Choosing an EU server region means absolutely nothing if you don't hold the keys

[u/EnthusiasmRoutine]

Half the people I talk to think they solved data sovereignty because they clicked "Frankfurt" in their AWS console.

It is a complete joke. Physical location of the drives does not equal legal sovereignty. If you use an American cloud provider and they manage your encryption keys, a judge can force them to hand over those keys. End of story. Encryption at rest just stops rogue admins from snooping. A court order easily bypasses it.

If you want actual sovereignty, you have to run your own external key management. Keep the metadata locally too.

ETA: yes this is a massive headache to configure, but what is the alternative?