<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Data Residency Requirements — API Reference

## Cloud Resource Location Discovery

```bash
# AWS: List all S3 bucket locations
aws s3api list-buckets --output json | jq -r '.Buckets[].Name' | \
  while read b; do echo "$b: $(aws s3api get-bucket-location --bucket $b --output text)"; done

# AWS: EC2 instances by region
aws ec2 describe-instances --query 'Reservations[].Instances[].{Id:InstanceId,AZ:Placement.AvailabilityZone}'

# AWS: RDS locations
aws rds describe-db-instances --query 'DBInstances[].{Id:DBInstanceIdentifier,AZ:AvailabilityZone}'

# GCP: All resource locations
gcloud asset search-all-resources --scope=projects/<PROJECT> --query="location:*"

# Azure: Resources by location
az resource list --query "[].{name:name,location:location,type:type}" -o table
```

## GDPR Transfer Mechanisms

| Mechanism | GDPR Article | Use Case |
|-----------|-------------|----------|
| Adequacy Decision | Art. 45 | Transfer to country deemed adequate |
| Standard Contractual Clauses | Art. 46(2)(c) | Most common vendor mechanism |
| Binding Corporate Rules | Art. 47 | Intra-group transfers |
| Consent | Art. 49(1)(a) | Explicit, informed, specific |
| Contractual Necessity | Art. 49(1)(b) | Performance of contract |
| Public Interest | Art. 49(1)(d) | Government/public authority |

## OPA Policy Testing

```bash
# Test data residency policies
opa eval --data policy/data_residency.rego \
  --input infrastructure.json "data.compliance.data_residency.deny"

# Run policy tests
opa test policy/data_residency*.rego -v
```

## AWS Region Restriction via SCP

```json
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Deny",
    "Action": "*",
    "Resource": "*",
    "Condition": {
      "StringNotEquals": {
        "aws:RequestedRegion": ["eu-west-1", "eu-central-1"]
      }
    }
  }]
}
```
