The "Big Red Button" Problem

When You Must Scale During an Outage

Static stability is the goal, but reality is messier. Sometimes a traffic spike is larger than your pre-provisioned capacity can absorb. You need to scale up — but so does every other company affected by the same AWS incident. The EC2 Control Plane gets hammered simultaneously by thousands of customers all trying to launch instances at the same moment.

This is the "Big Red Button" problem: the moment you most need to scale, the scaling mechanism is most likely to be degraded.

API Throttling and Capacity Contention

During a major AWS incident, two things happen simultaneously:

1. API throttling increases: AWS rate-limits RunInstances calls to protect the Control Plane from cascading failure. Your calls start returning RequestLimitExceeded errors.
2. Physical capacity contention increases: Other customers are also trying to launch instances in the same AZ. The "find me a free host" step of the Control Plane may fail with InsufficientInstanceCapacity.

Your automated scaling system, which works perfectly in normal conditions, fails precisely when you need it most.

The Reserve Capacity Solution: On-Demand Capacity Reservations (ODCR)

On-Demand Capacity Reservations (ODCR) are a mechanism to pre-reserve physical EC2 capacity in a specific AZ without running the instances. You pay the On-Demand rate whether or not you use the capacity.

• Without ODCR: During an outage, you call RunInstances and ask the Control Plane: "Please find me a free m5.2xlarge in us-east-1a." This may fail due to capacity contention.
• With ODCR: AWS has already set aside physical hosts for you. The Control Plane check becomes trivial: "Does this customer have a reservation? Yes. Assign them this pre-allocated host." The heavy lifting was done at reservation time, not at launch time.

You create a reservation by specifying the instance type, platform, target AZ, and instance count you want held; AWS sets aside exactly those physical hosts against your account, independent of what capacity contention is happening elsewhere in the region.

ODCRs are most valuable for your recovery infrastructure — the instances you plan to launch only when something goes wrong. These are exactly the instances you cannot afford to fail to launch.