Disaster recovery: how do I design an active-passive scenario around RTO and RPO?

Short answer: you don’t choose the architecture, RTO 30min / RPO 5min chooses it. Those two numbers determine, on their own, which disaster recovery strategy you build.

The real issue is this: RPO and RTO aren’t abstract goals, they’re figures that translate directly into technical decisions. Read the number, build the architecture to match.

1. RPO 5min = continuous replication, not a nightly dump. Cross-region streaming replication (or an RDS cross-region read replica) + ship WAL/PITR to S3. That way in a disaster you lose minutes of data at most, not hours. A nightly backup can never hit this RPO.
2. RTO 30min = a warm standby, not building from scratch. Keep a pre-provisioned copy in a second region ready to promote. You can’t stand up infrastructure from zero in 30 minutes; so have it waiting.
3. Provision the infrastructure in advance with IaC. Define the second region’s network, servers and config as code with Terraform so it’s a single command or already standing. Clicking through a setup by hand during a disaster blows the RTO.
4. Prepare static files and DNS. Replicate static assets to the second region with S3 Cross-Region Replication. Use Route 53 health-check / failover routing to swing traffic; when the primary region fails its health check, it routes traffic to the standby automatically.
5. Don’t go active-active — it’s overkill for these numbers. RTO 30min doesn’t require the cost and complexity active-active brings. Active-passive fits these targets exactly; don’t buy complexity you don’t need.

Bottom line: I’d set up a cross-region replica + PITR + Route 53 failover and pre-provision the standby with IaC. The part teams skip is this: rehearse the failover regularly (run a game-day). An untested disaster recovery plan is nothing but a guess that it’ll work. I separately discuss the cloud-vs-own-server question on sade.dev.