At the far end of the spectrum is the most robust, complex, and expensive DR strategy. It's also the only one that can achieve near-zero RTO and RPO simultaneously.
Active-Active (Hot Standby)
- How it works: Your entire application stack runs in two or more geographically distinct regions simultaneously. Both regions actively serve real user traffic at all times — this is not a standby that sits idle. A global load balancer (e.g., AWS Global Accelerator, Cloudflare Load Balancing, or a GeoDNS setup) sits in front and routes users to the closest healthy region based on latency and health checks.
- The Disaster Scenario: If one entire region fails, the global load balancer detects the health check failure within seconds and automatically redirects all traffic to the remaining healthy region(s). No human needs to declare a disaster or execute a runbook to restore service.
- RTO: Near-Zero. Typically the time for the load balancer to detect failure and update routing — often 10–60 seconds.
- RPO: Near-Zero. Data is replicated continuously, often with sub-second lag for asynchronous replication, or zero lag for synchronous replication (at the cost of write latency).
- Cost: Highest. You are running your full production environment twice (or more), all the time.
- Complexity: Extremely high. Keeping data consistent across regions in real-time is one of the hardest problems in distributed systems. You must reason carefully about the CAP theorem: during a network partition between regions, do you prioritize consistency (refuse writes in the degraded region) or availability (allow writes that may conflict)?
The Hidden Complexity: Data Consistency
The hardest part of Active-Active is not the compute or networking — it's the data layer. Consider what happens if a user submits an order that lands in Region A, and simultaneously another request for the same inventory item lands in Region B, before the replication has propagated. You can end up with conflicting writes. Solving this requires either:
- Synchronous replication: Every write is confirmed in both regions before returning success. Zero data loss, but adds cross-region network latency (typically 50–150ms) to every write operation.
- Asynchronous replication with conflict resolution: Writes are fast, but you need application-level logic to detect and resolve conflicts (last-write-wins, vector clocks, CRDTs, etc.).
This is why Active-Active is not the default answer for every system. The complexity cost must be justified by the business value of near-zero downtime.
A common senior-level interview question is: "Why wouldn't you just use Active-Active for everything?" The answer has three parts: (1) Cost — you're paying for double the infrastructure continuously; (2) Complexity — distributed data consistency across regions is genuinely hard and introduces new failure modes; (3) Overkill for most workloads — a marketing website or internal tool does not need the same DR posture as a financial trading platform. The right answer is always "it depends on the RTO/RPO requirements and the cost the business is willing to pay."