Running Cloud Infrastructure Under DORA: AWS, Azure, and GCP Compliance Guide

Running financial workloads on AWS, Azure, or GCP under DORA requires specific infrastructure configurations that go beyond the cloud providers' standard security baselines. Here's a practical guide to DORA-compliant cloud infrastructure.

Shared Responsibility Under DORA

DORA doesn't accept "that's the cloud provider's responsibility" as an answer. You are responsible for your ICT risk management, regardless of deployment model. The cloud provider may be designated as a critical third-party, but your obligations remain.

DORA-Required Cloud Configurations

Identity and Access

• MFA enforced for all human access — no exceptions
• Service accounts with minimal privileges, regularly rotated credentials
• Just-in-time access for production environments (AWS IAM Identity Center, Azure PIM, GCP PAM)
• Cross-account/cross-project isolation for production vs. non-production

Data Protection

• Customer-managed encryption keys (AWS KMS, Azure Key Vault, GCP Cloud KMS) — not provider-managed
• Key material in HSMs with FIPS 140-2 Level 3 certification
• Data residency enforcement — EU-only regions for regulated data
• Automated data classification and DLP policies

Network Security

• Private endpoints for all managed services — no public internet exposure for data plane
• Network segmentation with security groups and NACLs/NSGs
• Traffic inspection and logging (VPC Flow Logs, NSG Flow Logs)
• DDoS protection (AWS Shield Advanced, Azure DDoS Protection, Cloud Armor)

Logging and Monitoring

• Centralized logging with tamper-proof storage (CloudTrail with integrity validation, Azure Monitor with immutable storage)
• Real-time security monitoring with automated alerting
• Minimum 5-year retention for audit logs
• Cross-region log replication for resilience

Cloud Exit Readiness

DORA requires exit strategies. For cloud infrastructure: maintain Terraform/IaC that's portable between providers, avoid proprietary services for critical functions, test migration procedures annually, and keep data export capabilities validated.