This isn't true, not when you can boot a large application cluster and promote/upgrade a database replica in minutes. This is correct. Unfortunately, in the AW

This isn't true, not when you can boot a large application cluster and promote/upgrade a database replica in minutes. This is correct. Unfortunately, in the AWS context those of us who confidently planned to react to trouble in zone US-EAST-X by launching a new cluster in US-EAST-Y have often been frustrated by failures in Amazon's control plane. When one zone goes down hard, instances in other zones generally stay running - though the anecdotal evidence is not perfectly clear - but the ability to spin up new instances or drives in other zones often breaks. What I don't remember seeing is a case where a failure spanned regions. Which does not mean that can't happen; perhaps a catastrophic latent bug in Amazon's control software could kick it off. But it is far less likely. So planning to spin up in a distant region is a workable plan, and then your point is back to being correct. But spanning regions takes a bit more work and planning. And, needless to say, everyone's RTO is different. When people talk casually about "100% uptime" I tend to think "30 seconds", in which case redundant running instances is the solution, but obviously you do have to specify it. Because if you can live with 5 minutes, or even 30 minutes, as most apps probably can, your life will be much easier.