4 ms·
Whether or not your VPC can have subnets in multiple regions is entirely unrelated to security.
by dangus 8mo ago
Whether or not your VPC can have subnets in multiple regions is entirely unrelated to security.
- UltraSane 8mo agoI meant failure blast radius. Having isolated regions is a core part of the AWS reliability design. AWS has had entire regions fail but these failure have always been isolated to a single region. Global VPCs must rely on globally connected routers that can all fail in ways AWS regional VPCs can't.
- ses1984 8mo agoIf you need global HA to the extent that you're worried about global VPC failure modes, you're going to have to spend a lot of effort to squeeze uptime to the max regardless of where you deploy. Undersea cable failures are probably more likely than a google core networking failure. In AWS a lot of "global" things are actually just hosted in us-east-1.
- easton 8mo agoOn the other hand, when they say something is in us-west-2 they mean it, so if another region has an outage your workloads aren't impacted unless your code is reaching out to that region. Guessing that's similar on the other clouds.
- dangus 8mo agoI believe you’re likely misunderstanding Google’s architecture. The routing isn’t centralized, it’s distributed. The VPCs are a logical abstraction, not a centralized dependency. If you have a region/AZ going down in your global VPC, the other ones are still available. I think it’s also not that much of an advantage for AWS to be able to say its outages are confined to a region. That doesn’t help you very much if their architecture makes architecting global services more difficult in the first place. You’re just playing region roulette hoping that your region isn’t affected. Outages frequently impact all/multiple AZs.
- UltraSane 8mo agoRegions and Availability Zones are very different things. Regions are much more isolated.