CLD120 Module 14 — Planning for Disaster

Module Objective

Choose and design a disaster recovery (DR) strategy for a cloud architecture based on its recovery time and recovery point requirements.

Modules 3–8All layers✓ built

Module 9Elasticity & HA✓ done

Module 10Automation✓ done

Module 11Caching✓ done

Module 12Decoupling✓ done

Module 13Serverless✓ done

Module 14Disaster recoveryyou are here

High availability (Module 9)

Protects against losing a single Availability Zone

Disaster recovery (this module)

Plans for losing an entire Region

Disaster Recovery Concepts: RTO and RPO

Last recovery point

← RPO →
data lost

Disaster

← RTO →
downtime

Service restored

Metric	Definition
Recovery Time Objective (RTO)	The maximum acceptable time to restore service after a disaster
Recovery Point Objective (RPO)	The maximum acceptable data loss, measured as time since the last recovery point

RTO and RPO are business decisions. The business sets the targets; the architect designs a strategy that meets them at a cost the business will pay.

Backup and Restore

Primary Region

Load balancer
full scale

Compute
full scale

Database
full scale

Recovery Region

Load balancer
not running

Compute
not running

Database
backups · snapshots only

Data backed up regularly to a second Region — RDS snapshots, S3 replication. Compute is provisioned only after a disaster is declared.

Slowest RTO, lowest cost. Recovery infrastructure must be built from scratch after the disaster — but it’s the cheapest to run day to day.

Pilot Light

Primary Region

Load balancer
full scale

Compute
full scale

Database
full scale

Recovery Region

Load balancer
not running

Compute
not running

Database
running · continuously replicated

A minimal core — typically just the database — runs at all times. On failover, compute is scaled up to “light” the rest of the system.

Named for a literal pilot light: like a furnace’s pilot flame, the core stays on at low cost, so the full system can start quickly rather than from cold.

Warm Standby

Primary Region

Load balancer
full scale

Compute
full scale

Database
full scale

Recovery Region

Load balancer
reduced scale

Compute
reduced scale

Database
reduced scale

A scaled-down but fully working copy of the entire environment runs continuously. On failover, it scales up to full capacity.

Difference from pilot light: warm standby runs every tier at reduced scale — not just the database — so less must be provisioned during failover.

Multi-Site Active/Active

Users

→

Traffic routing
no failover step — redirect away from a failed Region

→

Region A
full production · serving traffic

Region B
full production · serving traffic

Strategy	Relative RTO	Relative Cost
Backup and restore	Hours	Lowest
Pilot light	Tens of minutes	Low
Warm standby	Minutes	Higher
Multi-site active/active	Near-zero	Highest

A common exam reference point: order the four by RTO and cost, and match a requirement to the cheapest strategy that meets it.

Key Terms

Recovery Time Objective (RTO): The maximum acceptable time to restore service after a disaster
Recovery Point Objective (RPO): The maximum acceptable amount of data loss, measured in time
Pilot light: Keeps only core data continuously replicated in a recovery Region
Warm standby: Runs a full but scaled-down environment continuously in a recovery Region
Multi-site active/active: Runs full production environments at the same time in multiple Regions

Review Questions

What is the difference between Recovery Time Objective and Recovery Point Objective?
Why is backup and restore the cheapest DR strategy but also typically the slowest to recover?
What is the key difference between pilot light and warm standby?
Why does multi-site active/active achieve a near-zero RTO compared to the other three strategies?