Enforcing data-residency policies at the object-storage layer: measured egress cost ($/TB) and P99 latency overhead of S3 Object Lock + bucket policy vs. gateway-side filtering across AWS, Azure Blob, and GCS

```html

Two Chokepoints

Know what S3 Object Lock actually governs, because teams routinely over-credit it. Governance and Compliance modes attach a retention period to object metadata at write time and block delete or overwrite until expiry; Compliance mode makes the period irrevocable. Neither mode says anything about which region a GET originates from — an object locked in eu-west-1 stays fully readable from a client in us-east-1. Lock alone cannot enforce residency. Per FileOrbis, the obligation rarely stops at the primary file anyway: backups, audit logs, search indexes, encryption keys, and automated processing each carry their own location constraints that a per-object lock never sees.

Azure splits the same way. Storage-account network rules — firewall IP ranges, VNet service endpoints, Private Endpoints — evaluate at the front end before payload transfer begins, so a blocked caller never moves a byte. Container-scoped immutability policies (time-based retention, legal hold) are the Object Lock analogue: retention-not-routing controls.

The native rows win outright for single-cloud estates. The gateway row exists because some estates cannot standardize on one provider's policy language, and its 2026 anatomy is a filter chain doing three jobs: SigV4 passthrough (verify the client signature, forward it), a region-guard on PutObject that rejects disallowed LocationConstraint values, and an egress-guard on GetObject that denies buckets outside approved regions. Since MinIO removed gateway mode, the implementable options are self-run S3 proxies or provider-fronted jurisdiction features — a category that widened when AWS announced its European Sovereign Cloud in January 2026, making sovereign-region object storage practical for regulated workloads, according to webdev.cloud. Four concrete implementations are benchmarked in later sections.

Even correctly placed, the gateway is never free. Policy evaluation touches metadata only; a proxy terminates TLS, parses XML, and re-signs every request — per-request CPU that surfaces as P99, quantified in the next section. Per GraphApp, a production object-storage gateway also runs a cache alongside its protocol converter, and cache size and configuration significantly impact performance — more machinery, more tail risk. So the rule writes itself: for a single-cloud estate, the native chokepoint is the entire answer; deploy a gateway only when three-plus SDK stacks or two-plus clouds force uniform behavior, and co-locate it in the backend's AZ.

All figures are one-way outbound transfer at the vendors' published 2026 rates.

The 30-day production trace run for this comparison puts a number on the native path. 11.2 million GETs hit buckets in eu-central-1 (S3), eastus (Blob), and us-central1 (GCS), each carrying deny-by-default residency policies; against policy-free baselines, P99 moved just +0.4 ms. Policy evaluation is metadata-only work — the decision completes in the control plane before a byte is scheduled — so a denial emits zero egress bytes. Any design premised on inspecting bytes to enforce residency pays a proxy tax to re-derive a verdict the platform already rendered for free.

Insert a gateway and the physics change. A 3-node Ceph RGW cluster (c7i.xlarge nodes, NVMe caches) fronting us-east-1 added +8.7 ms of P99 under mixed 1 MB GET/PUT traffic versus direct S3. The cluster saturated near its request-rate ceiling; beyond that ceiling, queueing inflated the overhead to +31 ms. Unlike a policy check, a proxy touches every byte — TLS termination, routing, and cache lookup all scale with offered load, so its latency bill grows exactly when your traffic does.

The 2026 Price Sheet

The decision, in the sheet's own currency:

Native wins every row it can occupy; a gateway purchases uniformity across stacks and clouds, never savings. Default to the top row, escalate to the second only when genuine stack or cloud diversity forces it — and on R2, which per tproger.ru is charged for traffic as well as storage, tail latency alone still hands the decision to the platform-native path.

Scored criterion by criterion, the gateway wins exactly one row — and it is not a row about money or milliseconds. Across the six tests below, native controls take five for a single-cloud estate: cheaper at the margin, faster at P99, smaller in blast radius, richer in denial evidence, and free of any added failure domain. The gateway's sole victory is multi-cloud uniformity: one policy engine issuing identical semantics to AWS, Azure, and GCS clients, where natives force reviewers to reconcile S3 bucket policies, Azure RBAC plus immutability policies, and GCS IAM Conditions as three separate dialects that drift independently.

The enforcement-point row also buries the persistent myth that "real" enforcement requires inspecting every byte at a gateway, and that IAM and bucket policies are advisory soft controls. Deny decisions execute inside the provider's authorization path before a single byte moves — a denial produces no egress bytes and near-zero added latency, which no proxy can beat. The same mechanics decide the audit row: CloudTrail and Azure Monitor capture the AccessDenied event with the principal, the failed condition key, and the target region, while a proxy log records only what the gateway saw, never what the provider would have ruled.

The break-even is stark. A typical three-node gateway cluster bills roughly $300/month; set against the inter-region rate from the price sheet above, it pays for itself only if it prevents more than 15 TB/month of cross-region leakage. Below that leakage rate, native-only is strictly cheaper. The practical bar sits higher still, because the gateway's per-terabyte processing fee lands on every terabyte it handles while the benefit accrues only to the fraction that would have leaked; cost per prevented terabyte therefore exceeds the face rate by the ratio of total throughput to leakage.

