Case Study: Route 53 and the 100% SLA

AWS Route 53 is the most famous example of the control/data plane separation in practice. AWS offers a 100% Availability SLA for Route 53 — the only AWS service with this guarantee. Understanding exactly what that means reveals the entire architecture.

The 100% SLA Applies Only to the Data Plane

The Route 53 Control Plane:
* What it does: You log into the console or call the API to change www.example.com to point to a new IP address.
* Where it runs: Centralized in us-east-1 (Northern Virginia).
* Reliability: High, but not 100%. It can have downtime. The SLA does not cover it.

The Route 53 Data Plane:
* What it does: A user's browser queries "What is the IP address for www.example.com?" and receives an answer.
* Where it runs: Across hundreds of Points of Presence (PoPs) distributed globally, each with its own copy of your zone data.
* Reliability: 100% SLA. Even if us-east-1 burns to the ground, the PoPs in Tokyo, Frankfurt, and São Paulo continue answering DNS queries from their local cache.

The Trap: DNS-Based Failover Done Wrong

Many teams build failover systems that work like this:

1. Monitor detects that the primary server is down.
2. Script calls ChangeResourceRecordSets to update the DNS record to point to the backup server.
3. DNS propagates. Traffic shifts.

This is a Control Plane dependency. Step 2 calls the Route 53 Control Plane — the part that does not have the 100% SLA. During a major outage (exactly when you need failover most), this API call may fail or be slow.

The Fix: Route 53 Health Checks (Data Plane Failover)

Route 53 Health Checks are a Data Plane feature. You configure them once (Control Plane, at setup time), and then the Route 53 Data Plane itself monitors your endpoints and automatically returns the healthy IP address without any API call from you.

Record: www.example.com
  → Primary: 1.2.3.4 (with health check)
  → Secondary: 5.6.7.8 (failover target)

When 1.2.3.4 fails its health check, the Route 53 Data Plane — running across all those global PoPs — automatically starts returning 5.6.7.8. No human intervention. No API call. No Control Plane involvement at runtime.