the entire procurement process on your behalf." }, "name" : "How does MAP 2.0 funding work, and do we qualify?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Zero standing access means no one - not AWS, not CBTW, not any system - holds permanent credentials that could be used to access your environment at any time. Instead, the architecture uses HashiCorp Vault to generate short-lived STS credentials on demand, scoped to the exact operation being performed and expiring automatically after use. Every access attempt is logged in a full audit trail. Through the AWS Nitro System Hypervisor Architecture, not even AWS can access your company data." }, "name" : "What does zero standing access mean in practice?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "It depends on the scope and complexity of the workloads being moved. A focused migration of one or two regulated workloads can move in weeks. Larger migrations covering multiple teams, data pipelines, and identity systems are typically phased. CBTW starts every engagement with a scoping phase to define the migration boundary, assess cross-partition bridge requirements, and produce a phased roadmap before any infrastructure work begins." }, "name" : "How long does a typical ESC migration take?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "The ESC infrastructure is located in Brandenburg, Germany, and is governed by EU law, making it accessible to organizations across the EU - not only German companies. AWS has committed to also launching new Sovereign Local Zones in Belgium, the Netherlands, and Portugal. Early adopters include regulated sectors: EWE AG (energy and telco), Medizinische Universitat Lausitz - Carl Thiem (state medical university), and Sanoma Learning (K12 EdTech across 11 countries). Banking, healthcare, public sector, and critical infrastructure are the primary verticals seeing immediate regulatory pressure." }, "name" : "Is ESC available outside Germany, and which industries are using it?" } ] } ```