Route 53 failover routing and health checks for active-passive DR

#1. Health check on the primary

aws route53 create-health-check --caller-reference web-prim-2026-10-22 --health-check-config '{
  "Type": "HTTPS", "FullyQualifiedDomainName": "web-prim.example.com", "ResourcePath": "/healthz",
  "Port": 443, "RequestInterval": 10, "FailureThreshold": 3, "MeasureLatency": true,
  "Regions": ["ap-southeast-1", "eu-west-1", "us-east-1"]
}'

• Checks come from multiple Route 53 checker locations. Route 53 treats the endpoint as healthy if more than 18% of checkers report it healthy, so a problem seen from only a few locations doesn't trigger failover.
• /healthz should reflect whether the region can serve users: app up and its critical dependencies reachable.
• Allow the Route 53 health checker IP ranges through WAF/security groups.

#2. Failover records

{
  "Changes": [
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "app.example.com", "Type": "A", "SetIdentifier": "primary", "Failover": "PRIMARY",
        "HealthCheckId": "<primary-health-check-id>",
        "AliasTarget": { "HostedZoneId": "<alb-zone-id-aps1>", "DNSName": "alb-prim-123.ap-south-1.elb.amazonaws.com", "EvaluateTargetHealth": true } } },
    { "Action": "UPSERT", "ResourceRecordSet": {
        "Name": "app.example.com", "Type": "A", "SetIdentifier": "secondary", "Failover": "SECONDARY",
        "AliasTarget": { "HostedZoneId": "<alb-zone-id-aps2>", "DNSName": "alb-dr-456.ap-south-2.elb.amazonaws.com", "EvaluateTargetHealth": true } } }
  ]
}

aws route53 change-resource-record-sets --hosted-zone-id Z123 --change-batch file://failover.json

Alias records to ALBs use alias TTL behaviour; for non-alias records set TTL around 60 seconds.

#3. Manual control (avoid flapping)

Automatic failover is great for clear outages but can flap on partial failures, or fail over when the database in DR isn't ready. Options:

• An "inverted" health check you toggle, or a CloudWatch-alarm-based health check tied to an operator switch.
• Route 53 Application Recovery Controller (ARC) routing controls: highly available on/off switches that use the data plane, designed for regional failover.

#4. Data first, then DNS

Order of operations in a failover:

1. Promote data (Aurora Global failover, DynamoDB global tables already active, S3 MRAP switch).
2. Scale the DR application tier.
3. Then shift DNS. Otherwise users land on a DR app that can't write.

#5. Test

aws route53 get-health-check-status --health-check-id <id>
dig +short app.example.com @8.8.8.8

Simulate failure by making the primary /healthz return 503 in a test environment (or invert the health check) and measure the time until clients reach DR. Remember that some clients cache DNS longer than the TTL.

Tip

Put a health check alarm on the secondary too. Failover to a DR endpoint that's silently been broken for weeks is a common surprise.