Run production in two zones or more

How to do it

A zone is a separate data centre with its own power and network, so a fire or power cut takes out one zone only. Create a subnet in each zone and spread servers or containers across them behind one load balancer. Some managed services copy data across zones by themselves, such as object storage and many serverless databases. Others need a setting, such as a managed database's standby in a second zone. Size each zone so the rest can carry the peak, as Keep headroom says. Drill the database side as Test what a failover loses does. A second region is a separate decision, made from the recovery targets.

Examples

Terraform example

resource "aws_db_instance" "orders" {
  identifier     = "orders"
  engine         = "postgres"
  instance_class = "db.t4g.medium"
  multi_az       = true
}

resource "aws_autoscaling_group" "web" {
  name                = "web"
  min_size            = 2
  max_size            = 6
  vpc_zone_identifier = [aws_subnet.private_a.id, aws_subnet.private_b.id]
}

Shell example

# Fails when a production database has no standby in a second zone.
aws rds describe-db-instances --query 'DBInstances[?MultiAZ==`false`].DBInstanceIdentifier' --output text

How to check

A script lists every production load balancer target group, database and cache. Each has healthy members in two zones or more. In a staging drill, traffic is moved away from one zone, and the error rate stays within its objective.

Sources

• AWS Well-Architected REL10-BP01 Deploy the workload to multiple locations

Related rules

• Keep headroom in Operations
• Test what a failover loses in Data
• Set recovery targets in Operations
• Make one server fast before you add more in Scaling