So Dave, great to have you here.
Great to be here.
So Dave, who are you?
So Dave Brown, I lead the EC2 organization, that's the Elastic Compute Cloud.
I've been on that team now for a little over 15 years.
So started out as an Engineer writing code in the very early days of EC2,
and kind of just stuck around.
And have the privilege of leading the team,
which is all our compute and networking services at AWS.
Can I say that you have been a fantastic partner?
Thank you.
Since I joined AWS.
It’s been a lot of fun to have you on the team.
Loved you spending this proportion of time following our customers in Telco.
Absolutely.
Especially along the digital sovereignty.
So Dave, I’ve seen the blog,
what is that AWS is saying in our blog around digital sovereignty?
Yeah, so we've been looking at digital sovereignty honestly
in a lot of detail for about the last three years in earnest.
But I really take our digital sovereignty story all the way back to 2008.
And so it's been something we've been focusing on for a long, long time.
In the early days, we maybe didn't even realize we were doing it.
We were really optimizing for security and availability.
But those have all become such critical things
when you start thinking about digital sovereignty.
So about six months ago, we put out a blog called Our Digital Sovereignty Pledge,
which really says that AWS is going to be sovereign by design.
That’s what we’re going for.
We want to make sure that what we bring from a digital sovereignty and a data
sovereignty point of view still gives customers
the richness of the cloud, the functionality of the cloud,
gives them control over their data, which as I said earlier
isn't far off from what we've been doing since the very early days of AWS.
But the blog post really outlines how we are approaching the challenge
and how we're looking to solve it on behalf of our customers.
Super interesting.
And I found it really insightful having conversations with you, with our customers.
So should you recap, which are the key tenets
that we have used shaping our approach digital sovereignty along the years?
I mean, you have been here since ever.
Yeah.
So which had been the key decisions that made us sovereign by design?
Yeah, I think
one of the very early decisions that we took, as I said, was back in 2008.
And at the time people were still trying to get their head around the cloud.
Is the cloud going to work?
Are we going to be able to move our data centers to the cloud?
Is that actually going to work for us?
And middle of 2008, we actually had an event with S3.
And S3 was one of the very early AWS services.
EC2 was only in our US East one region, there were no other regions.
And S3 actually had an event, it was a Sunday afternoon,
I remember it well, and you can still go read about it today
if you search on the internet for July, 2008, AWS.
But what happened is we actually had, S3 used to share
information between three locations, so Virginia, Seattle, and Dublin.
And when you created a new file in S3 or object in S3, it would actually use
the thing called the Gossip Protocol.
It would actually gossip between those three locations.
And we had a router on the east coast of the US
that would just flip a bit every now and then.
It was a broken router, we didn't know it was broken.
And over a period of a few hours, S3 started to tell everybody that the file
didn't exist because this key store that it was gossiping about became unavailable.
And the way we fixed it as you fix everything is we turned it off
and back on again.
And that recovered S3 for that day.
But what we were doing at the same time, was we were trying to design
what the second region for EC2 would look like, and ultimately for AWS.
And that was going to be Dublin.
And prior to that event,
we thought everything was going to be just one big global cloud,
very similar to what all of the other cloud providers do today.
A lot of functionality centralized, and a lot of the other regions
will continue to use that.
And we came into the office on that Monday
and we said, we have to completely change our strategy.
Because if we are sharing data between regions, we cannot guarantee
that those regions won't fail for the same reason at the same time.
And what was amazing about that decision, is it's meant over
the years we've actually built our regions to be very, very isolated.
So when we put down a new region, if we just put a region in Melbourne
a couple of weeks back, we did Switzerland, we've done this year
in Spain recently as well.
Those regions are complete AWS footprints of a region.
And so it allows our customers, or you fast-forward to today,
and from a digital or data sovereignty point of view, customers
know that the services that they're using and that the data that they're storing
is always going to be local to that region and that geography.
And so it aligns very well with what regulators have been looking for.
