That actually brings up another aspect of AWS architecture, even for global services that depend on us-east-1, AWS separates the control plane (configuration of

That actually brings up another aspect of AWS architecture, even for global services that depend on us-east-1, AWS separates the control plane (configuration of resources) from the data plane (usage of resources). These global services like IAM have regionalized data planes: https://docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/global-services.html#global-single-region-operations https://docs.aws.amazon.com/whitepapers/latest/aws-fault-iso... In a disaster scenario, the data plane operations can continue so customer workloads can still run while the control plane might experience downtime. This is another lesson where in the case of fly isolating the control plane (deployment of services) from the data plane (executing customer code) could have limited the blast radius of this fault instead of using a global cluster manager.