Disaster Recovery

Backup-restore vs pilot-light vs warm-standby vs multi-site active-active — cost, RTO, RPO, when to pick each.

Overview

Getting back to a working state

Disaster recovery (DR) is the discipline of recovering after a region, AZ or whole-cloud failure. Every workload needs a DR strategy. Which one is driven by the cost of downtime, not engineering preference.

The AWS Well-Architected Reliability Pillar names four strategies, in increasing cost and decreasing RTO/RPO. Each is roughly 10× the cost of the previous and gives roughly 10× faster recovery.

The four strategies

1. Backup and Restore — Data only; infra and code redeployed at failover — Hours to days — Hours — $ (data egress and storage) — Downtime tolerance is hours or more and the workload tolerates data lag
2. Pilot Light — Data replicated continuously; core infra (databases, object storage) on; app servers loaded but switched off — 10s of minutes — Minutes — $$ (storage, minimal compute) — Downtime tolerance is minutes to an hour and data must survive
3. Warm Standby — Scaled-down but fully functional copy of production — Minutes — Seconds — $$$ (compute at reduced scale) — Downtime budget is minutes and brief degraded capacity is fine
4. Multi-site Active/Active — Both regions serve traffic continuously — About 0 — 0 or near 0 — $$$$ (full duplicate) — Every minute of downtime costs more than running two copies forever

AWS wording, verbatim

Backup and Restore — "replicate your data from one Region to another and provision a copy of your core workload infrastructure" (only at the moment of disaster)
Pilot Light — "Other elements, such as application servers, are loaded with application code and configurations, but are 'switched off.'"
Warm Standby — "can handle traffic (at reduced capacity levels) immediately."
Active/Active — "run your workload simultaneously in multiple Regions."

Region failure vs data corruption

> [!WARNING] Even multi-site active/active has non-zero RTO and RPO for data corruption. RTO=0 applies only to region-level failure; corruption means restoring from backup regardless of how many regions run.

Key concepts

Backup and Restore: Cheapest. Data replicated; infra rebuilt at failover. RTO: hours-days. Cost: $.
Pilot Light: "Data replication and backup, such as databases and object storage, are always on. Other elements, such as application servers, are loaded with application code and configurations, but are switched off." (AWS verbatim)
Warm Standby: "A scaled down, but fully functional, copy of your production environment in another Region." Can serve at reduced capacity immediately. (AWS verbatim)
Multi-site Active/Active: "Run your workload simultaneously in multiple Regions." Full duplicate. RTO ≈ 0. (AWS verbatim)
RTO / RPO data-corruption caveat: RTO=0 from active/active only covers REGION failure. Data corruption (bad code push, malicious actor) requires restore-from-backup → non-zero RTO regardless of strategy.

When to use it

Setting an RTO/RPO target with product/finance — the choice maps directly to one of these four
Reviewing a DR plan — does the strategy actually match the SLO's downtime budget?
Cost-optimisation reviews — multi-site active/active is real money; downgrade to warm standby if RTO/RPO allows
Disaster Recovery testing — different strategies need different drills

Interview questions

Walk me through the four AWS DR strategies and their trade-offs.
My SLO is 99.99% (52 min/yr). What DR strategy do I need?
Active-active sounds best. Why isn't it always the answer?
How do I decide between pilot-light and warm-standby?