Home / AWS

AWSRunbookAdvanced

AWS Elastic Disaster Recovery (DRS): replicate servers, drill and fail over

Use AWS Elastic Disaster Recovery to replicate EC2 or on-premises servers to a DR region, configure launch settings, run non-disruptive drills, perform recovery and fail back.

Deepak Bhardwaj2 min read

Applies toAWS Elastic Disaster Recovery (DRS) for EC2-to-EC2 cross-region and on-premises/other-cloud to AWS

How DRS works

  • An AWS Replication Agent on each source server streams block-level changes to a lightweight staging area (small replication servers + cheap EBS) in the target region.
  • Point-in-time snapshots are kept (by default for 7 days, configurable).
  • On recovery, DRS converts and launches full-size recovery instances from the chosen point. RPO is typically seconds; RTO typically minutes, plus your app checks.

1. Initialise and configure

Initialise DRS in the target region (console → Elastic Disaster Recovery → Set default replication settings): staging subnet, replication server instance type, EBS type, encryption key, point-in-time policy, bandwidth throttling.

2. Install the agent

# Linux source server
wget -O ./aws-replication-installer-init https://aws-elastic-disaster-recovery-ap-south-2.s3.ap-south-2.amazonaws.com/latest/linux/aws-replication-installer-init
chmod +x aws-replication-installer-init
sudo ./aws-replication-installer-init --region ap-south-2

(Windows: the .exe installer from the same regional bucket.) Prefer an IAM role or short-lived credentials for installation. Source servers need outbound TCP 443 to DRS and TCP 1500 to the replication servers.

3. Launch settings per server

  • Target instance type (right-sizing on or off), subnet, security groups, private IP (copy source IP if your network design allows).
  • EC2 launch template defaults: IAM instance profile, tags, licence settings.
  • Post-launch actions (SSM documents) for steps like updating config files or DNS.

4. Drill (non-disruptive)

aws drs start-recovery --is-drill --source-servers sourceServerID=s-1234567890abcdef0 --region ap-south-2
aws drs describe-jobs --region ap-south-2 --max-results 5

Replication continues during drills. Test the app on the drill instances in an isolated subnet, record timings, then terminate the drill instances.

5. Real recovery

  1. Choose the recovery point (latest, or before a corruption/ransomware event).
  2. Launch recovery for the group of servers (start databases first).
  3. Validate, switch DNS/load balancer targets.
  4. Communicate.

6. Failback

  • On-premises: boot the source with the DRS Failback Client ISO to replicate back.
  • EC2 cross-region: start reverse replication from the recovery instances, then perform a planned recovery back to the original region.

Checks

aws drs describe-source-servers --region ap-south-2 \
  --query "items[].{host:sourceProperties.identificationHints.hostname, state:dataReplicationInfo.dataReplicationState, lag:dataReplicationInfo.lagDuration}" --output table

Alert when dataReplicationState isn't CONTINUOUS or lag grows.

Tip

Keep the DR region's VPC, security groups and DNS defined in IaC, and run a drill monthly for Tier 1 servers. DRS makes the server part easy; the network and dependencies are where drills usually fail.

Related fixes