Active-Passive Disaster Recovery
Cross-Cluster Search is for querying across silos. Cross-Cluster Replication (CCR) is for survival — ensuring your search infrastructure can withstand a regional AWS outage.
Without CCR, if us-east-1 experiences a major failure, your OpenSearch cluster is gone. Any application that depends on search — product catalogs, log dashboards, security alerts — goes dark.
With CCR, you maintain a continuously synchronized copy of your data in a second region:
- Leader Index: The index in your primary region (
us-east-1) that receives all writes. - Follower Index: An index in your secondary region (
us-west-2) that continuously pulls changes from the Leader using an internal replication protocol — not standard document writes.
How replication works internally:
The Follower index polls the Leader's operation log (similar to a database WAL — Write-Ahead Log) and replays operations in order. This is more efficient than re-indexing documents because it transfers only the delta (changes), not full documents.
Failover procedure:
1. Detect that us-east-1 is unavailable (via Route 53 health checks or manual assessment).
2. Send a POST /_plugins/_replication/follower-index/_stop command to the West cluster to stop replication.
3. Send a POST /_plugins/_replication/follower-index/_promote command to convert the Follower to a normal writable index.
4. Update your application's OpenSearch endpoint to point to us-west-2.
5. When us-east-1 recovers, re-establish replication in the reverse direction or re-sync from a snapshot.
RPO and RTO: CCR provides a Recovery Point Objective (RPO) of seconds to minutes (depending on replication lag) and a Recovery Time Objective (RTO) of minutes (the time to execute the failover procedure). This is far better than snapshot-based recovery, which typically has an RPO of hours.
Interviewers often ask: "What is the difference between Cross-Cluster Search and Cross-Cluster Replication?" The answer is about purpose and data movement. CCS federates queries across independent clusters without moving data — it is a read-time operation. CCR continuously replicates data from a Leader to a Follower — it is a write-time operation used for disaster recovery and geo-distribution. A follow-up question is often: "Can you use both together?" Yes — you can use CCR to maintain a replica in a second region and CCS to query both regions simultaneously for global search.