Question

A financial services company runs an active-passive workload across us-east-1 (primary) and us-west-2 (standby). Each region has an identical Auto Scaling group fronted by an Application Load Balancer, and data is replicated with an Aurora global database. Compliance requires an RTO of under 5 minutes, and a recent incident revealed that Route 53 health-check-based DNS failover did NOT trigger because the primary region's control plane was degraded but the ALB health check endpoint still returned HTTP 200. The DevOps team needs a failover mechanism that remains operable even when the primary region is partially impaired and that prevents the standby from being accidentally promoted while the primary is still serving traffic. Which approach BEST meets these requirements?

Accepted Answer

Implement Amazon Route 53 Application Recovery Controller with routing controls and readiness checks, and use safety rules to enforce that only one region's routing control is ON at a time.

Answer

Add a second Route 53 health check that evaluates a deeper application health endpoint, and shorten the health check interval to 10 seconds with a failure threshold of 1.

Answer

Create a CloudWatch alarm on primary ALB 5XX metrics that triggers a Lambda function to update the Route 53 record set weights, promoting the standby region automatically.

Answer

Enable Aurora global database managed failover and rely on the RDS event to invoke an EventBridge rule that updates Route 53 alias records to the standby ALB.