Consent & Privacy Service  ·  View 16 of 22  ·  Operations

Deployment Architecture

Three jurisdictional boundaries of the same shape, and the deliberate absence of any arrow between them.

Editable source SVG draw.io All views
Global — definitions only, no personal data Control plane Aurora Global purpose registry Signed bundle S3 + CloudFront EU boundary — eu-west-1 / eu-central-1 AZ a / b / c Decision & capture Fargate, 3 AZ Ledger + projection DynamoDB Case orchestrator Keys & evidence Regional CMK Object Lock audit US boundary — us-east-1 / us-west-2 AZ a / b / c Decision & capture Fargate, 3 AZ Ledger + projection Case orchestrator Keys & evidence Regional CMK Object Lock audit IN boundary — ap-south-1 AZ a / b / c Decision & capture Fargate, 3 AZ Ledger + projection Regional CMK Jurisdiction router Route 53 + edge policy policy Deployment — Three Jurisdictions, No Cross-Border Failover Data store Application we own Security / platform Interface / broker batch Nothing crosses a boundary: no replica, no key, no failover. A region's unavailability denies its subjects' consent-based purposes, which is the correct answer. v 1.0 · owner Security & Identity Architecture

Decisions

  • Nothing crosses a boundary: no replica, no key, no failover. A region's unavailability makes its subjects' consent-based purposes deny, and that is the correct answer rather than a gap to be engineered away.
  • The availability target is set with that behaviour in mind. Buying cross-region failover here would mean replicating consent records out of their jurisdiction, which is the thing the platform exists to prevent.
  • Only the signed policy bundle fans out globally, and it carries definitions rather than people.

Assumptions

  • 9 regional deployments across 3 jurisdictional boundaries; three AZs per region; per-region customer master key with no cross-region grant.
  • RTO 10 minutes in-region for the decision path. No cross-jurisdiction RTO is offered.

Risks

  • Duplicated stacks multiply operational cost and configuration drift. The mitigation is that the stack is identical and deployed from one definition, which makes drift a release problem rather than a regional one.
  • The jurisdiction router is the single component that can send a subject's request to the wrong boundary. It is a residency control in the data path, and its failure mode is an unlawful transfer.
◀  Purpose Limitation — The Decision Path All views Observability  ▶
Solution Architecture v1.0 · Amazon Web Services · Security & Identity Architecture · 2026-1016-deployment-architecture