High availability & DR
Multi-AZ, multi-Region, RTO/RPO strategies.
Designing for high availability and disaster recovery is the heart of the Reliability pillar. The guiding assumption is that everything fails eventually, so you architect to absorb failures and recover within defined objectives.
Multi-AZ and multi-Region
High availability starts with multi-AZ: spread every tier across at least two Availability Zones so a data-center failure is absorbed — Auto Scaling groups across AZs behind a load balancer for compute, Multi-AZ databases for data. For protection against a whole-Region failure or for global latency, multi-Region designs replicate data and stand up capacity in a second Region, coordinated by Route 53 failover or latency routing. Multi-AZ is the default expectation for production; multi-Region is added when the business requires surviving a Region-wide event or serving users globally with local latency, and it costs and complicates more.
# HA (within a Region) — the production default:# ALB → Auto Scaling group across AZ-a/b/c# RDS Multi-AZ (synchronous standby, auto failover)## DR (across Regions) — for Region-level protection:# replicate data to a second Region (e.g. Aurora Global, S3 CRR)# Route 53 failover routing → promote the DR Region on outage
DR strategies, RTO and RPO
Disaster-recovery strategies trade cost against recovery speed. Backup and restore is cheapest and slowest — restore from backups after an event. Pilot light keeps a minimal core (like a replicated database) always running in the DR Region, scaled up on failover. Warm standby runs a scaled-down but functional copy ready to take traffic. Multi-site active-active runs full capacity in both Regions for near-zero downtime and the highest cost. You choose based on two objectives: RTO (Recovery Time Objective — how long you can be down) and RPO (Recovery Point Objective — how much data loss is acceptable). Tighter RTO/RPO demands a more expensive strategy; match the strategy to the business requirement, not to fear.