Yeah, amazing.
I think these are the key milestones
that you need to go through while you scale managing complexity.
I think there is one of the reasons why we said that there is no compression
algorithm to the experience, right? [Dave] Yes.
[Fabio] You need to clash against the wall sometimes to listen and understand.
And that's even been true today in how we think about digital sovereignty, right?
And one of the reasons we went out with the pledge
and not a solution, we've seen others come out with solutions,
is they're very hard to come out with a one solution.
Because we have to look at how is a country, or a regulator
in the case of Telco maybe, defining digital sovereignty
and how does that fit with what AWS has to provide?
What do we have to do to innovate on behalf of our customer?
What is our customer going to have to do and how are they going to have to change?
And maybe in some cases, regulators change as well as they learn about services
on our side like Nitro for example, and just the level of data protection
that provides.
We've even seen regulators change some of the strategy
when they really understand what we do from a security point of view.
So it's a journey.
It's not just checking tick boxes.
But the pledge really says
that AWS is committed to providing digital sovereignty for our customers.
In an ever-changing world that's changing faster
than we've ever seen it change before, we’re committed
to working with our customers, working with regulators, and bringing our richness
of services into these regulated environments.
Again, for me, it was amazing one month ago
when we spent that one week just traveling Europe.
With you listening to regulators and customers,
what is that you have learned in this
very intense interaction that you have had in the last months?
I think the first thing to acknowledge is digital sovereignty is definitely
something that is very important to countries
and it's not something that anybody should be writing off.
There's a very clear reason as to why they want digital sovereignty
and why they need sovereignty and digital data sovereignty as a country.
The second thing is I think there’s still a lot of uncertainty out there
as to exactly what’s going to be required and how that’s going to work.
And as AWS, we’re
really working very hard to bring a lot of clarity into these situations.
In many cases that's happening behind the scenes.
We are working very closely with regulators.
And again, as I said earlier, it's really empathizing,
understanding what they’re trying to do,
and then trying to make sure that the cloud solutions we have solve
the outcome that they're looking for, but also educate them
in the way that the cloud works.
And so it's very much us innovating, regulators understanding what we have,
and then ultimately delivering what the customer needs.
And it's also working closely with our customers and ISV’s and Telco’s.
In many cases, we have customers that are owning part of the digital
sovereignty experience for their end customer as well.
The customers are going to be using the Telco in a certain country.
And so, together with our technologies like our regions, our local zones,
even our outposts, all bring certain types
of digital sovereignty solutions that customers can deploy.
Great to hear.
You know, you mentioned Nitro as a, let me say, a moment of innovation where
we are invented the hypervisor technology essentially having sovereignty in mind.
Yeah.
Can I say that?
Now, should you mention the key functionality and control functions
that we can provide today to our customers to be compliant
with the most stringent requirements
in terms of digital sovereignty, what would you say?
Well, actually that's another key milestone for us.
I spoke about availability about regions and isolation earlier.
But Nitro was probably one of, it has to be the next massive step we took.
At the time, digital
sovereignty, again, we were designing for security and availability.
We were designing
very much for data separation to ensure that us as a cloud provider
don't have access to customer data or can't gain access to customer data.
And so when we initially started off designing Nitro to really solve
some of the latency problems we were seeing,
and then when we got to designing all parts of the system and rethinking how
the hypervisor worked, we started to think about, well, how do we make sure
that we just have a level of security here that would never have been achievable
with a software-based hypervisor?
And even first Nitro instance, the very first Nitro instance
launched in 2012 and the full 100% Nitro instance where
every single part of that machine used Nitro as its system was launched in 2017.
And today, we’re still the only cloud provider that has anything like Nitro.
Yeah, that’s amazing.
But from a security point of view, it’s
a very strong separation between AWS and customer data.
All customer data is encrypted at rest with a key that exists only
for the lifetime of the instance.
It’s never known to any system.
The other thing is everything is validated and attested.
