Availability, Recovery, RTO, and RPO

Availability, Recovery, RTO, and RPO

RTO sets acceptable restoration time and RPO sets acceptable time-based data loss; an Availability Zone failure differs from a regional disaster. This lesson applies the rule by turning outage and data-loss impact into a testable architecture decision.

A recovery point must survive compromise of the workload account and deletion of its resources. What action fits? Decision: Copy recovery points to a vault in a separate security account. Reason: Account separation preserves a copy outside direct compromise of the source boundary.

Application targets behind an ALB span two Availability Zones, but each target keeps user sessions in local memory. Any target must serve the user without session loss after one Zone fails. What should change? Decision: Externalize session state to a durable shared store and keep application targets stateless. Reason: External state makes targets interchangeable, and the session store itself must be available and replicated across the intended Availability Zones so the failure point is not merely moved.

A service must recover from Region failure within minutes. Ready capacity must carry initial traffic, and remaining scale-out may complete inside the RTO. Which pattern fits? Decision: Use warm standby with reduced running capacity in a second Region that can carry initial traffic, test failover, and include remaining scale-out inside the RTO. Reason: Warm standby keeps a minimally sufficient working copy; it does not promise instant full production capacity, and remaining scaling is included in the RTO.

The customer owns the operating systems of an EC2 fleet and wants patches applied in a controlled window with reviewable compliance results. What solution fits? Decision: Systems Manager Patch Manager with a policy or baseline, a maintenance window, and retained results. Reason: Patch Manager orchestrates guest OS scanning and patching and can run in a window with compliance tracking.

A reference instance is approved, and replacements must launch with the same root-volume software while runtime data stays external. Which artifact fits? Decision: An approved versioned AMI. Reason: An AMI preserves a reusable launch baseline for consistent instances while runtime data remains external.

Original instructional case: An archive system must recover from complete loss of an AWS Region, accepts an 8-hour RTO and a 24-hour RPO, and prioritizes low ongoing recovery cost. Which strategy fits? Decision: Copy backups to another Region and rehearse restoration against the RTO and RPO. Backups copied to another Region provide a recovery point after complete Region loss. Backup and restore fits the eight-hour RTO and one-day RPO with lower permanent capacity, and a restore rehearsal proves the objectives.

A cloud initiative requires a $200,000 investment and produces $260,000 of measurable gross benefit over the same horizon. What is the simple ROI? Net benefit is $260,000 minus $200,000, or $60,000. Simple ROI is net benefit divided by investment, which is 30%; initiatives must use the same scope and horizon for a meaningful comparison.

A migration eliminates an $80,000 annual tooling renewal and frees 600 operations hours that staff will redirect to product work with no positions removed. How should the two benefits be recorded? Canceling the renewal removes an actual expense, so $80,000 is cash cost avoidance. Redirected hours are capacity or productivity value, not cash savings unless a corresponding expense or contract is actually removed.

An initiative costs $240,000 now and generates $60,000 of incremental cash flow at the end of each year. Ignoring discounting for this measure alone, what is the payback period? Payback measures the time until cumulative cash flows equal the initial investment: $240,000 divided by $60,000 is four years. This result does not measure value after year four or the time value of money.

A service objective requires 99.95% monthly availability for a 30-day month. What approximate maximum downtime does the error budget allow before the objective fails? Unavailability is 0.05%. A 30-day month has 43,200 minutes; 43,200 × 0.0005 = 21.6 minutes. This is the decision budget before evaluating designs, not proof that a named service meets it.

The RPO is 15 minutes. In a drill the source is lost at 10:00, the latest committed source write is 09:59, and the latest recoverable write is 09:38. What is the gate result? RPO measures maximum acceptable data loss. The gap from 09:59 to 09:38 is 21 minutes, so copy existence alone does not prove the objective and a separate RTO measure cannot substitute for it.

The business requires automatic service continuity within minutes after an Availability Zone loss, but accepts rebuilding an entire Region within four hours from tested definitions and copies. How should the two needs be classified? The Zone failure calls for rapid operational continuity within the architecture, while Region loss permits a timed recovery process. Separating them avoids imposing an unrequested hot-Region cost.

Finance compares buying owned servers up front with monthly payment for consumed cloud resources. How are the examples classified? The up-front owned asset is capital expenditure, while ongoing metered consumption is operating expenditure in this example.

A control reduces annual outage probability from 10% to 2%. Outage impact is $500,000 and the control costs $25,000 per year. What is the correct analysis? Expected loss falls from $50,000 to $10,000, a $40,000 reduction. After the $25,000 cost, expected value is $15,000; probability makes this risk value rather than realized cash.

A showback policy adopts successful-request consumption as its driver, and measurement confirms comparable variable operating cost per request across products. The platform costs $120,000; A, B, and C record 60, 30, and 10 million requests, while $20,000 of central support has no proven driver. How should the policy be applied? Because the policy adopts a validated driver with comparable cost per request, allocate $100,000 by 60/30/10. Keep $20,000 visible and unallocated until a driver is proven, preserving reconciliation and avoiding false precision.

AWS Backup centralizes backup plans, schedules, retention rules, and policy application across supported resources and accounts. The service coordinates backup governance; restore testing and evidence remain necessary because policy assignment alone does not prove recoverability.