Resilient Cloud Solutions · Topic 4 of 5
Disaster Recovery and Backup Strategy
Choose a disaster recovery strategy from RTO and RPO targets, and design backups with AWS Backup, snapshots, point in time recovery and copies.
- 5 min
- RTO is time to recover; RPO is acceptable data loss measured in time.
- The four strategies in rising cost and speed: backup and restore, pilot light, warm standby, multi site active active.
- AWS Backup applies plans by tag and supports cross Region and cross account copies.
What it is
Disaster recovery (DR) is the plan for restoring a workload after a major failure such as a Regional outage, data corruption or an attack. Two numbers drive every DR design.
The Recovery Time Objective (RTO) is how long the business can accept being down. The Recovery Point Objective (RPO) is how much recent data the business can accept losing, measured as time. A smaller RTO or RPO costs more.
How it works
The four DR strategies
| Strategy | What runs in the DR Region | Typical recovery | Cost |
|---|---|---|---|
| Backup and restore | Only backups | Hours | Lowest |
| Pilot light | Core data replicated, compute switched off | Tens of minutes | Low |
| Warm standby | A scaled down but running copy | Minutes | Medium |
| Multi site active active | Full capacity in both Regions | Near zero | Highest |
Match the strategy to the numbers in the question. An RPO of hours with an RTO of a day points to backup and restore. A requirement of near zero downtime and data loss points to multi site active active.
In pilot light the database is replicated continuously but servers are not running, and recovery means scaling up the servers from templates and AMIs. Warm standby keeps a small fleet already serving traffic, so recovery is mostly scaling it up and switching DNS.
AWS Backup
AWS Backup centralizes backups for many services, including EC2, EBS, RDS, Aurora, DynamoDB, EFS, FSx and S3.
| Concept | Meaning |
|---|---|
| Backup plan | Rules for schedule, backup window, lifecycle and destination |
| Resource assignment | Which resources, chosen by tag or ID |
| Backup vault | The container for recovery points, encrypted with KMS |
| Lifecycle | Move to cold storage after a period, delete after a retention time |
| Cross Region and cross account copy | Copy recovery points to another Region or account |
| Vault Lock | Write once, read many protection against deletion |
| Backup policy | An Organizations policy that applies plans across accounts |
Assigning resources by tag means a new resource that carries the tag is protected automatically.
Cross account copy to a dedicated backup account protects against a compromised production account. Vault Lock in compliance mode means that even the account administrator cannot delete recovery points before retention ends.
Service level backup features
- EBS snapshots are incremental and stored in S3. Amazon Data Lifecycle Manager automates their creation, retention and cross Region copy.
- RDS takes automated backups and keeps transaction logs, which allows point in time recovery, typically to within the last five minutes. The retention period is configurable up to 35 days. Manual snapshots stay until you delete them. Snapshots can be copied to another Region.
- Aurora also offers backtrack for MySQL compatible clusters, which rewinds the database without a restore.
- DynamoDB supports point in time recovery, which can restore any moment within a window of up to 35 days, and on demand backups.
- S3 versioning recovers from overwrites and deletes. Replication copies data to another Region, and Object Lock prevents deletion.
A restore usually creates a new resource, so plan the cutover: new endpoint names, security groups and parameters.
Encryption and sharing
An encrypted snapshot is shared across accounts or Regions only with a customer managed KMS key whose policy allows the destination. When copying to another Region, you name a key in the destination Region for the copy.
Testing
A backup that has never been restored is unproven. AWS Backup has restore testing plans that restore and validate recovery points on a schedule, and you should also run game days against the DR environment.
aws backup start-copy-job --recovery-point-arn <arn> \
--source-backup-vault-name prod-vault \
--destination-backup-vault-arn <dr-vault-arn> \
--iam-role-arn <role-arn>Infrastructure for DR
DR is not only data. Keep the infrastructure in CloudFormation or CDK so the DR Region can be built or scaled on demand, replicate AMIs and container images, and store configuration in parameters that are also replicated. Keep the DR runbook automated, because manual steps during a disaster are slow and error prone.
What to remember for the exam
- RTO is time to recover; RPO is acceptable data loss measured in time.
- The four strategies in rising cost and speed: backup and restore, pilot light, warm standby, multi site active active.
- AWS Backup applies plans by tag and supports cross Region and cross account copies.
- Vault Lock gives tamper resistant retention.
- RDS point in time recovery needs automated backups enabled, and a restore creates a new instance.
- DynamoDB point in time recovery covers a window of up to 35 days.
- Sharing encrypted snapshots needs a customer managed KMS key.
- Replication does not replace backups, since it copies corruption and deletions too.
- Automate failover and recovery steps in code, then test them.
Read the RTO and RPO in the question first, because they often narrow the choice to one or two strategies at once.
Common mistakes
Mixing up RTO and RPO. RTO is about downtime and RPO is about lost data.
Relying on Multi AZ for DR. It protects against an AZ failure, not a Regional outage or a bad delete.
Keeping backups in the same account and Region. One compromise or one Regional event removes both the data and its backup.
Expecting an in place restore. Restores usually create new resources, so connection settings change.
Cross Region backup copies of encrypted data fail if the destination KMS key policy does not allow the copy role.
Check yourself
Which DR strategy keeps data replicated but servers switched off?
Pilot light, where the core data is live and compute is created or started at failover time.
What protects recovery points from deletion even by administrators?
AWS Backup Vault Lock in compliance mode.
Why do backups need to be tested?
Only a restore proves the data is complete, the keys work and the runbook meets the RTO.
Topic 4 of 5 in Resilient Cloud Solutions
Test yourself on Resilient Cloud Solutions
The full AWS DOP-C02 question bank has 844 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.