eu-west-2 Is Not a Compliance Strategy

Selecting the AWS London region is one decision. Keeping patient data in the UK is twenty

There is a common misconception in UK healthcare IT that data residency is a configuration choice. You pick eu-west-2 during account setup and move on.

It is not that simple. And in a sector governed by UK GDPR, the Data Protection Act 2018 and the NHS Data Security and Protection Toolkit, the gap between believing you are compliant and actually being compliant can be the difference between a clean audit and a reportable breach.

What the region selection covers

When you provision AWS resources in eu-west-2, you are telling AWS to physically locate those resources in their London data centres. Data stored in an S3 bucket provisioned in eu-west-2 does not replicate to other regions by default. An RDS database provisioned in eu-west-2 runs on hardware in the UK. The underlying infrastructure stays within UK jurisdiction.

That is meaningful. But it is also the easiest part.

Where the gaps appear

Cross-region replication is opt-in, but so is preventing it.

S3 Cross-region Replication is disabled by default, but it only takes one misconfigured replication rule, one automated backup policy copying to us-east-1 for cost reasons or one CloudTrail log bucket pointing to a cheaper non-UK region to put patient identifiable information outside UK borders. The region selection does not prevent any of this. Only deliberate Service Control Policies (SCPs) at the AWS Organisation level can enforce that no resource is ever created outside eu-west-2.

Managed services have regional defaults you need to verify individually.

Amazon SES, Lambda edge functions, CloudFront distributions and several analytics services have default behaviours that operate globally or default to US regions. Each one requires regional configuration. Assuming that provisioning within eu-west-2 cascades to every attached service is one of the most common architectural mistakes in cloud migrations.

VPC Endpoints are not automatic.

Without VPC Endpoints configured for S3 and other AWS services, traffic from your application tier to AWS managed services routes over the public internet even when both the application and the service are in eu-west-2. This is not a data residency failure, but it is a data-in-transit exposure that creates significant compliance problems under UK GDPR’s requirement for appropriate technical measures. VPC Endpoints ensure that traffic between services never leaves the AWS private network.

CloudTrail logs have to be explicitly retained in-region.

AWS CloudTrail provides the immutable audit log that regulators and the NHS DSP Toolkit assessors will ask for. But CloudTrail logs can be configured to export to S3 buckets in whatever region is cheapest or most convenient. If your audit logs live in eu-west-1 or us-east-1, you have a data residency problem in the very system you rely on to prove you do not have a data residency problem.

The architecture that actually enforces residency

Genuine UK data residency in AWS requires a layered approach.

1. An SCP at the organisation level denying any API call that would create resources outside eu-west-2.

2. A dedicated S3 bucket policy blocking cross-region replication.

3. VPC Endpoints for every AWS service the application consumes.

4. CloudTrail and CloudWatch log groups explicitly provisioned in eu-west-2 with bucket policies preventing replication.

5. KMS key policies scoped to the London region.

6. CloudWatch alarm that fires if any of these controls drift.

None of this is complex. All of it is easy to miss if you treat region selection as the end of the compliance conversation rather than the beginning.

Why this matters specifically in healthcare

NHS England’s progressive migration to AWS and their maintenance of full DSP Toolkit compliance throughout, demonstrates that it is entirely achievable. But their architecture teams spent considerable effort on exactly these controls. The clinics, trusts and private healthcare providers following in their footsteps inherit the destination but not necessarily the map.

Data residency in UK healthcare is not a setting. It is an architectural discipline. The earlier that is treated as a constraint rather than a checkbox, the less expensive it becomes to get right.