The October 20 field note ended with a prediction made on the record: watch what gets published after the Saturday, October 24 disconnect. If it is evidence — raw artifacts, timings, scope statements — the genre has moved and the bar is set for every vendor. If it is a paragraph with no artifacts, you have a new data point about what verifiable meant, and the copy-the-drill checklist is the counter-offer.

At 03:37 UTC on November 2, AWS published the results post. It is the second branch. Below is the grading against the scorecard that post set, what actually shipped, and why the gap between the two is precisely the space where community infrastructure can beat the market leader.

What shipped

The post is written by Stéphane Israël — the ESC managing director who, together with co-director Stefan Hoechbauer, called the exercise. Author and grader are the same person. Its operative claims, in full:

  • Both global systems were switched off for several hours on October 24 — the AWS Global Network backbone and the dedicated transfer system — matching the scope announced in September.
  • Backbone traffic rerouted "securely over the public internet."
  • Workloads kept running, customers could still access their data, and there was no availability impact on the ESC, other AWS regions, or Direct Connect.
  • When it ended, "traffic returned to its normal path."

That is the whole technical record. No convergence duration. No reroute timings. No traffic logs. No runbook. No scope-statement document. No statement of what was instrumented, or by whom. The words "verifiable" and "evidence" appear four times; an artifact appears zero times.

Two sections follow the narrative. Why we ran it says transparency is at the core of AWS's sovereignty commitment and "the exercise produced verifiable technical and operational evidence... It turns a design claim into a verified result." What customers and partners are saying fills the rest with four quotes: Capgemini, Atos, Genesys, Accenture.

And then the sentence that turned a good week into a teachable one: "The AWS European Sovereign Cloud can operate independently at any time."

Grading the five asks

The October 20 post listed five questions to put to any vendor that had run a drill. Grading the results post against them:

1. When was your last independence drill? — Pass. October 24, announced in advance, apparently run as described. This remains the part that separates AWS from every vendor still using a brochure.

2. Where is the evidence package? — Fail. This was the ask the whole exercise was judged on, and it is the ask the results post does not even name. No artifact, no location, no ID, no commitment to publish one. It is possible raw evidence landed inside the Sovereign Reference Framework console package that AWS assembles for public-sector buyers — but the public results post does not say so, and a gated package selected and assembled by the operator was exactly the form of "verifiable" October 20 predicted would not be enough. Whether the artifacts exist somewhere unseen or were never instrumented is not knowable from outside, which is the definition of an unverifiable claim.

3. Who witnessed it? — Fail, instructively. No regulator, no auditor, no third party. The announcement mapped the drill to Germany's BSI C3A criteria and the EC Cloud Sovereignty Framework and promised an update to regulators and customers. The results post names neither framework and neither regulator. The four testimonials that fill the space are more revealing than a witness list: every named company is an AWS ecosystem partner — one of them, Atos, identifies itself in its own quote as "a Launch Partner of the AWS Digital Sovereignty Competency." These are companies whose revenue depends on selling migration onto this cloud. They are customers of the claim, not witnesses to the event. The scorecard said: "An auditor or regulator you can name, with a role in the run, not a testimonial." Four testimonials arrived. The audience for the October 24 event was customers and regulators; the four people quoted are neither.

4. Can it run unannounced? — Not addressed. Nothing commits AWS to a second drill, let alone an unannounced one. Asked point-blank by the scorecard — "if the answer is 'we would tell you first,' you have learned exactly how much the capability is trusted internally" — the results post declines to answer, which is an answer.

5. What does the result not claim? — This is where it gets worse than silence. The September announcement did not claim immunity and did not claim permanence. The results post claims "can operate independently at any time." A four-hour announced failover, run by its own authors, with no published instrumentation, establishes none of that. October 20 spent three paragraphs on this exact trap: one Saturday is an event, not a property; the property only exists if the failover holds at unannounced times, run by hands other than its authors', with evidence auditors can touch. The results post converts the event into the property in a single sentence — and then, for assurance value, offers the narrative to buyers: organizations "can take this result to regulators and their boards as evidence for their compliance and assurance documents." Take what to a regulator? A blog post written by the person who ran the exercise, describing an exercise nobody outside observed, asserting a property one exercise cannot establish. That is not evidence; that is a press release with the word evidence in it.

