System design · interactive

Failover and disaster recovery

Your whole primary region goes dark. How long until you're back (RTO), and how much recent data is gone (RPO)? Faster recovery means paying to keep more running in a second region all the time. Figures are typical, not exact.

strategy	RTO	RPO	cost
Backup and restore	8 h	24 h	1.1×
Pilot light	1 h	5 min	1.2×
Warm standby	15 min	1 min	1.5×
Active-active	1 min	~0	2.1×

Recovery steps

1Health checks fail
2Promote the standby database
3Scale up the small running fleet
4DNS fails over

Primary region

down

Second region normally runs

small full copy

Warm standby: back in about 15 min, losing up to 1 min of data, for about 1.5× the cost of a single region.

Strategy

Step 3 of 4 · read left to right

1
Agree RTO and RPO first
How long can the business be down, and how much data can it lose? The answers pick the strategy.
Different systems get different targets.
2
Backups and pilot light
Little runs in the second region; you rebuild during the disaster. Fine for internal tools.
Infrastructure as code makes rebuilding possible.
3
Warm standby and active-active
A running copy takes over in minutes or instantly. Active-active needs data replicated both ways and conflict handling.
Much more complex to build.
4
Run failover drills
Untested DR plans fail. Practise regularly and time it: that's your real RTO.
Game days, region evacuation tests.

In production

Tools and technologies

Clouds document these DR tiers explicitly.

Not tied to one language — use these names when you search docs or design a system.