3 ms·
This is a good approach if you can get enough redundancy with your instances and if instance failure is uncorrelated. However, what do you do if there's a mass
by chimeracoder 14y ago
This is a good approach if you can get enough redundancy with your instances and if instance failure is uncorrelated.
However, what do you do if there's a massive outage that affects most or all of your instances simultaneously? Diversification that fails when you need it the most isn't very helpful.
- seldo 14y agoAs I mention in the post, we go across AWS availability zones: these systems have physically separate power and networking. When they fail together, it's because they are connected at the software level -- usually EBS. If you're not using EBS, then Amazon's multi-AZ pattern is sufficient: just make sure your instances are spread across AZs. Of course, east-1 has fallen off the map entirely on at least one occasion -- for that reason we keep a "seed" set of warm databases in us-west; if east-1 were to have an extended outage we have a disaster recovery plan that involves transferring DNS to IPs in west and spinning up new app instances there.