Home / AWS

AWSHow-toIntermediate

AWS DR strategies compared: backup and restore, pilot light, warm standby, multi-site

Pick the right AWS disaster recovery strategy per application from RTO, RPO and cost, with the AWS services that implement each one and the failover steps they require.

Deepak Bhardwaj2 min read

Applies toMulti-region designs on AWS (EC2, RDS/Aurora, DynamoDB, S3, Route 53, AWS Backup, AWS Elastic Disaster Recovery)

The four strategies

Strategy RTO RPO What runs in the DR region Relative cost
Backup and restore Hours Hours (last backup) Nothing; backups copied there $
Pilot light Tens of minutes to hours Minutes Data layer replicating; compute off (AMIs, IaC ready) $$
Warm standby Minutes Seconds–minutes Scaled-down full stack running $$$
Multi-site active/active Near zero Near zero Full stack serving traffic $$$$

Building blocks per strategy

Backup and restore

  • AWS Backup plans with cross-region copy (EC2/EBS, RDS, EFS, DynamoDB, S3).
  • Infrastructure as code to recreate VPCs, IAM, load balancers.
  • Tested restore runbook; restore time is your RTO.

Pilot light

  • RDS cross-region read replica or Aurora Global Database; DynamoDB global tables; S3 replication.
  • AMIs copied to the DR region; launch templates and ASGs defined with capacity 0.
  • AWS Elastic Disaster Recovery for servers that can't be rebuilt from code.

Warm standby

  • Same as pilot light, plus ASGs running at minimum size, ALB in place, health-checked by Route 53.
  • Failover = promote data + scale out + switch DNS.

Multi-site

  • Route 53 latency or weighted routing to both regions; DynamoDB global tables or a write-region design for relational data.
  • Hardest part: data consistency and conflict handling.

What breaks DR plans most often

  • Service quotas in the DR region (EC2 vCPU limits, EIPs) never raised.
  • AMIs, KMS keys (use multi-Region keys or re-encrypt on copy), secrets and parameters missing in the DR region.
  • Hard-coded region names or ARNs in code.
  • Third-party allow lists only containing primary-region IPs.
  • DNS TTLs too long (set 60 s on records you'll switch).

Control plane vs data plane

During a regional event, prefer actions that use data plane operations (Route 53 health-check-driven failover, Route 53 ARC routing controls) over control-plane-heavy steps (creating resources), which may be impaired or throttled in a crisis.

Quick check commands

aws service-quotas get-service-quota --service-code ec2 --quota-code L-1216C47A --region ap-south-2   # running on-demand standard vCPUs
aws backup list-recovery-points-by-backup-vault --backup-vault-name dr-vault --region ap-south-2 --max-results 5
aws rds describe-global-clusters --query "GlobalClusters[].GlobalClusterMembers[]"

Tip

Not every application needs the same tier. A typical customer ends up with 10% warm standby, 30% pilot light and 60% backup and restore. That mix is far cheaper than "everything active/active".

Related fixes