Disaster Recovery and Business Continuity

Plan for outages with RPO and RTO, pick a DR strategy from backup and restore to multi-site active/active, and know AWS Backup and Elastic Disaster Recovery.

What is it?

A disaster is anything that takes a workload down for longer than a normal failure: a Region-wide outage, a flood at a data center, ransomware, or someone deleting a production database. Disaster recovery (DR) is how you get the workload back. Business continuity is the wider goal: keep the business running during and after the disruption.

A Business Continuity Plan (BCP) documents how the business keeps operating during an unplanned disruption. For each workload it sets two numbers:

  • Recovery Point Objective (RPO): the maximum acceptable data loss, measured as time since the last good recovery point. 'How much data can we afford to lose?' An RPO of one hour means backups or replication must be at most one hour behind.
  • Recovery Time Objective (RTO): the maximum acceptable downtime, from the interruption until service is restored. 'How long can we be down?'

The business, not the IT team alone, chooses these targets by weighing the cost of downtime and lost data against the cost and complexity of the recovery setup. Smaller RPO and RTO always cost more.

The four AWS DR strategies, from cheapest and slowest (cold) to most expensive and fastest (hot):

  • Backup and restore: back up data (and keep infrastructure as code), then rebuild everything after the event. RPO and RTO in hours. Lowest cost; fine for lower-priority workloads.
  • Pilot light: data is continuously replicated to another Region and only the core pieces (such as the database) are running. Servers are switched on and scaled up after the event. RPO and RTO in tens of minutes.
  • Warm standby: a scaled-down but fully working copy of production runs all the time in the recovery Region. On failover you scale it up. RPO and RTO in minutes. Suits business-critical workloads.
  • Multi-site active/active: a full-scale copy runs in another Region and serves real traffic all the time. Near-zero downtime and data loss for mission-critical workloads, at roughly double the infrastructure cost.

AWS services that help

  • AWS Backup: one place to define backup plans (schedules, retention, cross-Region and cross-account copies) for EC2, EBS, RDS, Aurora, DynamoDB, EFS, FSx, Storage Gateway and more.
  • AWS Elastic Disaster Recovery (AWS DRS), formerly CloudEndure Disaster Recovery: continuously replicates on-premises or cloud servers into a low-cost staging area in a target AWS account and Region, and launches full recovery instances within minutes when needed.
  • Replication features: EBS snapshot copies, S3 Cross-Region Replication, RDS cross-Region read replicas, Aurora Global Database and DynamoDB global tables.
  • Route 53 failover routing and health checks move users to the recovery site; CloudFormation rebuilds infrastructure quickly and identically.

Multi-AZ vs multi-Region: spreading across Availability Zones (Multi-AZ RDS, Auto Scaling across AZs) protects against a data center or AZ failure and is the normal baseline for high availability. Copying to a second Region protects against a Region-wide problem or a regional disaster, and is what the four DR strategies above usually mean. High availability keeps you running through small failures; DR gets you back after big ones.

Exam tip: match the words in the question. 'Lowest cost, hours acceptable' = backup and restore. 'Core database always replicated, start servers when needed' = pilot light. 'Scaled-down full copy always running' = warm standby. 'Zero downtime, full copy serving traffic' = multi-site active/active.

Explain like I'm 10

Think about a bakery preparing for a fire. Backup and restore is keeping the recipes in a safe at home: you can rebuild, but it takes days. Pilot light is a second kitchen with the oven's pilot flame lit and flour in stock: you need to turn things on and hire staff. Warm standby is a small second shop already baking a few loaves that can ramp up quickly. Active/active is two full bakeries serving customers every day: if one burns, the other carries on.

Examples

Choosing a DR strategy

Workload                     RPO / RTO target     Strategy
---------------------------  -------------------  -----------------
Internal wiki                24 h / 24 h          Backup and restore
Order history reports        1 h / 1 h            Pilot light
Customer web shop            minutes / minutes    Warm standby
Payment processing           ~0 / ~0              Multi-site active/active

Each step down the table costs more because more infrastructure runs all the time in the recovery Region.

