Once you have your RTO and RPO targets, you can select an architecture. There is a direct, unavoidable trade-off: lower RTO and RPO targets cost significantly more to achieve. Understanding this spectrum lets you have an honest conversation with business stakeholders about what they're actually buying.
Here are the four canonical DR strategies, ordered from cheapest/slowest to most expensive/fastest.
1. Backup and Restore (Cold Standby)
- How it works: You take regular snapshots of your data and ship them to a geographically separate location (e.g., an S3 bucket in a different AWS region). Your infrastructure in the DR region does not exist until a disaster is declared. When disaster strikes, you provision infrastructure from scratch using IaC (Terraform, CloudFormation) and restore data from the most recent backup.
- RTO: Hours to Days. You're building an entire environment from zero under pressure.
- RPO: Determined by backup frequency. Daily backups = up to 24 hours of data loss.
- Cost: Lowest. You pay only for storage of the backups, not for running compute.
- Best for: Non-critical internal tools, development environments, or businesses with very high tolerance for downtime.
2. Pilot Light (Minimal Passive)
- How it works: You keep a minimal, always-on footprint in the DR region — specifically, your database replica is continuously receiving replicated data from the primary. However, the application servers (VMs, containers, load balancers) are turned off or don't exist. When disaster strikes, you turn on and scale up the compute layer and point it at the already-warm database.
- RTO: Minutes to Hours. Compute provisioning is faster than a full rebuild, but still takes time.
- RPO: Low — typically minutes, determined by replication lag between primary and replica.
- Cost: Low-Medium. You pay for the replica database continuously, but not for idle compute.
- Best for: Applications where data is the hardest thing to recover, and compute can be spun up quickly via automation.
- The name explained: Like a pilot light on a gas stove — a tiny flame is always burning so you can ignite the full burner quickly.
3. Warm Standby (Scaled-Down Active)
- How it works: A fully functional but scaled-down version of your entire environment runs continuously in the DR region. It might handle only 10–20% of normal production traffic. Data is continuously replicated. In a disaster, you scale up the DR environment to handle 100% of traffic (by increasing instance counts, scaling up database tiers, etc.).
- RTO: Minutes. The environment is already running; you just need to redirect traffic and scale up.
- RPO: Seconds to Minutes. Continuous replication keeps the replica very close to the primary.
- Cost: Medium-High. You're paying for a permanently running (though smaller) second environment.
- Best for: Business-critical applications where a few minutes of downtime is acceptable but hours are not.
4. Active-Active (Hot Standby)
Covered in detail in the next section.