Multi-region and disaster recovery

Every disaster recovery conversation starts by extracting two numbers from the business: RTO, how long until service is restored, and RPO, how much data you can afford to lose. Those two numbers set the budget, and the correct first response to "we cannot lose any data and cannot be down" is to ask for them, then show the cost curve.

The most useful thing to say in this area is that untested failover is fiction, and that failback is harder than failover. The hard part of a region evacuation is not the mechanics, it is deciding to do it.

What this chapter covers

• [done] RTO and RPO, extracted and priced
• [todo] The DR ladder: backup and restore, pilot light, warm standby, active-active
• [todo] Active-active conflict resolution: last-writer-wins, CRDTs, single-writer-per-key
• [todo] Global load balancing: GeoDNS, anycast, health-check routing
• [todo] The write path question: global strong consistency vs regional writes
• [todo] Data residency pinning users to regions
• [todo] Who declares failover, and at what threshold
• [todo] A full DR runbook example
• [todo] Failback and split-brain reconciliation
• [todo] The dependency audit: identity provider, DNS, secrets manager
• [todo] Backup hygiene: 3-2-1, immutable copies, and restore testing
• [todo] Cell-based architecture and blast radius

Source: §32.