The fair read

None of this subtracts from the thing AWS did well. The drill was announced with a date, run on the date within the announced scope, and reported with a verdict in nine days. A trillion-dollar infrastructure operator publicly disconnected its flagship sovereignty region from its own global backbone and said so afterward. Every other sovereign claim in this market is still unfalsifiable marketing; this one went to the trouble of being falsifiable before it was success-claimed. October 20 called that "a better genre of sovereignty claim, because a drill is at least falsifiable." That judgment stands.

But the genre moved halfway and stopped. Claims became events — that step is now proven. Events became reports — that step is now proven. Reports did not become artifacts — that step has a name attached to it now, and the name is on the most rigorous sovereignty document the hyperscaler market has produced. The failure is not that AWS ran a drill and graded it; the failure is that grade was the whole offering, and the evidence layer that makes the grade credible was the one part left undone.

There is a pattern worth naming. The announcement was written for regulators — frameworks named, criteria mapped, evidence promised. The results were written for sales — success asserted, partners quoted, "at any time" added on. Whoever wrote each document knew exactly who it was for.

The counter-offer, sharpened

The October 20 post closed with a checklist for running the same drill on a community scale — a fire hall's rack, a municipal Nextcloud, a co-op Matrix homeserver. It still stands. But the results post adds something the checklist did not anticipate: the hardest part of the copy-the-drill format turns out to be the part that costs nothing.

The artifacts AWS did not publish are the artifacts every community drill produces as waste product. When you cut the WAN on your own stack:

  • The service probes log timestamps. systemd and your monitoring already journal events; a drill note is three lines of journalctl cut-and-paste with times attached.
  • The routing change is visible. Before/after ip route on a router, or a conntrack/ping tranche during the window — plain text, two minutes of terminal work.
  • The failures have names. The DNS forwarder that dies off-WAN, the auth token that expires out of reach of the SSO sync, the backup job that silently points at a now-unreachable target — a drill finds them, and each one is one sentence in a public note.

Raw, honest, unpolished evidence is the one kind a community can produce at zero budget and the one kind the market leader left out. That asymmetry is the whole point. The sovereignty genre now looks like this: AWS announced a drill, ran it, reported success, and stopped one step short of the finish line. A community that announces a window, pulls the wire, journals what survives, and commits the artifacts — signed, dated, unedited — has now produced the most complete sovereignty evidence package in its market too, with no trillion dollars in sight. Publish the note. Attach the logs. That last step is where the genre actually moves, on any budget, and as of November 2 it is a step nobody in the hyperscaler market has publicly taken.

What goes in the procurement notebook now

One line gets added to the October 20 ask-list, and one line gets a permanent definition.

  1. "Show me the artifacts, not the quotes." A vendor that reports a drill with customer testimonials has run an event and marketed it. A vendor that reports a drill with named artifacts — log ranges, measurement methodology, who instrumented it, where the package lives and who may read it — has run an auditable event. The difference between those two documents is now demonstrated, by the same operator, in the same product, nine days apart. Any buyer can now see both genres side by side.

  2. "At any time" is a property claim, and property claims need properties-grade evidence — repeatability, unannounced runs, independent instrumentation. When a sales deck says can operate independently at any time, the exact question is: when has it done so on a schedule it did not choose, and who measured it? If the answer is a Saturday the operator picked and a post the operator wrote, the deck is asserting an event twice.

The drill format itself is still the best thing in this market — it produced a falsifiable claim, which became a success narrative, which is more than every sovereignty brochure ever produced. The artifact layer is where it stopped. That layer is unpatented, unowned, and free. Somebody will figure out that attaching it is the moat. On the evidence of November 2, that somebody is not going to be the incumbent — and a community that attaches its artifacts to its failures is, from tomorrow, ahead of the market leader.

Sources: AWS Security Blog: Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation (published November 2, 2026, 03:37 UTC, author Stéphane Israël); AWS Security Blog: the independence exercise announcement (September 2026, event October 24, 2026); this site's October 20 scorecard.