CodeParkRTO (recovery time objective) is how long your system may be down. RPO (recovery point objective) is how much data you may lose, measured in time. For example, an RPO of 15 minutes means you may lose the last 15 minutes of data. Lower targets cost more.
The common strategies, from cheapest to most expensive:
- Backup and restore: you copy backups and images to another Region. When the first Region fails, you rebuild everything there from IaC (infrastructure as code: scripts that create your servers and services). RTO is measured in hours.
- Pilot light: your data is always copied to the second Region, for example with an Aurora Global Database or a cross-Region read replica. Compute (the servers) stays off until you need it.
- Warm standby: a smaller but working copy of the system runs in the second Region. On failover, you scale it up to full size.
- Multi-site active/active: both Regions serve traffic at the same time. RTO is near zero, but keeping data consistent between Regions is complex.
All of these strategies depend on three things:
- IaC, to recreate the infrastructure.
- DNS failover, such as Route 53 health checks, to send users to the healthy Region.
- Regular failover drills, to prove the plan really works.
- RTO is how much downtime is allowed. RPO is how much data loss is allowed.
- Backup and restore is the cheapest and the slowest strategy.
- Pilot light keeps data copied to the second Region, but compute stays off.
- Warm standby runs a smaller working copy that you scale up on failover.
- Active/active is the fastest and the most complex. Every strategy needs IaC, DNS failover and drills.
Read more