A daily backup plan with a cross-Region copy (AWS Backup)

aws backup create-backup-plan --backup-plan '{
  "BackupPlanName": "daily-35d",
  "Rules": [{
    "RuleName": "daily",
    "TargetBackupVaultName": "Default",
    "ScheduleExpression": "cron(0 3 * * ? *)",
    "Lifecycle": { "DeleteAfterDays": 35 },
    "CopyActions": [{
      "DestinationBackupVaultArn": "arn:aws:backup:eu-central-1:111122223333:backup-vault:dr-vault"
    }]
  }]
}'

Assign resources to the plan (for example by tag) with create-backup-selection. The copy to another Region protects against a regional disaster; the daily schedule sets an RPO of about one day.

How it works

Every DR strategy has two halves: getting data to the recovery site (backups or continuous replication, which sets your RPO) and getting compute running there (rebuild, start, scale or already live, which sets your RTO).

With backup and restore, snapshots and backups are copied to another Region and infrastructure is rebuilt from templates. Pilot light and warm standby replicate data continuously (for example a cross-Region database replica) while keeping little or some compute running. In active/active both Regions take traffic and data is replicated both ways.

Failover is usually triggered by health checks: Route 53 notices the primary is unhealthy and starts answering with the recovery site's address. Test the plan regularly; a DR plan that has never been rehearsed rarely meets its RTO.

  cost / speed  low ------------------------------> high
  Backup &        Pilot          Warm           Active/
  restore         light          standby        active
  [data only]     [DB running]   [small copy]   [full copy]
  RPO/RTO hours   10s of min     minutes        near zero
        Primary Region ==replicate==> Recovery Region
                 Route 53 failover sends users across

Why does it exist?

Hardware fails, people make mistakes and whole areas can be hit by disasters. Without a plan, recovery is improvised, slow and often incomplete. Defining RPO and RTO up front lets a business pay for exactly the level of protection each workload needs.

When to use it

Every production workload needs at least backups and a tested restore. Move up to pilot light, warm standby or active/active as the cost of downtime and data loss grows. Use AWS Backup to centralise backups and Elastic Disaster Recovery to protect servers (including on-premises ones) with low RPO and RTO.

When not to use it

Do not pay for multi-site active/active for workloads that could tolerate a few hours of downtime. Do not rely on Multi-AZ alone when the requirement is to survive a Region-wide event, and do not treat replication as a backup: deletions and corruption replicate too, so keep point-in-time backups as well.

Common mistakes

  • Mixing up RPO (data loss) and RTO (downtime).

  • Assuming Multi-AZ is a disaster recovery plan for a Region-wide outage.

  • Never testing restores, then discovering backups are incomplete or too slow to restore.

  • Keeping backups only in the same Region and account as production.

  • Treating replication as a backup, so an accidental delete is copied to the DR site instantly.

  • Calling the service CloudEndure Disaster Recovery; it is now AWS Elastic Disaster Recovery.

Practice exercises

  1. Easy:

    Define RPO and RTO in one sentence each and give a business example of a 4-hour RPO.

  2. Medium:

    Order the four DR strategies by cost and recovery time, and give one workload that suits each.

  3. Medium:

    Design an AWS Backup plan for EC2, RDS and EFS with daily backups, 35-day retention and a copy in a second Region.

  4. Hard:

    A shop needs an RTO of 15 minutes and RPO of 1 minute at the lowest reasonable cost. Pick a strategy, name the AWS services for data replication and failover, and describe a failover test.

Interview questions

What is the difference between RPO and RTO?

RPO is the maximum acceptable data loss, measured back to the last recovery point. RTO is the maximum acceptable time to restore service after an interruption.

Exam-style: Which DR strategy has the lowest cost and the longest recovery time?

Backup and restore.

Exam-style: Which DR strategy keeps a scaled-down but fully functional copy of production running at all times?

Warm standby.

Exam-style: Which DR strategy keeps only core components such as the database running and replicated in another Region?

Pilot light.

Exam-style: Which DR strategy gives near-zero downtime by running full production in multiple Regions?

Multi-site active/active.

Exam-style: Which service continuously replicates on-premises servers to AWS for fast recovery?

AWS Elastic Disaster Recovery (formerly CloudEndure Disaster Recovery).

Exam-style: Which service centrally manages and automates backups across many AWS services?

AWS Backup.

Does Multi-AZ protect against a Region-wide outage?

No. Multi-AZ protects against the loss of a data center or Availability Zone; surviving a Region outage needs a copy in another Region.