Disaster Recovery Strategies (RPO/RTO)
Key concepts
Backup and restore
Pilot light
Warm standby
Multi-site active-active
RPO and RTO definitions
Introduction
Disaster Recovery (DR) is the process of preparing for and recovering from a disaster that impacts your IT systems. AWS provides multiple DR strategies with different trade-offs between cost, complexity, and recovery objectives. Understanding these strategies and when to apply them is critical for the SAA-C03 exam.
DR Core Concepts: RPO and RTO
Recovery Point Objective (RPO): Maximum acceptable data loss measured in time (how much data can you afford to lose?) Recovery Time Objective (RTO): Maximum acceptable downtime (how long can you be offline?)
Lower RPO/RTO = higher cost and complexity. The right DR strategy balances business requirements against budget.
DR Metrics: RPO and RTO
Understanding RPO and RTO
Recovery Point Objective (RPO):
- Maximum acceptable amount of data loss
- Measured in time (hours, minutes, seconds)
- Determines backup frequency
- Example: RPO of 1 hour means you can lose up to 1 hour of data
Recovery Time Objective (RTO):
- Maximum acceptable downtime
- Time from disaster to full recovery
- Determines DR strategy complexity
- Example: RTO of 4 hours means systems must be operational within 4 hours
Business Impact Analysis: Before choosing a DR strategy, conduct a Business Impact Analysis to determine:
- Critical systems and their dependencies
- Cost of downtime per hour
- Acceptable data loss
- Compliance requirements
The Four DR Strategies
AWS categorizes disaster recovery into four strategies, ordered by increasing cost and decreasing recovery time.
DR Strategies Comparison
| Strategy | RPO | RTO | Cost | Complexity |
|---|---|---|---|---|
| Backup & Restore | Hours | Hours (24+) | $ Lowest | Low |
| Pilot Light | Minutes | Tens of minutes | $$ Low-Medium | Medium |
| Warm Standby | Seconds | Minutes | $$$ Medium-High | Medium-High |
| Multi-Site Active/Active | Near zero | Near zero | $$$$ Highest | High |
1. Backup and Restore
The simplest and most cost-effective DR strategy. Data is backed up regularly and restored when needed.
Backup & Restore has the lowest cost but highest recovery time. If an exam question mentions 'cost-effective DR' with acceptable downtime of several hours, this is likely the answer. Remember that recovery time includes provisioning infrastructure AND restoring data.
2. Pilot Light
Core infrastructure components are kept running in the DR region with minimal resources. Like a pilot light on a gas heater, it's ready to quickly ignite the full system.
Pilot Light Architecture
In DR Region (Always Running):
- RDS Read Replica (synchronized)
- S3 Bucket (with CRR)
- AMIs ready for EC2 launch
- Route 53 health checks configured
On Failover (Deploy/Scale):
- Launch EC2 instances from AMIs
- Create/resize Auto Scaling Groups
- Promote RDS Read Replica to primary
- Update Route 53 to point to DR region
3. Warm Standby
A scaled-down but fully functional version of the production environment runs continuously in the DR region.
4. Multi-Site Active/Active
The most resilient (and expensive) strategy. Full production capacity runs in multiple regions simultaneously.
Active/Active Complexity
Multi-site active/active requires careful consideration of data consistency. Write conflicts can occur when the same data is modified in multiple regions simultaneously. Use patterns like write-partitioning or eventual consistency models to handle this complexity.
Strategy Selection Guide
Traffic Routing for DR
Routing Traffic During Failover
Amazon Route 53:
- Health checks monitor endpoint availability
- Failover routing policy for active/passive
- Latency/geolocation for active/active
- Automatic DNS failover (minutes to propagate)
AWS Global Accelerator:
- Static Anycast IPs
- Instant failover (no DNS propagation)
- Health-based endpoint routing
- Better for latency-sensitive applications
Best Practice:
- Use Route 53 health checks for endpoint monitoring
- Configure low TTL for faster DNS propagation
- Consider Global Accelerator for near-instant failover
Data Replication for DR
Data Replication Options
| Service | Replication Type | RPO | Use Case |
|---|---|---|---|
| S3 CRR | Async cross-region | Minutes | Object storage DR |
| RDS Read Replica | Async cross-region | Minutes | Database DR |
| Aurora Global Database | Async, <1 sec lag | Seconds | Low-latency DB DR |
| DynamoDB Global Tables | Async bidirectional | Seconds | NoSQL active/active |
| EBS Snapshots | Point-in-time | Hours | Volume backup |
| AWS Backup | Scheduled | Hours-Minutes | Centralized backup |
Common Exam Scenarios
DR Strategy Selection: Lowest cost + hours downtime OK → Backup & Restore | Under 1 hour, minimize cost → Pilot Light | Minutes recovery, reduced capacity OK → Warm Standby | Zero downtime, mission-critical → Active/Active | DB in minutes → Pilot Light or Warm Standby with RDS replica
A company has an RTO of 4 hours and RPO of 24 hours for their non-critical analytics workload. They want the MOST cost-effective DR strategy. What should they implement?
A financial services company requires RPO of less than 1 minute and RTO of less than 15 minutes for their trading platform. Which DR strategy should they implement?
A company is implementing a pilot light DR strategy. Which components should be ALWAYS RUNNING in the DR region? (Select TWO)
Best Practices
DR Best Practices
- Conduct Business Impact Analysis: Understand the true cost of downtime before choosing a strategy
- Test regularly: Run DR drills at least annually; use AWS Resilience Hub for validation
- Automate failover: Manual steps slow recovery and introduce errors
- Document runbooks: Clear procedures for failover and failback
- Monitor replication lag: Ensure data is synchronizing within RPO targets
- Use Infrastructure as Code: CloudFormation/Terraform for consistent DR deployments
- Consider regional dependencies: Ensure DR region has capacity and required services
- Plan for failback: Recovery is only half the story; plan the return to primary
- Use AWS Backup: Centralized, policy-driven backup across services
- Keep AMIs updated: Outdated AMIs in DR region can cause deployment issues
Summary
Disaster Recovery on AWS ranges from simple backup/restore to complex multi-site active/active architectures:
- Backup & Restore: Lowest cost, highest recovery time (hours)
- Pilot Light: Data replicated, compute on-demand (tens of minutes)
- Warm Standby: Scaled-down functional stack (minutes)
- Multi-Site Active/Active: Full capacity, near-zero recovery (highest cost)
The right strategy depends on balancing business requirements (RPO/RTO) against cost and complexity. Understanding these trade-offs is essential for the SAA-C03 exam.