AWS Public Sector Blog
Data ingress and egress through Trusted Research Environments and other secure enclaves
If your institution controls sensitive data, you know that trust is your most important asset. At Amazon Web Services (AWS), we have seen requests for collaboration using sensitive datasets grow in number and complexity as more value is unlocked through novel research techniques and cutting-edge research topics. Enabling this collaboration while making sure requests for data transfer are appropriately reviewed helps you maintain trust with your data owners and meet compliance obligations. Failure to protect sensitive data can lead to a loss of trust, damaging your ability to continue using that data for research and other critical purposes.
Data Review & Transfer Component (DRTC) on AWS provides a seamless solution to review, approve, and automate sensitive data transfer requests into and out of secure enclaves. In this post, we take you through the benefits of using DRTC to review data and other research artifacts for sensitivity prior to transfer into and out of these secure environments, in particular Trusted Research Environments (TREs). TREs play an important role in enabling secure collaboration on sensitive data across industries. As the demand for cloud-based TREs grows, organizations face the challenge of deploying these environments while enabling strict data governance and compliance.
Note: Recently, several standards have arisen for the design of trusted, collaborative environments using sensitive data. These all agree on the need for secure data transfer into and out of environments, with robust review and approval processes to protect sensitive information. Examples include the Standard Architecture for Trusted Research Environments initiative, UK-National Health Service (NHS) accreditation for secure data environments, the European Health Data Space (EHDS), the U.S. National Institutes of Health (NIH) Policy for Data Management and Sharing (DMS), and the U.S. Food & Drug Administration (FDA) Electronic Submissions Gateway. You can learn more about TRE and related concepts in the blog post Integrating Research and Engineering Studio in Trusted Research Environments built on AWS. |
Architecture highlights
The architecture of DRTC leverages serverless services (where possible) to provide a scalable, low-touch, and low-cost design, all of which can contribute to the overall agility and competitiveness of your organization. The DRTC solution follows these high-level steps:
a. Data owners authenticate and initiate a data transfer request from a source location they own to a destination they have permission to access.
b. Serverless AWS services, such as AWS Step Functions and AWS Lambda spin up in real time to orchestrate and process your workflow.
c. After a transfer request is initiated, data is first moved to an Amazon Simple Storage Service (Amazon S3) quarantine bucket where it can be inspected both automatically and manually according to your organization’s compliance needs.
d. When the request is approved, AWS DataSync securely transfers data to its final destination.
e. Throughout the process, system performance and API activity is logged in Amazon CloudWatch and AWS CloudTrail for audit purposes respectively.
The following diagram shows the high-level architecture of DRTC.

Figure 1. Architectural diagram of DRTC. The major components are Amazon S3 buckets, AWS Step Functions, AWS Lambda, AWS DataSync, and Amazon CloudWatch.
Configure compliance needs
Organizational data compliance requirements, such as those set forth by the Five Safes framework and the UK Health Data Research Alliance, are a critical consideration for TREs. That’s why we built DRTC to be highly configurable, allowing administrators to tailor the data transfer review and approval process to their specific compliance needs.
When setting up a storage location within DRTC, administrators have granular control over the review workflow. DRTC supports a two-tier review process with a designated first reviewer and the option to add up to three reviewers. Administrators can assign a specific individual or a group of users, such as a data governance committee. The additional reviewers, if configured, can be drawn from other user groups, for example to draw on subject matter experts to review data manually, or introduce a segregation of duties to further strengthen the control environment.
Automate controls
With DRTC, in addition to manual reviews, administrators can enable automated data checks as part of the transfer approval process. As the volume of data transfer requests grow, manual review processes can quickly become a bottleneck. By automating initial reviews, DRTC enables organizations to scale their data governance capabilities to meet increasing demand, while maintaining or improving accuracy and comprehensiveness.
Secure data transfers
DRTC uses AWS DataSync to facilitate the secure transfer of data. When a data transfer is initiated, the data is first placed in a quarantine location, where it undergoes the review and approval process. After it’s approved, the data is then securely transferred to the destination through virtual private cloud (VPC) endpoints to remain private.
The solution also supports data transfers between accounts. It also supports data transfers between standard AWS Regions and the AWS GovCloud (US) Region, enabling government agencies and regulated industries to move data into and out of their isolated environments.
Visibility and auditability
Throughout the data transfer lifecycle, DRTC provides comprehensive visibility and auditability. Users can track the status of their transfer requests, from submission to final approval or denial. Detailed audit logs capture all actions taken within the system, allowing organizations to demonstrate compliance with regulatory requirements.
Conclusion
DRTC can help organizations building Trusted Research Environments balance the need for effective collaboration with the requirement to protect sensitive information and maintain strict control over data access and transfer. Historically, the ability to collaborate and publish results based on sensitive primary data has been limited by fear of improper disclosure to locked rooms and encrypted physical media. The advent of cloud service providers has opened up new possibilities for secure, cloud-based collaboration on sensitive data. However, this has also introduced new challenges around data governance and compliance. DRTC can help organizations balance the need for effective collaboration with the requirement to protect sensitive information and maintain strict control over data access and transfer.
Currently, DRTC is only available through select AWS partners. To get started, reach out to your AWS account representative or Amazon Partner Network (APN) partner today.