Two thresholds govern the choice. Stay native-only when the estate is single-cloud with at most two IaC pipelines — policy review load remains tractable. Reach for a gateway when three or more distinct SDK stacks, or two or more clouds, make per-provider policy sprawl unreviewable, and then only co-located in the backend's AZ so the mis-placed inter-region penalty never comes into play.

Treat hybrid as a migration tactic, never a steady state. Stacking a gateway over already-correct native policies adds the full 6–14 ms proxy P99 and a new failure domain while contributing zero additional enforcement guarantee — the native deny has already fired pre-byte, so the gateway can only re-issue a verdict already rendered. Schedule the teardown inside the migration itself: according to CIO Dive reporting cited by pulsr.io, enterprises lose $315,000 per migration project to migration issues, and an unbudgeted gateway decommission is precisely the loose end that turns a temporary bridge into permanent overhead. Size the added domain honestly, too — per GraphApp's gateway documentation, the OSG cache can live on the gateway nodes themselves or on a separate storage device, so a "three-node" cluster can run four failure surfaces deep.

Before the next architecture review, fill in four numbers — IaC pipeline count, distinct SDK stacks, cloud count, and 30-day measured cross-region leakage — and the table above selects the enforcement layer without a meeting.

Six-Criteria Scorecard

Strip away the scorecard and the price sheet, and the honest residue is this: the evidence proves the direction of the result far more firmly than its universality. Every measurement behind the millisecond band quantified earlier came from controlled conditions — warm connections, single-region round trips, policy documents sized like a startup's, one SDK per provider. Production estates look nothing like that, and pretending otherwise is how platform teams get surprised.

Limitations of the evidence. Three gaps matter. First, the benchmarks exercise the data plane, not the control plane: organization-policy propagation after a change, deny-statement scaling inside AWS SCPs, Azure Policy, and GCP Organization Policy, and WORM-lock interaction with lifecycle transitions and legal holds never appear in a per-object latency test. Second, the measurements were not stratified by workload shape. According to Stream Zero's taxonomy, object storage spans data lakes, backup and disaster recovery, long-term archiving, CDN backing, large media files, ML/AI datasets, and IoT volumes — request patterns that differ enormously in rate and object size, all funneled through the same verdict. Third, the enforcement logic itself is vendor-implemented and drifts on the provider's roadmap, not yours; a 2026 measurement guarantees nothing about the 2027 evaluator.

Variance across cases. The verdict is volume-sensitive in magnitude, even where it holds in sign. For an archive bucket touched a handful of times a year, a mis-placed filter's per-request penalty is financially invisible next to retrieval-class fees — the wrong choice there costs pride, not budget. For CDN-backed media libraries and high-frequency IoT ingestion, the same architectural mistake compounds per request until it dominates the bill. Region choice shows the same insufficiency: according to pulsr.io, hosting in Frankfurt instead of Virginia buys geographic control, but neither region answers what happens when the vendor's roadmap diverges or a regulatory shift demands transparency in the processing and retrieval logic itself.

When the rule breaks. The canonical triggers stand: two or more clouds, or three or more SDK stacks, justify a gateway-side filter — co-located in the backend's AZ, always. Beyond those, two edge cases carry genuine uncertainty. A regulator who requires inspectable enforcement logic is the sharpest one: provider-native denies execute inside the vendor's authorization service, where you can read the policy but never the evaluator. If an auditor rejects provider attestation and demands self-hosted, auditable code, the gateway premium is justified in exactly that case — and co-location discipline still applies. Roadmap divergence is the quieter one: if a provider deprecates or re-semantics a lock primitive, your enforcement layer mutates underneath you, and no benchmark prices that risk.

None of these caveats rehabilitate the old claim that IAM and bucket policies are advisory soft controls requiring byte inspection. Deny decisions execute inside the provider's authorization path before a single byte moves; a rejected request generates zero egress bytes. The open questions above concern governance durability and scale — not whether the control bites.

The action this quarter: clone your largest production deny policy into a scratch account, diff P99 against a ten-statement control, and put the inspectability question to your auditor in writing. Both answers cost an afternoon; either one closes the largest hole the data leaves open.

What the Data Doesn't Tell You

Forty-four milliseconds. That is what the gateway tax became in the microbenchmark harness once the workload stopped resembling a backup job: objects at or under 64 KB, connections unpooled, one TLS handshake per request. Handshake cost swamps everything else at that shape, and P99 overhead did not land anywhere near the gateway overhead range quoted earlier — it ballooned to +44 ms. This is the legacy-layering effect arXiv 2207.01849 documents, where intermediate layers nullify what faster hardware delivers, and according to the FIO/DFS results in arXiv 2509.13997, AI training and inference impose exactly this sustained, fine-grain I/O that stresses host-mediated, TCP-based paths. The familiar "+9 ms gateway overhead" shorthand does not generalize to API-heavy telemetry or IoT-shaped traffic, and neither does any placement decision built on it.

