High availability or disaster recovery: where to invest first?
Continuous service ↔ Recovery capability
Context
Choose this year’s one resilience project for a payments platform.
We have budget for one resilience project this quarter.
Today: the app runs across three availability zones, but the database is single-AZ, and our only recovery is a nightly backup in the same region.
Option A: high availability, a Multi-AZ database with automatic failover, so a zone or instance failure costs seconds.
Option B: disaster recovery, point-in-time recovery, backups copied to another region and account, and a rehearsed regional restore. The regulator is asking for this.
Which first?
Constraints
- Today
- Multi-AZ app, single-AZ database, nightly backups
- Budget
- One quarter, two engineers
- Audit
- Regulator asks for a tested DR plan
High availability (in-region redundancy)vsDisaster recovery (cross-region recovery)
Community verdict
10 engineers · 5 opinions
With these constraints, what would you choose?
One choice per engineer. You can change it any time.
Everyday outages handled →
Trade-offs
Dimensions
- Everyday outages handled
- 5High availability (in-region redundancy) scores 5 of 52Disaster recovery (cross-region recovery) scores 2 of 5
- Regional disaster handled
- 1High availability (in-region redundancy) scores 1 of 55Disaster recovery (cross-region recovery) scores 5 of 5
- Recovery from data corruption
Community discussion
5 comments
Have you made this decision in production? Share your reasoning.
Sign in to commentHA does nothing against ransomware, a bad migration or an engineer's DELETE: it replicates the damage instantly. Point-in-time recovery to an isolated account is the only defence.
And a regulator asking is a deadline, not a suggestion.
Make the backup account write-only from production. Attackers who own prod shouldn’t be able to delete your backups.
HA first, because you are exposed to the common failure every day: a single-AZ database is your most likely outage. Multi-AZ failover is mostly configuration on a managed database, so it's a week, not a quarter.
Then spend the rest of the quarter on DR.
Fair: Multi-AZ is cheap enough that it doesn’t really compete for the quarter.
A backup you have never restored is a hope, not a plan. Schedule a quarterly restore drill with a stopwatch.