ThreatClaw · Investigation Playbook

Compliance: Les données doivent être stockées et traitées dans l'Union européenne

OPA / RegoRule eu_data_residency

  1. Confirm the non-compliance

    Control: **Les données doivent être stockées et traitées dans l'Union européenne** (category: compliance). Platform(s) / resource(s): config, iac. Severity: **medium**. Verify the infrastructure resource genuinely violates the control and that it is not a documented, accepted exception.

  2. Compliance frameworks impacted

    • Required directly by: ReCyF

  3. Blast radius (scope)

    Search for the same non-compliance across other resources of the same type in the IaC and the cloud estate: a misconfiguration is rarely isolated.

  4. IaC remediation (informational, HITL)

    ⚠️ No automatic action. Fix the configuration at the source in the infrastructure code (Terraform / CloudFormation / Kubernetes manifest / ARM) per the control, then re-evaluate with the policy engine (OPA) after the fix. Human review required.