AWS turns digital sovereignty into 37 cloud-design practices

On October 5, AWS launched a Digital Sovereignty Lens for its Well-Architected Framework, organized around 21 questions and 37 practices covering locality, access control, continuity, portability and auditability. AWS described localization and resilience as potentially conflicting requirements and identified external APIs, software dependencies and third-country jurisdiction as sources of exposure. This is provider-issued architecture guidance rather than a regulatory safe harbor, so legal teams must still map controls to the client’s actual statutory, procurement and sector obligations. Its practical value is to make sovereignty claims testable: contracts and risk assessments can require evidence about operator access, encryption control, failover locations, portability and the legal authority governing each layer.