A medical device company is designing a disaster recovery (DR) architecture for a critical patient monitoring application on AWS. The application runs on Amazon EC2 instances in private subnets across multiple Availability Zones in us-east-1 and must connect to external healthcare registries over the internet to update records. The database tier requires an Amazon Aurora PostgreSQL database. The business requires a Recovery Time Objective (RTO) of less than 15 minutes, a Recovery Point Objective (RPO) of less than 1 minute, and high availability for outbound connectivity within each region. Which of the following designs meets these requirements with the lowest operational overhead?
- ADeploy Amazon Aurora PostgreSQL in us-east-1 with daily AWS Backup jobs copy-replicated to us-west-2. Deploy the EC2 instances in private subnets across multiple Availability Zones in both regions, and set up a NAT Gateway in each Availability Zone. Use Amazon Route 53 Failover routing with health checks, and restore the database from the backup in us-west-2 upon failover.
- BDeploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. Deploy the EC2 instances in private subnets across multiple Availability Zones in both regions, and deploy a single NAT Gateway in a single Availability Zone in each region to minimize idle costs. Use Amazon Route 53 Failover routing with health checks, and promote the secondary Aurora cluster during a failover.
- CDeploy Amazon RDS PostgreSQL Multi-AZ in us-east-1 and a cross-region read replica in us-west-2. In both regions, deploy EC2 instances across multiple Availability Zones with a NAT Gateway in each Availability Zone. Configure the primary application to route read queries to the RDS Multi-AZ standby database instance to scale read performance, and promote the read replica in us-west-2 during a failover.
- Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In both regions, deploy the EC2 instances across multiple Availability Zones and deploy a NAT Gateway in each Availability Zone. Configure Amazon Route 53 with an Active-Passive Failover routing policy using health checks linked to the Application Load Balancer in each region, and promote the secondary Aurora cluster during a failover.Answer
Answer
Deploy Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in us-west-2. In both regions, deploy the EC2 instances across multiple Availability Zones and deploy a NAT Gateway in each Availability Zone. Configure Amazon Route 53 with an Active-Passive Failover routing policy using health checks linked to the Application Load Balancer in each region, and promote the secondary Aurora cluster during a failover.
The correct design utilizes Amazon Aurora Global Database to achieve near-zero RPO (asynchronous replication is fast and storage-based) and meets the RTO of under 15 minutes through promotion of the secondary cluster in the recovery region. To maintain high availability for outbound connectivity (required to connect to external registries), a NAT Gateway is deployed in each Availability Zone in both regions. This prevents a single AZ outage from interrupting outbound internet connectivity for the surviving AZs within a region. Lastly, Route 53 Failover routing records point to the local Application Load Balancers, routing traffic to the primary region during normal operations and failing over to the secondary region during a disaster.
Step-by-Step Solution
Key Concept
Multi-region disaster recovery using Amazon Aurora Global Database and Route 53 Failover routing while maintaining multi-AZ NAT Gateway redundancy.