4 ms·
Reading the paper[1] linked from Jeff's post: > In Aurora, we have chosen a design point of tolerating (a) losing an entire AZ and one additional node (AZ+1) w
by ben509 8y ago
Reading the paper[1] linked from Jeff's post:
> In Aurora, we have chosen a design point of tolerating (a) losing an entire AZ and one additional node (AZ+1) without losing data, and (b) losing an entire AZ without impacting the ability to write data. We achieve this by replicating each data item 6 ways across 3 AZs with 2 copies of each item in each AZ. We use a quorum model with 6 votes (V = 6), a write quorum of 4/6 (V w = 4), and a read quorum of 3/6 (V r = 3). With such a model, we can (a) lose a single AZ and one additional node (a failure of 3 nodes) without losing read availability, and (b) lose any two nodes, including a single AZ failure and maintain write availability. Ensuring read quorum enables us to rebuild write quorum by adding additional replica copies.
There are many 2 AZ regions in AWS, of course. I don't think you can stripe 3 copies per AZ, an AZ failure drops you to potentially 2/6, and if you allow for 2/6 and 3/6 writing you could have a split brain. Any thoughts how they manage that?
[1] https://www.allthingsdistributed.com/files/p1041-verbitski.pdf https://www.allthingsdistributed.com/files/p1041-verbitski.p...
- exawsthrowaway 8y agoI left AWS before Aurora was introduced, but I suspect it's similar to how S3 fulfills a similar promise. From the S3 FAQ[1]: > Amazon S3 Standard, S3 Standard-Infrequent Access, and Amazon Glacier storage classes replicate data across a minimum of three AZs to protect against the loss of one entire AZ. This remains true in Regions where fewer than three AZs are publicly available. Italic emphasis is mine. [1] https://aws.amazon.com/s3/faqs/ https://aws.amazon.com/s3/faqs/
- arosenbaum 8y agoAWS has consistently stated Aurora storage spans 3 AZs. I believe some 2 AZ regions have a third AZ for internal AWS use only (not a 3rd DC in small regions but otherwise a separate AZ). I would imagine they might run the 5th + 6th copies in storage cells there...seems more likely than the other options...
- discodave 8y agoAWS has long had AZs that were not exposed via EC2, as somebody else pointed out, the S3 FAQ gives the game away that some regions have a 'hidden' AZ. They are slowly adding a 3rd AZ to regions that didn't have one already. E.g. https://aws.amazon.com/blogs/aws/now-open-third-aws-availability-zone-in-london/ https://aws.amazon.com/blogs/aws/now-open-third-aws-availabi... https://aws.amazon.com/about-aws/whats-new/2018/03/aws-govcloud-us-region-adds-third-availability-zone/ https://aws.amazon.com/about-aws/whats-new/2018/03/aws-govcl... http://www.datacenterdynamics.com/content-tracks/colo-cloud/aws-opens-third-availability-zone-in-singapore/99634.fullarticle http://www.datacenterdynamics.com/content-tracks/colo-cloud/...