Design Resilient Architectures · Topic 5 of 5
Disaster Recovery Strategies
Choose a disaster recovery strategy from RPO and RTO targets, and compare backup and restore, pilot light, warm standby and multi site designs on AWS.
- 5 min
- Includes a diagram
- RPO is the acceptable data loss in time. RTO is the acceptable downtime.
- The four strategies in order of cost and speed: backup and restore, pilot light, warm standby, multi site.
- Pilot light keeps only the core, such as the database, running. Warm standby runs a reduced copy of everything.
What it is
Disaster recovery (DR) is the plan for getting a workload back after a large failure, such as the loss of a whole Region or a damaging data event. High availability handles small failures. DR handles big ones.
Two targets drive every choice. The recovery point objective (RPO) is how much data you can afford to lose, measured as time. The recovery time objective (RTO) is how long the service can be down before it must be back.
How it works
The four strategies
Each step down the table shortens the typical RTO and raises cost. The RPO depends on how data reaches the recovery Region: the backup interval for backup and restore, and the replication lag for the other three.
| Strategy | What runs in the recovery Region | Typical RTO | Cost |
|---|---|---|---|
| Backup and restore | Nothing, only backups are copied | Hours | Lowest |
| Pilot light | Core data is replicated and always on, while application servers are off or minimal | Tens of minutes | Low |
| Warm standby | A complete but scaled down copy that runs all the time | Minutes | Medium |
| Multi site active active | A full copy that serves live traffic in two or more places | Near zero | Highest |
Backup and restore copies data (snapshots, S3 replication, AWS Backup copies) to another Region, then you rebuild the infrastructure from templates when needed. Pilot light keeps the data layer, such as a replicated database, running, and you start the application layer when a disaster happens. Warm standby already runs the application at small scale, so you scale it up and switch traffic. Multi site needs no recovery step, because both sides already serve users.
Tools that help
| Need | Tool |
|---|---|
| Copy backups to another Region or account | AWS Backup, cross Region snapshot copy |
| Replicate objects | S3 Cross Region Replication |
| Replicate relational data | Aurora Global Database, RDS cross Region read replica |
| Replicate NoSQL data | DynamoDB global tables |
| Replicate servers continuously, including from on premises | AWS Elastic Disaster Recovery |
| Rebuild infrastructure quickly and consistently | AWS CloudFormation templates |
| Redirect users after failover | Route 53 failover routing, or AWS Global Accelerator |
AWS Elastic Disaster Recovery replicates servers at the block level into a low cost staging area, then launches full instances when you declare a disaster. It fits a pilot light style design for physical, virtual or cloud servers.
Matching strategy to requirement
Read the numbers. An RTO of several hours and a low budget points to backup and restore.
An RTO of tens of minutes points to pilot light, and an RTO of minutes points to warm standby. Near zero downtime and data loss points to multi site, usually with near real time data replication.
Replication is not the same as a backup. A replicated database also replicates a mistaken delete, so keep point in time recovery or versioned backups too.
Planning habits
Keep infrastructure as code so the recovery stack matches production. Store backups in a different Region and, for protection against account compromise, a different account. Practice a failover, and document who decides to fail over.
For on premises workloads, AWS can serve as the recovery site. A hybrid design might use AWS Storage Gateway or Elastic Disaster Recovery to send data to AWS.
In a question, find the RPO and RTO words first, then pick the cheapest strategy that still meets both. If the question only says "minimize cost" and the downtime allowed is hours, backup and restore wins.
Quotas and throttling in the recovery Region
Service quotas apply per account and per Region. A standby Region starts with default quotas, so a failover that launches many instances can hit a limit exactly when you need it.
Check the Service Quotas console (or API) for the standby Region, and request increases for adjustable quotas ahead of time, because a request is not instant. Some quotas are fixed and cannot be raised.
A quota is not a capacity guarantee. If you must be sure that instances are available in the recovery Region, a capacity reservation can hold them.
Many AWS APIs also throttle callers that send too many requests. The AWS SDKs retry throttled calls with exponential backoff, which means waiting longer after each failure, and recovery scripts should do the same instead of retrying in a tight loop.
What to remember for the exam
- RPO is the acceptable data loss in time. RTO is the acceptable downtime.
- The four strategies in order of cost and speed: backup and restore, pilot light, warm standby, multi site.
- Pilot light keeps only the core, such as the database, running. Warm standby runs a reduced copy of everything.
- Multi site active active has the lowest recovery time and the highest cost.
- Aurora Global Database and DynamoDB global tables replicate data across Regions.
- AWS Elastic Disaster Recovery replicates servers continuously for fast recovery.
- Route 53 failover routing or Global Accelerator shifts users to the recovery Region.
- Replication does not replace backups, since it copies mistakes too.
Common mistakes
Mixing up pilot light and warm standby. In a pilot light the application tier is off or minimal. In a warm standby it is running, just smaller.
Paying for multi site when hours of downtime are allowed. The question usually has a cost clue. Pick the cheapest design that meets the targets.
Keeping backups only in the primary Region. A regional failure takes the backups with it. Copy them elsewhere.
Assuming DR is automatic. Most designs need a failover step, which can be scripted, so test it.
A recovery plan that depends on a console action in the failed Region can stall during the event. Automate recovery from the recovery Region where you can.
Check yourself
What does RTO measure?
The maximum acceptable time for the service to be down before it is restored.
Which strategy keeps the database replicated and running but the application servers off until a disaster?
Pilot light.
Which strategy has the lowest RTO and the highest cost?
Multi site active active.
Topic 5 of 5 in Design Resilient Architectures
Test yourself on Design Resilient Architectures
The full AWS SAA-C03 question bank has 823 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.