Single-Region SaaS to a DR Region: RTO 30 Minutes Against 40 TB of EVS
A SaaS vendor runs entirely in one region (two AZs): 60 ECS instances, 40 TB of EVS, an RDS for MySQL primary with a standby in the second AZ, 300 TB of OBS and a dedicated ELB. Users reach the service through a third-party DNS provider with a 60-second TTL. The board approves a DR region and sets RTO 30 minutes, RPO 5 minutes for the database, RPO 1 hour for ECS disks and RPO 24 hours for object data. The CFO asks whether a second full footprint, another 60 ECS and 40 TB of EVS, must be paid for, and whether 'just switching on cross-region replication' is enough. The DBA says binary-log shipping to the DR region is technically possible but has never been configured. Nobody has ever run a DR test, application deployment in the DR region is a manual 40-step wiki page, and the ECS images are only stored in the primary region.
1. Map each RTO/RPO target to the Huawei Cloud capability that delivers it, and identify which target is not achievable as designed.
Read the worked answer
| Requirement | Mechanism | Verdict |
|---|---|---|
| DB RPO 5 min | RDS cross-region backup alone is insufficient - RPO equals the backup interval. Needs a read replica in the DR region (or binlog shipping) plus measured replication lag and an automated promotion step. | Achievable only if built; today it is a plan, not a control |
| EVS RPO 1 h | EVS volumes are region- and AZ-scoped and cannot be attached across regions. Use CBR vault replication with an hourly backup policy, or replicate data at application level. | RPO met |
| ECS rebuild | IMS image replication to the DR region, plus pre-created AS groups/configurations there. | Currently impossible - images exist only in the primary region |
| OBS RPO 24 h | Cross-region replication (requires versioning on both buckets). | Easily met |
| ELB | Region-scoped object: must be re-created in the DR region, certificates re-imported, EIP/bandwidth pre-allocated. | Manual work, must be pre-built |
| DNS | Health-checked failover at the third-party DNS, or GSLB; 60 s TTL adds about a minute. | Fine |
The target that fails: the RTO of 30 minutes. Restoring 40 TB of EVS from a CBR backup in the DR region will not finish in 30 minutes. Either the RPO/RTO for those volumes is renegotiated, the critical volumes are shrunk to the true stateful set, or the data is replicated continuously rather than restored from backup.
2. Does the CFO need to pay for a full second footprint? Compare the DR strategies and give a recommendation.
Read the worked answer
No - but 'no' comes with engineering cost.
- Backup and restore: cheapest, but RTO is hours; fails 30 minutes.
- Pilot light (recommended base): in the DR region run only the database replica, replicated IMS images, CBR vault replication and pre-created VPC/subnets/ELB definitions; zero ECS running. On failover the 60 ECS are launched from images by Auto Scaling. Booting 60 instances in parallel takes roughly 5–10 minutes if images, quotas and startup scripts are ready; add application warm-up, ELB and DNS and you land near 15–25 minutes - inside the RTO, but only if the 40-step wiki is replaced by infrastructure-as-code.
- Warm standby: 10–15 instances of the critical tier running continuously with warm caches; AS expands the rest. Costs perhaps 20–25% of a full footprint and removes the riskiest minutes of the RTO.
- Active-active: a full second footprint plus data replication in both directions; only justified if the business case demands near-zero downtime.
Non-cost traps to flag to the CFO: vCPU and EIP quotas are per region - a default quota can block 60 instances on the worst day; and a pilot light that has never been launched is a hypothesis, not a DR plan.
3. The CFO asks whether 'just switching on cross-region replication' is sufficient. Answer, and state how you would prove the DR plan works.
Read the worked answer
It is not sufficient. Replication moves data; it does not move capability. Replication gives you OBS objects and possibly volume backups, but the DR region still lacks: IAM users/agencies and their policies, security groups and network ACLs, the ELB and its certificates, the EIP and bandwidth allocation, AS configurations and images, DNS failover records, and above all a tested runbook. In this account the runbook is a 40-step manual page and the images were never replicated - a real region failure today would be an unplanned multi-day outage, not a 30-minute one.
Also correct the framing: the existing two-AZ deployment already survives an AZ failure. It provides zero protection against a region-level event, which is what the board approved.
How to prove it:
- Replicate images and enable CBR vault replication and OBS cross-region replication now; verify object counts and restore times against the 24 h RPO.
- Configure DB replication, then measure actual lag for a week - the 5-minute RPO is a measurement, not a setting.
- Convert the wiki to automated deployment so failover is one command.
- Run a quarterly game day: declare a simulated region failure, execute failover, and time it end-to-end from detection to first successful synthetic transaction. Report the measured RTO, not the designed one.
- Fix whatever the drill exposes - the first drill should be expected to overrun, and that is the point.