Choose disaster recovery from RTO and RPO

Begin with two plain questions: how much recent data may be lost, and how soon must the business operation work again? RPO is maximum tolerable data-loss window back to the latest recoverable point. RTO is maximum time to restore the required business function.

Define them per operation, not as “fast recovery.” State Regional failure scope, reduced capacity, data lag, consistency, write ownership, dependencies, quotas, security, test frequency, and cost. In-Region HA is prerequisite, not Regional DR. Validate that data achieves RPO and compute, network, identity, certificates, DNS, dependencies, and operators achieve RTO. Five-minute lag cannot meet one-minute RPO.

A template cannot meet five-minute RTO if restoring 20 TB takes hours. Strategy follows feasibility, not service familiarity.

The strategies differ mainly in what is already running before the disaster. More standing readiness shortens recovery but raises cost and operating work. Backup and restore keeps recoverable data and artifacts but builds after disaster: lower standing cost, longer RTO. Pilot light keeps core data or critical services live while app capacity needs activation.

Warm standby is scaled-down but functional and can serve reduced traffic immediately. Multi-site active-active serves production in multiple Regions and can approach near-zero infrastructure recovery, but needs surviving capacity, data correctness, conflict or write ownership, and highest operational discipline. Warm standby wins when reduced service must begin immediately but active-active capacity is unjustified. Pilot light loses that requirement.

Active-active loses when near-zero targets do not justify spend and consistency complexity. Backup and restore is correct when hours are acceptable and cost dominates.

A second Region is not useful until clients can reach it, one writer is authoritative, and the team can safely return service later. Route 53 failover is DNS active/passive and TTL plus resolver caching means changes are not instantaneous. Global Accelerator provides static anycast entry and health-based endpoint routing; it helps when fixed IPs and rapid network shift are required, not as cache.

Choose steering from protocol and timing. Health must represent business function. Pre-raise quotas, synchronize artifacts, monitor lag, and test at required load. Define surviving writer, split-brain prevention, and failback of writes. Active-active is not passive failover; traffic leaves unhealthy endpoints and surviving Regions absorb it. Cost includes standby, transfer, replicas, licenses, tests, and operator complexity. Untested strategy is not evidence.

Recovery evidence must include a clock and a data checkpoint. At declaration, record the latest durable recovery point; at steering, record when the first valid reduced-service response arrives; at scale-up, record full-load time; at failback, verify which Region owns new writes. These timestamps expose strategies that look ready but cannot meet the objective.

Security controls travel with the recovery path: standby identities remain least privilege, replicated keys and certificates are ready before an incident, and emergency access is audited rather than shared. A warm environment that omits WAF policy or secrets rotation is not a valid reduced service. Cost should be framed as expected business loss plus standing and testing expense, not just duplicate instances.

Pilot light is rational when activation time fits; warm standby earns its premium by already processing health checks and a small workload; active-active earns its complexity only when near-zero interruption or local-write latency is worth conflict and operational burden. Always test failback, because a one-way promotion procedure leaves the next incident undefined.