The announcement went up at the end of September and mostly got the weekend-it-was-slow treatment of policy blogs. Its date is what makes it live again: on Saturday, October 24, the AWS European Sovereign Cloud (ESC) runs for several hours with no connection to the AWS Global Network backbone.

The drill, as announced

The facts, straight from the AWS Security Blog:

  • For several hours, the ESC will not use the AWS Global Network backbone — the private network that moves authorized AWS operational data between AWS locations without touching the public internet. During the exercise, that traffic reroutes over the public internet, using "dedicated internet connectivity from European internet service providers."
  • In standard operation the ESC touches two global systems: the backbone, and a dedicated transfer system controlled and supervised by the local EU team — vetted source-code mirroring and software updates flowing in, "very limited and approved routine information" flowing out. During the exercise the transfer system is disabled entirely.
  • The operations team is "composed entirely of EU residents within the EU" and executes the exercise "using only the hardware and software resources of the AWS European Sovereign Cloud."
  • AWS warns customers of brief disruption at the edges — routing convergence when traffic moves onto the EU ISP links and back. AWS Direct Connect is unaffected. Other AWS regions are unaffected.
  • Context for anyone who has not followed the ESC: Brandenburg, Germany; physically and logically separate data centers; a local in-EU copy of the source code; customer content and customer-created metadata stay in the EU; operated exclusively by EU residents.

AWS frames the exercise against the objectives of the European Commission's EU Cloud Sovereignty Framework and the criteria of the "C3A" framework from Germany's BSI, says it will produce "verifiable technical and operational evidence," and promises an update after the exercise to regulators and customers. The evidence feeds an ESC compliance package — the Sovereign Reference Framework — for public-sector buyers.

What is actually being tested

The scope is narrower than the framing invites, and reading it correctly is most of the work. This drill targets AWS's own operational dependency surface: the control and data path its operations run on (the backbone), the software supply path (code mirroring, updates), and the outbound telemetry path (the transfer system). That is the right surface to drill. The EC and BSI sovereignty frameworks grade whether an operator's administration can run without foreign infrastructure — not whether your office's VPN tunnel holds up. Direct Connect stays up deliberately: nobody's workload is being asked to survive without the connectivity it normally has, because that is not what those frameworks measure.

So if you read the announcement as "your EU workloads have been proven to run without US involvement," you have over-read it. What gets tested is the operator's runbook, one Saturday, on announcement, against the operator's own dependencies. That is a real thing to test — the August sovereignty-washing post documented the alternative genre, where "sovereign" means a GmbH with German staff and euro billing, and the parent company's jurisdiction never enters the picture. AWS's drill blog, to its credit, does not claim what the marketing decks might later claim for it. It says independence: no critical dependencies on non-EU infrastructure. It never says immunity.

What it cannot prove

Three gaps, in descending order of importance.

The legal layer is not on the test. The ESC is still an offering of Amazon's group — a US parent under the CLOUD Act, which reaches US providers through control, not geography. That is the argument this site made about AWS GmbH in August and, five days later, about Palantir's authorization layer: whoever holds the control layer decides who reaches the system, and no amount of European hardware changes who holds it if the legal chain terminates in Washington. No network exercise touches FISA Section 702, a CLOUD Act order, or an MLAT. Two entirely different questions get conflated the moment the word "sovereign" appears: can it run without foreign infrastructure (drillable, and being drilled) and can it refuse a foreign court (not drillable by any network exercise, and untouched by this one). The Saturday result, whatever it is, answers only the first.

It is self-graded. AWS chose the window, engineered the failover, wrote the runbook, and will write the grade. The update goes to "regulators and customers" — notice, not to the public. "Verifiable technical and operational evidence" means verifiable within a package AWS assembles. Nobody outside AWS has defined in advance what artifacts will exist, what timestamps they will carry, or who may inspect the raw material. The Netherlands government cloud field note in September: the value there was not that the government had a plan, it was that it published the blueprints. The ESC exercise produces the plan-plus-runbook equivalent. Whether the public gets blueprints or a three-paragraph blog post is the first thing to watch next week.

One Saturday is an event, not a property. Sovereignty is a condition. A service that ran two hours without the backbone on an announced Saturday, under the supervision of the people who built it, has demonstrated a rehearsed failover. The condition only exists if the failover holds at unannounced times, run by hands other than its authors', with evidence auditors can touch. A drill is a demonstration of capability; repeatability is what converts capability into property. Nothing in the announcement commits AWS to a second one, let alone to an unannounced one.

