Skip to content

Trade-offs · Senior and Staff

Active-active vs active-passive multi-region

When to run two regions that both serve users and when to keep one on standby, with the money and risk numbers and the step-by-step path between them.

Asked at: SeniorStaff

The decision

A region is a group of data centres in one part of the world. With two regions, you choose how they share the work. In active-passive, one region serves all users and the other waits. It receives copies of the data, and users move to it only after a failure. In active-active, both regions serve users all the time. Active-passive is cheaper and simpler. Active-active gives faster recovery and shorter distance to users, but you pay in money, in write conflicts and in team effort. Neither side is correct in general. The forces are cost, outage pain, data safety and team skill.

Choose active-passive when

  • Most users live close to one region, so distance is not your problem.
  • A recovery time of 5 to 30 minutes is acceptable, and a person can press the failover button.
  • Your data needs one writer, for example stock counts or money balances.
  • The team is small, because active-active means testing every feature in two places.
  • You can pay for a warm standby, which is a smaller but running copy of the system.

Choose active-active when

  • Users are spread across regions, and the delay to a far region hurts. For example, more than 30 percent of users are over 100 ms away from the one region.
  • The cost of a minute of downtime is very high, or a contract demands recovery in under a minute.
  • Your data can be split by owner: each user or tenant has a home region and writes there. Conflicts are then rare.
  • You already deploy safely to many places and have tested losing a whole region.

The numbers that change the answer

All money numbers in this section are Assumptions. One lakh is 100,000; one crore is 10,000,000.

Monthly bill. One full region costs Rs 10 lakh a month. Backup only, with copies of data in a second region, adds 5 percent: Rs 10.5 lakh. A warm standby at 30 percent size adds 30 percent: Rs 13 lakh. Active-active needs each region to carry the whole load alone, so it is 2 x 10 = Rs 20 lakh.

What an outage costs. A region fails once in 3 years. The outage lasts 12 hours with backup only, 0.5 hour with warm standby, and almost 0 with active-active. Revenue is Rs 5 lakh an hour.

  • Backup only: 12 x 5 = Rs 60 lakh per event, so 60 / 3 = Rs 20 lakh a year.
  • Warm standby: 0.5 x 5 = Rs 2.5 lakh per event, so 2.5 / 3 = Rs 0.83 lakh a year.

Does each step pay for itself? Break-even revenue is the yearly extra cost divided by the hours of outage saved a year.

  • Backup only to warm standby: extra cost (13 - 10.5) x 12 = Rs 30 lakh a year. Hours saved: (12 - 0.5) / 3 = 3.83. Break-even: 30 / 3.83 = Rs 7.8 lakh an hour. Our Rs 5 lakh is below that: the step saves 3.83 x 5 = Rs 19 lakh and costs Rs 30 lakh. At these numbers warm standby does not pay on outage cost alone. It is a close call.
  • Warm standby to active-active: extra cost (20 - 13) x 12 = Rs 84 lakh a year. Hours saved: 0.5 / 3 = 0.17. Break-even: 84 / 0.17 = Rs 504 lakh, which is Rs 5 crore an hour.

So at these numbers outage cost alone does not justify active-active. The real reasons are distance to users, contracts and the risk of one region holding the only copy. AWS notes that if you already pay for a full second environment, using it active-active often makes sense (see Sources).

Write conflicts. A stock row gets 50 writes a second, 25 in each region. Assumption: copies arrive 1 second late. About 25 writes from the other region are always in flight and unseen. With last-writer-wins, one of two near-same-time writes is lost. The fix is one home region for each row.

Distance. Assumption: 20 ms round trip between regions. A checkout with 5 writes that wait for the other region adds 5 x 20 = 100 ms.

Cited facts. AWS describes four plans, from backup and restore to multi-site active/active, and calls active/active the most complex and costly. It says data corruption still needs backups. It reports that Aurora Global Database typically replicates in under a second and can promote a second region in under a minute (see Sources).

What breaks with each choice

Active-passive.

  • The failover was never tested, so it may fail when needed. Fallback: practise it every quarter, and keep every step in code.
  • The standby is too small. Fallback: pre-warm it, or run a hot standby at full size.
  • Data not yet copied is lost. Fallback: measure the copy delay. Then agree an RPO (the most data you accept to lose, counted in time) and an RTO (the longest outage you accept).

Active-active.

  • Two regions write the same record. Fallback: a home region for each user or tenant, or data types that merge.
  • A bad deploy or bad data hits both regions. Fallback: deploy region by region, and keep point-in-time backups.
  • Each region sits at 50 percent load, and nobody notices that one region cannot carry 100. Fallback: a monthly test that sends all traffic to one region.

What it costs

  • Money: Rs 13 lakh a month for warm standby and Rs 20 lakh for active-active, from above.
  • People (Assumption): warm standby takes 1 engineer for about 6 weeks and then a day each quarter for the drill. Active-active takes 3 to 4 engineers for 3 to 6 months, then a share of every future feature.
  • Changing your mind: moving from active-passive to active-active is a project of months. Moving back is quick, but you must remove writes in the second region first.

How each level answers

SDE-1: In active-passive one region works and one waits. In active-active both work. Active-active recovers faster.

SDE-2: I start with active-passive because most data has one writer. Active-active needs a conflict plan and doubles the cost. I use it when users are far from one region.

Senior: Warm standby costs Rs 2.5 lakh more a month than backup only, and it pays when an hour is worth over Rs 7.8 lakh. Active-active needs over Rs 5 crore an hour to pay from outages alone, so I would need a latency or contract reason. Each user gets a home region to avoid conflicts. I test the failover every quarter. I assume bad data reaches both regions, so I keep point-in-time backups.

Staff: I ask the business three questions: what an hour of downtime costs, where users are, and what the contract says. I write down an RPO and an RTO for each service tier, because a payment service may need active-active while a report service does not. One team owns the plan. I make it a path: backup, then warm standby, then active-active for chosen services. I move on only when a trigger fires: revenue per hour above the break-even, or over 30 percent of users far away. I know it was right when the drill meets its target and the extra bill is below the loss it removes. I revisit it every year.

Say it in the interview

I would start with active-passive, because most of our data has one writer. Going from warm standby to active-active adds Rs 84 lakh a year. At our numbers it removes only about Rs 0.8 lakh a year of outage loss. I would go active-active, with a home region for each user, only when many users are far away. A contract that needs recovery in under a minute is the other reason. The risk is a failover that fails, so we practise it every quarter, and we keep point-in-time backups because bad data copies everywhere.

Common mistakes

  • Saying active-active means no downtime. A bad deploy or bad data reaches both regions. Region failure is only one cause.
  • Both regions write the same rows without a plan. Last-writer-wins silently loses updates. Pick a home region or a merge rule first.
  • Sizing each region at 50 percent. When one region fails, the other cannot carry the load.
  • Never testing failover. An untested failover is a guess.

Sources

Understand the trade-off. Practise explaining your choice.

In an AI mock interview, the interviewer can push on a choice like this one: it changes a number and asks if your answer still holds.

See the mock interviewsAll trade-offs