Disaster recovery tiers
Choose how much standby capacity to keep for a lost region, from backups alone to a second site that serves traffic all the time, and pay for the speed you need.
Disaster recovery tiers trade money for recovery speed: the faster you must be back, the more idle or duplicate capacity you pay for.
Use it when#
A whole region or zone loss would end the business, not just spoil a day.
The business says how long it can be down and how much data it can lose, so the tier is a choice and not a guess.
You have backups but have never restored one.
How it works#
AWS's whitepaper names four tiers, cheapest first:
Backup and restore. Copy data elsewhere, and rebuild everything after the disaster. Recovery takes hours.
Pilot light. Keep the data replicated and the core running, and start the rest on demand. Recovery takes tens of minutes.
Warm standby. Keep a scaled-down copy of the whole stack running, and scale it up on failover. Recovery takes minutes.
Active-active. Serve traffic from two sites at once, so a loss only removes half the capacity. Recovery is near zero.
A team that loses a region at 02:00 with only nightly backups restores a day-old copy and rebuilds servers by hand. A team with active-active already serves from the other site.
What it costs#
Each tier up multiplies the bill and the complexity, and active-active adds the cross-site consistency problems of replication strategies. The common mistake is an untested restore. A backup you have not restored is a hope, so rehearse it.
In Quorum#
The game has the rungs that matter. A snapshot-only Database is backup and restore. A zone standby covers a lost zone. A replica in another region behind GeoDNS is a warm standby, and a Spread store is active-active. It has no pilot light. The Design below shows the zone rung.
Drag to pan. Hold Ctrl or Cmd and scroll to zoom.
| Where | Setting | Value | Why |
|---|---|---|---|
| App Server | Instance size | medium | Medium for the app, so the Database is the part under test. |
| Database | Instance size | medium | Medium for the primary. The standby copies this size. |
| Database | Standby | On | A second box in another zone takes over within seconds if the primary zone fails, and doubles the Node bill. |
| Database | Backups | nightly | A nightly snapshot is the cheap floor: a bad delete loses up to a day of writes. |
Research this Design needs: Point-in-time recovery, Multiple zones, Health checks.
Point-in-time recovery unlocks backups, Multiple zones unlocks the standby, and Disaster recovery drills runs the scripted regional outage the IPO checklist asks for. The Zone outage incident shows a standby taking over. See RPO and RTO for the two numbers a tier buys, and the glossary entry on availability zones.