So when a machine boots,
we actually make sure that every single component in that system
is exactly as it should be.
That includes hardware as well as software and firmware.
Has it been signed correctly?
And if any of that is found to be incorrect,
we won't actually allow the server to boot up.
And then the final thing is we actually, we never built a command prompt,
so there’s no shell, there’s no SSH.
And it was really at the time, I remember people saying, “Well,
how are we going to run the system if I can’t log into the system?”
And I think that's a mentality that certainly other cloud providers
still have is if something goes wrong, you have to log in and debug or get logs.
And we just said to ourselves, well, that's not how we're going to operate.
And so we are never going to be able to access the box.
If we need telemetry, it's going to be stuff that we can
read off metrics that came off the machine or sanitized logs
that came off the machine.
All APIs are encrypted and signed as well and deeply authenticated.
And so from a security point of view, it really raises the bar on security and
honestly solves a lot of the challenges that customers have.
Nitro also was the very early stages that ultimately led us
to graviton memory encryption as well, which is another hugely important feature
for digital sovereignty.
And it's refreshing, the moment that we pitch the Nitro value proposition
to our customers, it's a kind of eyes opening moment for all of them.
So I think this was another key fundamental milestone.
Where we have taken the right decision following the right tenet
to be digital sovereignty by design.
Yeah, absolutely.
Now maybe last question. [Dave] Yeah.
[Fabio] So again, you have spent so much time with me, with my team.
Yeah? [Dave] Yeah.
[Fabio] Talking to Telcos, Orange, Deutsche Telekom,
Telia, Telenor and I’m for sure forgetting some of those.
And I have in mind the wonderful example of Deutsche Telekom T-systems that last
Mobile Congress launched the fully managed data protection service on AWS.
So the question is, what do you think could be the role of Telcos
within the digital sovereignty area?
What kind of role?
I think it's an excellent question,
and it's been a lot of fun working with you and the team.
As you know, I did think you were crazy when you started.
I probably still do.
But bringing the very early Telco ideas to me and saying, “How
do we solve these problems?” And some of those are really hard challenges.
Outposts came out of some of those early interactions,
and we've really actually driven a lot of innovation in AWS
through Telco requirements.
And I think that's going to be an area
of just incredible innovation for us going forward.
And it's really sort of forced us out of our regions
and into the edge with local zones and outposts and all this other technology
we’re doing now.
So it's been a lot of fun working with you.
On the question, though.
I think in many countries, one of the things we see from regulators
and governments is that they want a local entity
to be able to stand surety or to be able to attest.
The other word we use is custodian.
And so Deutsche Telekom is a great example of that.
And the use case there was really key management.
And what the regulator wanted was that a German-based entity
had control of the keys and that it wasn't AWS managing the keys.
The feature we actually launched for that, which went public at re:Invent last year,
is called XKMS, which essentially means
that Deutsche Telekom, in this case with an HSM, can actually manage
the keys, the key material, all the APIs that we need to use
to be able to get an encrypted block back to do things like EBS encryption.
Or any part of AWS that requires encryption is actually going
to a Deutsche Telekom-managed system.
Now, there's nothing...
Deutsche Telekom is a fantastic partner,
but other Telcos could do a similar thing and implement that.
It’s just a feature that we have where the key management can be done externally.
I also think that that list, that's
a great example of key management, there’s going to be a list of other things.
Some of those are going to be common amongst countries.
Some of those are going to be specific to certain
geographies and regulatory requirements,
but we look forward to partnering with Telcos
and have them be a custodian in these countries
on behalf of AWS for the end customer, for some of these workloads
where that might be required.
You know what, Dave?
I think I really want to thank you for the fun that we had
while seeking the truth.
Yeah.
I think the beauty has been just to ask the wrong and the right questions,
but always challenging each other and listening to what our customers want and need.
Really, thank you for the thought leadership
that you brought in this super difficult area.
I think we are digital sovereign by design.
Yeah, absolutely agreed. Thank you Fabio.
Thank you.