Every cross-account role in an AWS landing zone stops at the aws-eusc partition line

Every AWS Region belongs to exactly one partition, each partition runs its own instance of IAM, and AWS describes the boundary between partitions as hard ^[3]. A landing zone is mostly trust relationships. They all stop at that line. Credentials issued in one partition cannot be used against resources in another ^[4]. The role an identity account assumes in a workload account has no cross-partition equivalent, because caller and callee are registered in different IAM instances.

For the case AWS spells out, a CI/CD system in a commercial Region deploying into EUSC, the guidance is to integrate at the network or API layer with separate credentials for each partition ^[8]. Cross-partition trust is not on offer ^[8]. The pipeline ends up holding two credential sets and calling eusc-de-east-1 endpoints as an external client.

The post says one organization, one logging account, one identity source and one billing roll-up are each achievable within a partition, and that EUSC gets an independent landing zone mirroring the commercial operating model ^[7]. Four centralised components in each of two partitions is eight ^[14].

The code change is small. It lands in every module that ever wrote an ARN out by hand. AWS's Terraform and CloudFormation examples build the ARN from a partition value resolved at deploy time, and the guidance is not to hardcode arn:aws ^[9]. The same pattern is presented as working unchanged across aws, aws-us-gov and aws-eusc ^[9].

The most useful thing in the post is its own labelling. It marks which behaviors are platform boundaries of a sovereign partition and which are configuration choices you can adapt, and maps the design to the AWS Security Reference Architecture and the Well-Architected Framework ^[11]. Billing roll-ups, SSO, cross-account roles, Direct Connect and image distribution are the questions AWS says the boundary settles, with the practical differences set out in a table ^[10]. A companion post covers alignment with C5:2020 criteria and an independent assessment report on AWS Artifact ^[12].

How much of that mirror is worth building depends on how much runs in aws-eusc. The model assumes an operator wants the commercial operating model reproduced inside aws-eusc ^[7]. For a two-account EU estate, most of that structure is overhead carried so the audit story reads the same on both sides. For an estate that has to stay inside the EU, the duplication is the cost of the boundary AWS drew, and AWS describes that boundary as hard ^[3].