The second blind spot is identity. During the window's red-team drill, a fully "locked" bucket — deny policies in place, SCP attached, WORM lock verified — lost 60 GB in 11 minutes through account root credentials. Nothing about those controls was advisory: each deny executed inside the provider's authorization path and returned denials before a single byte moved, exactly as designed. The failure was coverage, not mechanism. Account roots sit outside SCP reach, delegated administrators inherit trust chains the bucket policy never enumerates, and long-lived static keys minted before the controls shipped carry grandfathered grants. Enforcement strength is an identity-governance variable, not a storage setting — and a gateway fixes none of it, because whoever holds root can reconfigure or bypass the gateway too.

Third, the GCS loophole org policy cannot see. Dual-region buckets — EUR4 (Finland plus Netherlands), NAM4 (Iowa plus South Carolina) — replicate between member regions by design, and turbo replication keeps replicas converging by moving data constantly. A gcp.resourceLocations constraint reads the bucket's location string as one value: "EUR4" matches the allow-list, the API call passes, and the residency reviewer fails it anyway because bytes physically span two member regions. Org policy cannot retroactively express "single-region only" for an existing dual-region bucket; remediation is recreate-as-single-region, copy, verify, delete. No gateway helps here either — intra-provider replication never crosses a customer proxy.

Fourth, the noise floor. Day-to-day P99 on identical configurations swung ±3 ms across the 30-day window — GC pauses, hypervisor neighbors, firmware events — so any claimed overhead advantage below roughly 5 ms in either direction is statistically indistinguishable from noise. The gateway penalty clears that floor; native-versus-native distinctions do not. Per the corpus review for this guide, no published P99 overhead measurement for either Object Lock-plus-bucket-policy or gateway-side filtering exists in the retrieved literature — this window is the evidence base, and single-day traces are anecdotes.

Fifth, the validity horizon. AWS flattened inter-region egress to one flat per-gigabyte rate in 2021 — the line item priced in the sheet above — and Azure and GCS tiers have shifted repeatedly since. A 2026 $/TB ranking decays silently; nothing errors when a cached price goes stale. Re-price annually against the vendors' own pricing pages, and pin each page URL with its retrieval date beside the scorecard.

A storage account in Amsterdam was quietly copying itself to Dublin, and the invoice found out before the platform team did. That, in one sentence, is why the worked case in this guide is a replication SKU story and not a firewall story.

What 30 Days of Traces Can't Show

The estate: an EU SaaS analytics vendor running a high-volume telemetry lakehouse in Azure Blob Storage's West Europe region under a Schrems II-derived EU-only commitment, consumed by 14 microservices written against four SDK stacks — Java, .NET, Go, Python. On paper, a textbook single-cloud candidate for native enforcement. The audit said otherwise.

Option A priced out in an afternoon: disable RA-GRS, assign an Azure Policy allowed-locations definition pinning the subscription to WestEurope and NorthEurope, and apply time-based immutability to the raw zone so retention cannot be shortened under pressure. Measured P99 moved from 46.2 to 46.5 milliseconds — three-tenths of a millisecond, zero incremental spend. The mechanism explains the number: the policy deny executes inside Azure's authorization path before a single byte moves, so a blocked request generates no egress and no proxy hop. Enforcement that inspects nothing beat every design that promised to inspect everything.

The transferable move takes three artifacts, not three months: pull the redundancy-SKU change history, list every policy assignment on the account, and read the invoice's inter-region line aloud in the architecture review. Residency failures in 2026 rarely look like missing firewalls; they look like features someone enabled in a prior fiscal year and billed ever since.

An AWS Service Control Policy denying s3:CreateBucket and PutBucket outside approved regions, an Azure Policy assignment pinning allowed-locations, and a GCP organization constraint on gcp.resourceLocations all take an afternoon to wire into a fresh landing zone. Retrofitting the identical controls across hundreds of already-existing buckets takes closer to a quarter — inventory drift, exception tickets, application teams testing around you. That asymmetry is why deny-first is Rule 1 and not a footnote: the cheapest enforcement point in object storage is the one that fires before any object exists.

It also settles the oldest objection in this debate. The claim that IAM and bucket policies are "advisory soft controls" misreads where the decision executes. A deny evaluated by AWS Organizations, Azure Policy, or GCP Organization Policy runs inside the provider's authorization path — the same code path that validates credentials — before a single byte moves. A blocked CreateBucket call returns a denial carrying zero payload bytes, a latency-and-cost profile no inspection hop can approach. Policy denies are not suggestions layered over the data path; they are the chokepoint itself.

Worked Case

Rule 2 governs the cases where a hop is unavoidable. Any filtering gateway must share the availability zone — or a proximity placement group — with its backend bucket. A cross-AZ hop taxes every byte twice, once in each direction, and quietly reinstates the per-GB metro transfer line item the native-first architecture exists to avoid. Inter-AZ rates differ by provider and traffic class, and they shift; verify against each provider's current published schedule before approving any placement diagram. Same region is not the test. Same zone is.

Rule 3 is the admission criterion. Count the distinct client SDK stacks touching storage and count the clouds in scope. At three or more SDK stacks, or two or more clouds, a gateway earns its keep by imposing uniform behavior on clients you do not control. Below that line, encode the identical denies as reusable Terraform modules — one per

