Multi-Region Active-Passive (DR)
A warm standby region takes over only when the primary fails.
IntermediatePlatform
All traffic serves from a primary region while a standby region stays warm with replicated data. Health checks trigger a DNS failover to the standby if the primary becomes unreachable.
When to use it
- The business needs disaster recovery but not the cost/complexity of true active-active
- A short failover window (minutes) during a full-region outage is acceptable
Trade-offs
- The standby region is paid-for capacity that is normally idle
- Failover is rarely exercised, so it must be drilled regularly or it won't work when needed
Components used
DNSManaged App ServiceRelational Database
How it works
- One region serves all traffic while a standby region receives continuous replication but no live requests.
- Health checks trigger failover, promoting the standby to primary and repointing traffic.
- Because only one region ever accepts writes, there are no write conflicts to resolve.
Used in the wild
- Disaster recovery where an hour of downtime is tolerable but data loss is not.
- Regulatory requirements for a geographically separate recovery site.
- Teams wanting regional redundancy without the complexity of bidirectional replication.
Good to know
- Untested failover is not failover. The standard failure is discovering during a real incident that the standby's capacity, certificates or configuration drifted months ago.
- Failback is frequently harder than failover, because the original primary is now stale and must catch up without losing writes taken during the outage.
Related patterns
Model Serving with A/B Testing
Route inference traffic across model versions to compare live performance.
CQRS
Separate models and stores for writes and reads.
Blue-Green Deployment
Run two full production environments, switch traffic between them.
Canary Release
Send a small slice of traffic to the new version before a full rollout.