Disaster recovery: how do I design an active-passive scenario around RTO and RPO?

Short answer: you don’t choose the architecture, RTO 30min / RPO 5min chooses it. Those two numbers determine, on their own, which disaster recovery strategy you build.

Short answer

The real issue is this: RPO and RTO aren’t abstract goals, they’re figures that translate directly into technical decisions. Read the number, build the architecture to match. I covered how a promotion decision should be made inside a single region in the split-brain and quorum answer; here the same question is asked at region scale.

Why

1. RPO determines replication frequency. A 5-minute data-loss ceiling rules out nightly dumps from the start; continuous replication is mandatory.

2. RTO determines your readiness level. You can’t stand up infrastructure from zero in 30 minutes; the second region has to be up and ready to promote.

3. Active-active is overkill for these numbers. Complexity you don’t need is a cost you shouldn’t pay.

What to do

1. Set up continuous replication for RPO 5min. Cross-region streaming replication (or an RDS cross-region read replica) + ship WAL/PITR to S3.

2. Keep a warm standby for RTO 30min. Have a pre-provisioned copy in the second region ready to promote.

3. Provision the infrastructure in advance with IaC. Define the second region’s network, servers and config as code with Terraform; clicking through a setup by hand during a disaster blows the RTO.

4. Prepare static files and DNS. Replicate static assets with S3 Cross-Region Replication; use Route 53 health-check / failover routing to swing traffic automatically.

5. Rehearse the failover regularly (game-day). An untested disaster recovery plan is nothing but a guess that it’ll work.

Bottom line: I’d set up a cross-region replica + PITR + Route 53 failover and pre-provision the standby with IaC. Active-passive fits these targets exactly; don’t buy complexity you don’t need. I separately discuss the cloud-vs-own-server question on sade.dev.