Why it is still the most interesting sovereignty document in months

Because the genre changed. Every prior artifact this site has taken apart in this space was unfalsifiable or barely falsifiable: brochure claims ("sovereign" as region branding), certification grades (attestation levels that never resolved who could be compelled), control-layer descriptions (accurate analyses of who holds the authorization layer). The EC built its Cloud Sovereignty Framework precisely "to separate sovereignty claims from sovereignty facts" — and a scheduled, timed disconnect is the first artifact type in mainstream hyperscaler practice that can produce facts. Either the enclave keeps running, or it does not. Either result is checkable in ways a slide deck never is.

The structure of the claim is also more honest than usual. The blog states plainly that the ESC stays connected to the backbone day-to-day because it is better for customers — performance, capacity, DDoS defense — and that independence is a capability held in reserve. That is engineering truth over sovereignty romance. The connected default was precisely the trap in the sovereignty-washing pattern; here it is stated as the design, not hidden behind the adjective.

And the drill names its frameworks. C3A criteria from the BSI. CSF objectives from the Commission. Whatever a skeptical reader thinks of the exercise design, a vendor that says "this drill maps to criteria X and Y, here is the framework, regulators get the results" is playing a different and better game than the one that gave us CADA's four levels and Azure's Germany relaunch.

The bar this sets — for every vendor, including the ones you run

Once one vendor schedules a drill, sovereignty becomes a procurement question with a format. Before you sign any sovereign-tier contract — hyperscaler or boutique — the asks are now enumerable:

  1. When was your last independence drill? Not an audit, an actual disconnect.
  2. Where is the evidence package? Raw artifacts — timings, traffic logs, scope statements — not a summary.
  3. Who witnessed it? An auditor or regulator you can name, with a role in the run, not a testimonial.
  4. Can it run unannounced? If the answer is "we would tell you first," you have learned exactly how much the capability is trusted internally.
  5. What does the drill not claim? The two-questions discipline: operational autonomy versus legal refusability. A vendor that lets its sales force blur them is telling you what its sales force is for.

A vendor with no answer is not necessarily deceiving anyone — it is making claims at the pre-drill level of rigor that characterized this whole market until roughly last month. Now that the level exists, claims below it are a choice.

Copy the drill

The format is not AWS-proprietary. It is the cheapest sovereignty audit that exists, and it runs in miniature on exactly the infrastructure this site keeps advocating — the rack a fire hall owns, the municipal Nextcloud, the co-op's Matrix homeserver:

  1. Define the boundary. What must keep working if the WAN disappears for an afternoon? Answer in writing first: named services, named users, named failure modes.
  2. Announce it, then pull it. Maintenance window, uplinks unplugged or firewalled. A community version can be more rigorous than the hyperscaler's: publish the window, let anyone watch, keep it unannounced the following quarter.
  3. Document what breaks. First drills always find something — the DNS resolver that only exists as an upstream forwarder, the auth token that expires while the SSO sync is unreachable, the backup target nobody can reach, the clock that drifts without NTP. FOSS stacks have one clean advantage here: no license check to phone home. It is a sovereignty feature no datasheet lists.
  4. Publish the note. What was cut, what survived, what broke, the fixes, who stood watch. The demand-side lesson from the Cloudflare subpoena post applies in mirror image: the evidence you publish on your own schedule is worth more than the claim you make in a brochure.

That last step is what turns an untested belief — "we could run offline if we had to" — into an inventory of single points of failure with names attached, and then into fixes.

The Saturday drill will be graded by AWS, witnessed by people AWS chooses, and reported in a form AWS controls. That is exactly what makes it watchable rather than conclusive, and the same is true of every drill any vendor will run this year. Watch what gets published next week: if it is evidence, the genre has moved and the bar is set for everyone. If it is a paragraph with no artifacts, you have a new data point about what "verifiable" meant — and the copy-the-drill section above is the counter-offer.

Sources: AWS Security Blog: AWS European Sovereign Cloud — Demonstrating an independent operation (announced ~September 28, 2026; event October 24, 2026); AWS: the ESC will be operated by EU citizens; AWS ESC Sovereign Reference Framework.