This is all rings so true. Why do I have to swipe an access card and display a name badge in my building, when all the important data is outside the building?

This is all rings so true. Why do I have to swipe an access card and display a name badge in my building, when all the important data is outside the building? Why do we factor GDPR into our designs if we don't know where we store the data, and we'll never meet (nor be able to trust) the people who hold onto it for us. Can't we just encrypt it on our side then? I don't think we're getting homomorphically-encrypted relational databases anytime soon. My last month has been an effort of 'migrating' a service from another team to ours. The service stayed right where it was - the cloud - but we sank weeks into editing IAM files and deploy scrips to try to make it 'belong' to our team. We're programmers; we don't know about AWS's policies model, security groups or software-defined networking. Whenever I'm forced to interact with AWS I always feel like I'm doing significantly more work than the "managed" selling point of AWS would imply. I know my way around ssh, docker, iptables etc. But I miss having someone in the team whose actual job it is to be good at these things.