From backup-and-restore to active-active
Four ways to survive losing a whole site, from cheap and slow to expensive and near-instant. The right one is the cheapest that meets each system's targets - and replication, the thing that makes the fast ones fast, copies your mistakes too.
Backups protect your data. Disaster recovery (DR) is about the rest: if the building, the data centre or the whole cloud region you run in is gone, where does the system run tomorrow, and how quickly can it be there?
AWS’s whitepaper Disaster Recovery of Workloads on AWS sorts the answers into four approaches, “ranging from the low cost and low complexity of making backups to more complex strategies using multiple active Regions”. The names are used across the industry, whichever cloud or data centre you’re in.
- Backup and restore: copy backups to another region; after a disaster, rebuild everything there and restore. Cheapest, slowest.
- Pilot light: data is replicated continuously and core infrastructure is ready, but application servers stay switched off until a failover.
- Warm standby: a scaled-down but working copy runs all the time. It can take traffic at once, then scales up.
- Active/active: both sites serve users all the time, so there is nothing to fail over to. Most complex, most costly, recovery near zero.
What separates them
- Backup and restore is, in the whitepaper’s words, “a suitable approach for mitigating against data loss or corruption”, and for many systems it’s enough. Recovery means redeploying “the infrastructure, configuration, and application code” as well as the data. Without infrastructure as code, it warns, that “may be complex” and can blow your RTO.
- Pilot light vs warm standby is the distinction people mix up. The whitepaper is precise: “pilot light cannot process requests without additional action taken first, whereas warm standby can handle traffic (at reduced capacity levels) immediately.”
- Multi-site active/active “is the most complex and costly approach to disaster recovery, but it can reduce your recovery time to near zero for most disasters”.
None of them is “best”. The right one is the cheapest that meets a system’s RTO and RPO, which is why the targets from the previous lesson come first. Most organisations end up with different patterns for different systems.
What is the difference between pilot light and warm standby?
Both keep data replicated. Pilot light keeps application servers off until failover; warm standby runs a smaller working copy that can serve traffic at once and then scale up.
A payment service needs RTO 15 minutes and RPO 1 minute. Warm standby meets both; active/active does too. Which should you pick?
The goal is the cheapest pattern that meets the targets. Active/active buys recovery the business did not ask for; backup and restore cannot recover in 15 minutes.
Your shop runs warm standby. A bad deploy corrupts the orders table. Why doesn't failing over help?
Replication copies every write, good or bad. Recovering from corruption needs a point in time before it - versioned or point-in-time backups - whatever the DR pattern.
Sources
Missions and quizzes above earn their own XP. This marks the lesson done.