Question

Difficulty: Very hardHigh Availability and Disaster Recovery Design

A smart grid utility company is designing a real-time smart-meter telemetry ingestion platform across two AWS Regions: us-east-1 (primary) and eu-west-1 (secondary). The platform must achieve a Recovery Time Objective (RTO) of less than 5 minutes and a Recovery Point Objective (RPO) of less than 1 minute.

The architecture consists of:
- An ingress tier in each region running containerized applications on AWS Fargate in private subnets, behind an Application Load Balancer (ALB).
- Outbound connections from Fargate tasks to external grid devices that require highly resilient internet access.
- A persistence tier using Amazon Aurora PostgreSQL.
- An internal metadata microservice deployed in a shared services VPC in us-east-1 that resolves via a Route 53 Private Hosted Zone (PHZ) named grid.internal.

During normal operations, global telemetry traffic must be routed to the region with the lowest latency. If a regional outage occurs, all traffic must automatically fail over to the surviving region. The secondary region should operate in a cost-optimized warm standby configuration, scaling up its ECS tasks only during a failover.

Which solution meets these requirements while minimizing cost and operational complexity?

  1. Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. In each region, deploy the Fargate tasks across three Availability Zones (AZs) and provision a NAT Gateway in each AZ. Establish VPC peering between the eu-west-1 application VPC and the shared services VPC, and associate the grid.internal PHZ with both application VPCs. Create Route 53 latency-based routing records pointing to each regional ALB and associate them with Route 53 health checks.Answer
  2. B
    Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. In each region, deploy the Fargate tasks across three Availability Zones (AZs), but provision a single NAT Gateway in the first AZ of each VPC to optimize network resource costs. Establish VPC peering between the eu-west-1 application VPC and the shared services VPC, and associate the grid.internal PHZ with both application VPCs. Create Route 53 latency-based routing records pointing to each regional ALB and associate them with Route 53 health checks.
  3. C
    Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. In each region, deploy the Fargate tasks across three Availability Zones (AZs) and provision a NAT Gateway in each AZ. Establish VPC peering between the eu-west-1 application VPC and the shared services VPC, and enable DNS resolution support on the peering connection. Rely on the peering connection's native DNS features to resolve grid.internal in eu-west-1 without manually associating the PHZ with the secondary VPC. Create Route 53 latency-based routing records pointing to each regional ALB and associate them with Route 53 health checks.
  4. D
    Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. In each region, deploy the Fargate tasks across three Availability Zones (AZs) and provision a NAT Gateway in each AZ. Establish VPC peering between the eu-west-1 application VPC and the shared services VPC, and associate the grid.internal PHZ with both application VPCs. Configure Route 53 latency-based routing records pointing to each regional ALB, but do not associate health checks to prevent split-brain DNS states; instead, implement an AWS Lambda function triggered by Amazon CloudWatch alarms to manually swap DNS records during a regional failover.

Answer

Configure Amazon Aurora Global Database with the primary cluster in us-east-1 and a secondary cluster in eu-west-1. In each region, deploy the Fargate tasks across three Availability Zones (AZs) and provision a NAT Gateway in each AZ. Establish VPC peering between the eu-west-1 application VPC and the shared services VPC, and associate the grid.internal PHZ with both application VPCs. Create Route 53 latency-based routing records pointing to each regional ALB and associate them with Route 53 health checks.
The configuration using Amazon Aurora Global Database ensures sub-second data replication (meeting the RPO of 1 minute) and enables promotion of the secondary cluster in less than a minute. Utilizing a NAT Gateway in each Availability Zone prevents an AZ outage from disabling outbound internet access for tasks in the other AZs. Associating the Private Hosted Zone with the secondary VPC allows private resolution of grid.internal. Finally, Route 53 latency-based routing records with active health checks ensure that traffic is directed to the lowest-latency healthy endpoint and automatically routed to the secondary region during a failure, satisfying the RTO of 5 minutes.

Step-by-Step Solution

1
Select the database replication strategy.
Amazon Aurora Global Database provides sub-second replication latency to the secondary region, yielding an RPO of under 1 second, and can be promoted to a primary cluster in under 1 minute, satisfying the RTO constraint.
Standard multi-region deployments require storage-level or database-level replication to guarantee minimal data loss (RPO < 1 minute) and rapid failover (RTO < 5 minutes).
2
Design the outbound network connectivity for high availability.
Provision a NAT Gateway in each of the three Availability Zones per region.
A single NAT Gateway per VPC represents a single point of failure; an AZ outage would block outbound traffic from the remaining AZs.
3
Establish cross-region name resolution for the Private Hosted Zone.
Associate the Route 53 Private Hosted Zone (PHZ) grid.internal with the VPCs in both regions.
VPC peering does not automatically resolve private domains across VPC boundaries; the PHZ must be explicitly associated with each VPC that needs to resolve the domain.
4
Configure the global traffic routing policy.
Create Route 53 latency-based routing records associated with Route 53 health checks.
This setup routes users to the lowest-latency endpoint under normal conditions and automatically redirects traffic to the secondary region if the primary region's ALB health check fails.

Key Concept

Multi-region disaster recovery design integrating storage replication, private DNS resolution across accounts/regions, NAT redundancy, and automated DNS failover.
Rate this question