Warm-standby DR across an AU region pair — defined trigger, rehearsed failover
Warm-standby DR across an AU region pair
Sydney (ap-southeast-2) primary, Melbourne (ap-southeast-4) warm standby: a scaled-down copy of the stack kept running, fronted by Aurora Global Database replicating cross-region at ~1 second. The deliberate midpoint — cheaper than active-active, far faster than backup-and-restore — hitting RTO <15 min / RPO ~1s when drilled.
Problem it solves
- Regulated AU workloads (credit licensee, CPS 230 model) need continuity evidence funders and risk committees test: defined RTO/RPO, rehearsed failover, and data residency that DR never breaks (both regions in Australia).
Shape
- Multi-AZ primary (3 AZs, 99.95% target) + cross-region warm standby with Aurora Global Database (~1s replication, managed promote).
- Failover runbook: 1) incident commander declares on defined trigger (not ad-hoc), 2) promote DB replica to writer, 3) scale up standby app tier, 4) Route 53 flip via Application Recovery Controller — OIDC callback URLs and egress allow-lists already include the DR endpoint.
- Quarterly DR game day: full Sydney → Melbourne failover, timed against RTO/RPO.
- Evidence as a feature: the drill results are the audit artifact.
Rules
- The DR trigger is defined and authorised — a person declares, never automation alone.
- DR endpoints (callbacks, allow-lists, secrets) are provisioned before failover day, not during.
- Nothing leaves Australia: compute, DB, backups, DR copy all in AU regions — residency enforced by policy.
- Backups immutable (Object Lock) and access-logged; the audit trail survives the admin it records (org SCPs).
Anti-patterns
- Backup-and-restore as the only plan (RTO hours, not minutes).
- Active-active assumed before warm standby is drilled — pay for complexity only after the midpoint is proven.
- DR endpoints wired at failover time — the 3am scramble is the failure mode.
- Untested runbooks — an unrehearsed DR plan is a hypothesis, not a capability.
Sources
- aws-infra/docs/aws-design-guide.html (§06 resilience & DR, Fig 5, failover runbook, game-day table)
- aws-infra/org/variables.tf (Sydney primary, Melbourne DR data residency)
- aws-infra/org/scp.tf, modules/log-archive (immutable audit trail)