5
Cloud
Single region with fast failover vs multi-region active-active for 99.99%
Availability ↔ Complexity
Context
Meet a 99.99% contractual SLA for a payments API.
We've signed a 99.99% availability SLA for our payments API. That is 52 minutes of downtime a year.
Option A: one AWS region across three AZs, plus a warm standby in a second region with Aurora Global Database and a rehearsed 10-minute failover.
Option B: active-active in two regions, with traffic split by latency and writes coordinated across regions.
My instinct says A, because the failure modes we actually hit are deploys and config changes, not regions vanishing. But the sales team promised "multi-region".
Constraints
- SLA
- 99.99% (52 min/year)
- RPO
- < 1 minute
- Team
- 7 platform engineers
Single region + warm standbyvsMulti-region active-active
Community verdict
Single region + warm standby 71%Multi-region active-active 29%
7 engineers · 4 opinions
With these constraints, what would you choose?
One choice per engineer. You can change it any time.
Single region + warm standby
Multi-region active-active
Simplicity →
Trade-offs
Dimensions
Single region + warm standbyMulti-region active-activeout of 5
- Availability
- 3Single region + warm standby scores 3 of 55Multi-region active-active scores 5 of 5
- Simplicity
- 5Single region + warm standby scores 5 of 51Multi-region active-active scores 1 of 5
- Data consistency
Community discussion
4 comments
Have you made this decision in production? Share your reasoning.
Sign in to commentA rehearsed failover beats an unrehearsed active-active every time. We run a game day every quarter where we fail over for real during business hours. The first one took 47 minutes; now it takes 6.
At 52 minutes a year, progressive delivery (canaries, automatic rollback) buys you more nines than a second active region.
Game days in business hours is a great forcing function. Leadership pushback must have been fun.
Check your SLA definition. Ours measured monthly, excluded scheduled maintenance, and credits were capped at 10% of the fee. That changes how much engineering the extra nine is worth.
Active-active is much easier if writes are partitionable: route each merchant to a home region and replicate asynchronously for reads. You avoid cross-region write conflicts entirely.