Spread every layer across at least two Availability Zones (AZs), ideally three. An AZ is one or more separate data centres inside an AWS Region.
Load balancer and app:
- The ALB (Application Load Balancer) spans public subnets in each AZ.
- The ECS service runs tasks in private subnets across those AZs.
- Keep enough spare capacity so the remaining AZs can carry the full load, and use autoscaling to add more tasks.
- Tasks must be stateless: keep sessions in Redis or in tokens, not in the task's memory. Then any task can serve any request.
Data:
- Run RDS or Aurora in Multi-AZ mode, so the database fails over to another AZ automatically.
- Make the app reconnect and retry when it gets connection errors, because a failover drops open connections.
- Use ElastiCache for Redis with replicas in other AZs, and turn on automatic failover.
Network: use one NAT gateway per AZ. Then an outage in one AZ does not cut outbound internet traffic for the other AZs.
Finally, test it. Trigger a database failover and stop the tasks in one AZ. Confirm that the system recovers.
- Run every layer in at least two AZs.
- Tasks are stateless, with spare capacity and autoscaling.
- Use Multi-AZ RDS or Aurora, and make the app reconnect and retry.
- Use ElastiCache replicas with automatic failover.
- Use one NAT gateway per AZ, and test failover for real.