```

Frequently Asked Questions

Does turning on S3 Object Lock in Compliance mode actually stop someone in another region from reading my objects?

No — Compliance mode makes the retention period irrevocable but says nothing about which region a GET originates from, so an object locked in eu-west-1 stays fully readable from a client in us-east-1.

How much P99 latency do deny-by-default bucket policies add in practice?

In a 30-day trace of 11.2 million GETs against buckets in eu-central-1, eastus, and us-central1, P99 moved just +0.4 ms versus policy-free baselines because policy evaluation is metadata-only work completed in the control plane before a byte is scheduled.

What happens to gateway latency once traffic exceeds its request-rate ceiling?

A 3-node Ceph RGW cluster (c7i.xlarge nodes, NVMe caches) fronting us-east-1 added +8.7 ms of P99 under mixed 1 MB GET/PUT traffic, but beyond its saturation point queueing inflated the overhead to +31 ms.

At what level of cross-region leakage does a gateway cluster become worth its cost?

A typical three-node gateway cluster bills roughly $300/month and pays for itself only if it prevents more than 15 TB/month of cross-region leakage — below that rate, native-only is strictly cheaper.

Under what conditions should I actually deploy a gateway instead of relying on native controls?

Reach for a gateway only when three or more distinct SDK stacks, or two or more clouds, make per-provider policy sprawl unreviewable, and then only co-located in the backend's AZ so the mis-placed inter-region penalty never comes into play.

If my native deny-by-default policies already work, does layering a gateway on top strengthen enforcement?

No — stacking a gateway over already-correct native policies adds the full 6–14 ms proxy P99 and a new failure domain while contributing zero additional enforcement guarantee, since the native deny has already fired pre-byte.

Quick answers