Reliability and Continuity · Topic 4 of 5
Disaster Recovery Strategies
Understand RTO and RPO, compare backup and restore, pilot light, warm standby and active active, and use Route 53 failover and Elastic Disaster Recovery.
- 4 min
- Includes a diagram
- RTO is acceptable downtime, and RPO is acceptable data loss measured in time.
- The four strategies in rising cost and falling recovery time are backup and restore, pilot light, warm standby and active active.
- Pilot light replicates data and keeps compute off, while warm standby runs a scaled down full copy.
What it is
Disaster recovery (DR) is the plan for bringing a workload back after a large failure, such as the loss of a whole Region. High availability handles small failures automatically, and DR handles large ones.
Two numbers shape every DR design. The Recovery Time Objective (RTO) is how long the business can be down. The Recovery Point Objective (RPO) is how much recent data it can afford to lose.
How it works
RTO and RPO
A short RTO means you must be able to start the workload again quickly. A short RPO means data must be copied often, or continuously.
Lower numbers cost more, because you keep more running or replicate more often. The exam usually gives the requirement and asks for the cheapest strategy that still meets it.
The four strategies
| Strategy | What runs in the recovery Region | RTO and RPO | Cost |
|---|---|---|---|
| Backup and restore | Nothing, only backups copied over | Hours | Lowest |
| Pilot light | Core data layer replicated, application servers off | Tens of minutes | Low |
| Warm standby | A scaled down but working copy | Minutes | Medium |
| Multi site active active | Full capacity in both Regions | Near zero | Highest |
- Backup and restore: copy backups, snapshots and templates to another Region. After a disaster, rebuild with infrastructure as code and restore the data.
- Pilot light: the database is replicated and ready, while the servers exist as templates only. You start and scale them during recovery.
- Warm standby: a smaller version of the full stack is always running. You scale it up and send traffic to it.
- Active active: both Regions serve users all the time. Failure of one needs little or no recovery action.
Moving traffic
Amazon Route 53 failover routing sends users to a primary endpoint while its health check passes, and to a secondary endpoint when it fails. Weighted and latency routing can support active active designs.
# AWS CLI: list health checks used by failover records
aws route53 list-health-checksRoute 53 Application Recovery Controller adds routing controls for large, multi Region failovers. AWS Global Accelerator can also shift traffic between Regional endpoints quickly because it uses fixed anycast IP addresses, with no wait for DNS caches to expire.
Getting data and servers across
| Need | Tool |
|---|---|
| Copy backups to another Region or account | AWS Backup copy rules |
| Replicate a relational database | Aurora Global Database, RDS cross Region read replica |
| Replicate NoSQL data | DynamoDB global tables |
| Replicate objects | S3 Cross Region Replication |
| Replicate servers at the block level | AWS Elastic Disaster Recovery |
| Rebuild infrastructure the same way | CloudFormation templates and AMI copies |
AWS Elastic Disaster Recovery continuously replicates source servers, including on premises ones, to a low cost staging area. During a recovery, it launches instances from the replicated data.
Testing the plan
A DR plan that was never tested is a guess. Run regular drills, keep runbooks current, and automate the failover steps as far as you can. Check that the recovery Region has the quotas, AMIs, keys and permissions it needs.
Match the strategy to the numbers. If RTO is hours, backup and restore is enough. If it is minutes with low cost, think warm standby. If it must be near zero, think active active.
What to remember for the exam
- RTO is acceptable downtime, and RPO is acceptable data loss measured in time.
- The four strategies in rising cost and falling recovery time are backup and restore, pilot light, warm standby and active active.
- Pilot light replicates data and keeps compute off, while warm standby runs a scaled down full copy.
- Route 53 failover routing needs health checks.
- Global Accelerator avoids DNS caching delays by using fixed IP addresses.
- AWS Elastic Disaster Recovery replicates servers continuously, including from on premises.
- AWS Backup can copy recovery points across Regions and accounts.
- Infrastructure as code and copied AMIs make a rebuild repeatable.
- Test DR regularly.
Common mistakes
Choosing the most expensive option by default. Active active is only right when the requirement demands near zero downtime.
Confusing RTO and RPO. RTO is time to recover. RPO is how old the recovered data can be.
Forgetting to replicate encryption keys. An encrypted snapshot copied to another Region needs a key that can be used there.
Assuming Multi AZ is DR. Multi AZ stays inside one Region, so it does not protect against a Regional event.
Not checking limits in the target Region. A recovery fails if the quotas for instances are too low.
Backups that sit in the same Region and account as the source may be lost together in a Regional event or an account compromise. Keep a copy elsewhere.
Check yourself
Work through these.
What does RPO measure?
How much data loss, in time, the business can tolerate.
Which strategy replicates the database but keeps application servers switched off until needed?
Pilot light.
Which Route 53 policy sends traffic to a standby Region when the primary fails?
Failover routing with a health check on the primary.
Topic 4 of 5 in Reliability and Continuity
Test yourself on Reliability and Continuity
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.