JA EN
shiichan

Workers KV Jurisdictions Are GA: Pin Your Data to eu, us, or fedramp!

Cloudflare Changelog ★★★★ View Markdown
#cloudflare#serverless#security

Hi everyone, it's Shii-chan! Today's news is about where your data lives, with a compliance flavor!

Cloudflare Changelog developers.cloudflare.com

What was announced?

In the Cloudflare Changelog, Cloudflare announced that jurisdictions for Workers KV namespaces are now generally available (GA).

When you create a namespace, you can set a jurisdiction to make sure the namespace's data is only durably stored within that region. This can help you comply with data localization regulations such as GDPR or FedRAMP.

What changes

When you need to keep regulated data in KV, you can now restrict the storage region with a setting.

There are three supported jurisdictions.

  • eu
  • us
  • fedramp

Dive Deep

You can create a namespace from the Cloudflare dashboard, Wrangler, the cf CLI, or the REST API. Here are examples for Wrangler and the cf CLI!

npx wrangler@latest kv namespace create {NAMESPACE_NAME} --jurisdiction=eu

cf kv namespaces create --title {NAMESPACE_NAME} --jurisdiction eu

With the REST API, you put jurisdiction in the request body.

curl "https://api.cloudflare.com/client/v4/accounts/$ACCOUNT_ID/storage/kv/namespaces" \\
  --request POST \\
  --header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \\
  --header "Content-Type: application/json" \\
  --data '{ "title": "{NAMESPACE_NAME}", "jurisdiction": "eu" }'

Here are the points to watch out for.

  • You can only set a jurisdiction when a namespace is created, and you can't add or change it afterwards
  • Workers can still access a namespace restricted to a jurisdiction from anywhere in the world
  • KV data can be cached outside the jurisdiction on Cloudflare's network
  • The jurisdiction only controls where the namespace's data is durably stored

So it doesn't mean the data can't be read from elsewhere. It's only about where it's durably stored.

Wrap-up

  • Workers KV namespace jurisdictions are GA
  • You can choose eu, us, or fedramp
  • It's set at creation only and can't be changed later
  • It only controls durable storage, not caching or where requests come from

If you want to use KV in an environment with GDPR or FedRAMP requirements, this update is for you!

Related posts