Certopolis

AWS Certified Solutions Architect – Associate

AWS disaster recovery: pilot light vs warm standby vs backup

AWS describes four disaster recovery strategies, from cheapest and slowest to most expensive and fastest: backup and restore, pilot light, warm standby, and multi-site active/active. Pick the cheapest one whose recovery time objective (RTO) and recovery point objective (RPO) meet the requirement.

RTO and RPO

RTO is how long the system can be down. RPO is how much data, measured in time, you can lose. Asynchronous replication gives a low but non-zero RPO; backups give an RPO equal to the time since the last backup.

Backup and restore

Back up data and copy it to the recovery Region, for example with AWS Backup cross-Region copies or S3 Cross-Region Replication. Nothing runs in the recovery Region until a disaster.

At failover you must restore the data and also redeploy the infrastructure, configuration and code. AWS recommends infrastructure as code such as AWS CloudFormation or the AWS CDK; without it, recovery takes longer and may miss the RTO. Keep AMIs as part of the backup.

Pilot light and warm standby

Pilot light replicates data continuously to live data stores in the recovery Region, such as RDS read replicas, Aurora global databases or DynamoDB global tables. Databases are always on. Application servers are defined but switched off, and are deployed and scaled out only at failover.

Warm standby runs a scaled-down but fully functional copy of production in the recovery Region. The AWS distinction: pilot light cannot process requests without action first; warm standby can handle traffic at reduced capacity immediately and only needs to scale up.

Multi-site active/active

The workload runs in several Regions and serves traffic from all of them. This is the most complex and costly option and can bring recovery time near zero. A hot standby variant runs full capacity in the second Region but sends it no traffic.

Writes need a strategy. Write global sends all writes to one Region, which fits Aurora global database. Write local accepts writes in every Region, which fits DynamoDB global tables with last writer wins reconciliation. Point-in-time backups are still required, because replication also copies corruption.

Where the exam catches people

  • Believing backup and restore only needs the data copied: you must also redeploy infrastructure, configuration and code in the recovery Region.
  • Believing pilot light and warm standby are the same: pilot light cannot serve requests until servers are switched on; warm standby serves at reduced capacity immediately.
  • Believing continuous replication replaces backups: replication may not protect against corruption or deletion, so point-in-time backups are still needed.
  • Believing Aurora global database suits a write-in-every-Region design: secondaries are read-only; DynamoDB global tables are the write local option.
  • Believing changing Route 53 weights is the most resilient failover switch: it is a control plane change; ARC routing controls use the data plane.

Written from Amazon Web Services's documentation

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

  1. A company runs an internal reporting application on Amazon EC2 instances with an Amazon RDS database in one AWS Region. For a Regional disaster it accepts a recovery point and a recovery time of up to one day. It wants the lowest-cost disaster recovery strategy, with no databases or instances running in the second Region. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

    Right. In the game that’s Renown for your Design Resilient Architectures building.

    Not that one: A,C is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    The AWS disaster recovery whitepaper says backup and restore can "mitigate against a regional disaster by replicating data to other AWS Regions", that "AWS Backup supports copying backups across Regions, such as to a disaster recovery Region", and that "In addition to data, you must redeploy the infrastructure, configuration, and application code in the recovery Region. To enable infrastructure to be redeployed quickly without errors, you should always deploy using infrastructure as code (IaC) using services such as AWS CloudFormation or the AWS Cloud Development Kit (AWS CDK)."

    Written from docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html

  2. A company runs a web application on Amazon EC2 instances with an Amazon DynamoDB table in one AWS Region. For disaster recovery in a second Region, it needs a recovery point of seconds and a recovery time of tens of minutes. To keep cost low, no application servers may run in the second Region until a disaster is declared. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

    Right. In the game that’s Renown for your Design Resilient Architectures building.

    Not that one: B,E is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    "With the pilot light approach, you replicate your data from one Region to another and provision a copy of your core workload infrastructure. Resources required to support data replication and backup, such as databases and object storage, are always on. Other elements, such as application servers, are loaded with application code and configurations, but are "switched off" and are only used during testing or when disaster recovery failover is invoked." For the data half, it lists "Amazon DynamoDB global tables" among the services that provide "continuous, cross-region, asynchronous data replication", and the DynamoDB guide says that when an application writes to one replica, "DynamoDB automatically replicates the write to all other replicas in the global table."

    Written from docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html

  3. A multi-site active/active workload serves users from three Regions and must accept writes in each of them, with conflicting concurrent updates resolved automatically rather than rejected. A solutions architect must choose the data store. Which solution meets these requirements?

    Right. In the game that’s Renown for your Design Resilient Architectures building.

    Not that one: C is right. In the game your Design Resilient Architectures building would lose a little Renown, and this question would come back later.

    Show the full explanation and doc quotes

    "A write local strategy routes writes to the closest Region (just like reads). Amazon DynamoDB global tables enables such a strategy, allowing read and writes from every region your global table is deployed to. Amazon DynamoDB global tables use a last writer wins reconciliation between concurrent updates." The alternative is write global, and the whitepaper assigns Aurora to it: "Aurora global database is a good fit for write global, as it supports synchronization with read-replicas across Regions, and you can promote one of the secondary Regions to take read/write responsibilities in less than one minute", with write forwarding sending a secondary's writes to the primary.

    Written from docs.aws.amazon.com/whitepapers/latest/disaster-recovery-workloads-on-aws/disaster-recovery-options-in-the-cloud.html