Keeping two infras in sync means that you gotta have some kind of formalized management process. If you do have that, then there isn't much value in having the

Keeping two infras in sync means that you gotta have some kind of formalized management process. If you do have that, then there isn't much value in having the fail over up and running at all time, you can just build/launch it if needed. This is easy in a containerized env, if you don't have that luxury having batch scripts that can provision all the critical servers quickly does the trick. This combined with reliable database backups should be enough to make the impact of such an attack trivial.