Module Objective: Choose and design an appropriate disaster recovery strategy for a cloud architecture based on its recovery time and recovery point requirements.

Builds on Module 9: High availability (Module 9) protects against the loss of a single AZ; disaster recovery plans for the loss of an entire Region.

Disaster Recovery Concepts: RTO and RPO

Disaster recovery planning starts with two business-driven metrics that determine how much downtime and data loss a workload can tolerate — every DR strategy in this module is really just a different way of hitting a target RTO and RPO at a given cost.

MetricDefinition
Recovery Time Objective (RTO)The maximum acceptable time to restore service after a disaster
Recovery Point Objective (RPO)The maximum acceptable amount of data loss, measured in time since the last recovery point
🔵 Note RTO and RPO are business decisions, not technical ones — an architect's job is to design a strategy that hits the RTO and RPO the business actually needs, at a cost the business is willing to pay.

Backup and Restore

The lowest-cost, slowest DR strategy: regularly back up data (e.g. RDS snapshots, S3 replication) to a second Region, and only provision compute resources there after a disaster is declared.

⚠️ Warning — Slowest RTO, Lowest Cost Backup and restore typically has the longest RTO of the four strategies in this module, since infrastructure in the recovery Region has to be provisioned from scratch after the disaster occurs — but it's also the cheapest to maintain day to day.

Pilot Light

A minimal version of the environment — typically just the database, kept continuously replicated — runs in the recovery Region at all times, ready to be "lit" by scaling up compute resources when needed.

✅ Tip — Named for a Literal Pilot Light Like a gas furnace's pilot light, the core (database) stays running continuously at low cost, ready to ignite the rest of the system quickly rather than starting completely cold.

Warm Standby

A scaled-down but fully functional version of the entire environment runs continuously in the recovery Region, ready to be scaled up to full capacity when a disaster is declared — faster to recover than pilot light, at a higher ongoing cost.

🔵 Note Warm standby differs from pilot light by keeping every tier — not just the database — running at reduced scale, so there's less to provision from scratch during a failover.

Multi-Site Active/Active

The fastest and most expensive strategy: a full production environment runs simultaneously in two or more Regions, actively serving traffic, with a near-zero RTO since there's no failover to perform — traffic is simply redirected.

StrategyRelative RTORelative Cost
Backup and restoreHoursLowest
Pilot lightTens of minutesLow
Warm standbyMinutesHigher
Multi-site active/activeNear-zeroHighest
✅ Tip — This Table Is a Common Exam Reference Point Being able to place all four strategies in order of RTO and cost — and match a given business requirement to the cheapest strategy that meets it — is one of the more frequently tested design skills on the SAA-C03 exam.

Key Terms for Module 14

Recovery Time Objective (RTO)
The maximum acceptable time to restore service after a disaster
Recovery Point Objective (RPO)
The maximum acceptable amount of data loss, measured in time
pilot light
A DR strategy keeping only core data continuously replicated in a recovery Region
warm standby
A DR strategy running a full but scaled-down environment continuously in a recovery Region
multi-site active/active
A DR strategy running full production environments simultaneously in multiple Regions

Review Questions

  1. What is the difference between Recovery Time Objective and Recovery Point Objective?
  2. Why is backup and restore the cheapest DR strategy but also typically the slowest to recover?
  3. What is the key difference between pilot light and warm standby?
  4. Why does multi-site active/active achieve a near-zero RTO compared to the other three strategies?