# Disaster recovery: how do I design an active-passive scenario around RTO and RPO?

> RPO 5min buys continuous cross-region replication and PITR, RTO 30min an IaC-provisioned warm standby behind Route 53 failover, rehearsed on a game-day.

- Asked: 2026-05-31
- Answered: 2026-06-03
- Asked by: Levent
- Tags: dayaniklilik, altyapi, veritabani
- Source: https://www.muhammetsafak.com.tr/en/just-ask/disaster-recovery-strategy-setting-rto-and-rpo/
- Language: en-US
- Author: Muhammet Şafak

---
**Question:** AWS Frankfurt (`eu-central-1`) became completely unreachable. Our company policy is RTO 30 minutes (maximum downtime) and RPO 5 minutes (maximum data loss).

To meet these targets, how do I design an active-passive disaster recovery scenario covering the database (cross-region replication), static files and DNS routing (Route 53 latency/failover)?


Short answer: you don't choose the architecture, **RTO 30min / RPO 5min** chooses it. Those two numbers determine, on their own, which disaster recovery strategy you build.

The real issue is this: RPO and RTO aren't abstract goals, they're figures that translate directly into technical decisions. Read the number, build the architecture to match.

1. **RPO 5min = continuous replication, not a nightly dump.** Cross-region streaming replication (or an RDS cross-region read replica) + ship WAL/PITR to S3. That way in a disaster you lose minutes of data at most, not hours. A nightly backup can never hit this RPO.
2. **RTO 30min = a warm standby, not building from scratch.** Keep a pre-provisioned copy in a second region ready to promote. You can't stand up infrastructure from zero in 30 minutes; so have it waiting.
3. **Provision the infrastructure in advance with IaC.** Define the second region's network, servers and config as code with Terraform so it's a single command or already standing. Clicking through a setup by hand during a disaster blows the RTO.
4. **Prepare static files and DNS.** Replicate static assets to the second region with S3 Cross-Region Replication. Use Route 53 health-check / failover routing to swing traffic; when the primary region fails its health check, it routes traffic to the standby automatically.
5. **Don't go active-active — it's overkill for these numbers.** RTO 30min doesn't require the cost and complexity active-active brings. Active-passive fits these targets exactly; don't buy complexity you don't need.

**Bottom line:** I'd set up a cross-region replica + PITR + Route 53 failover and pre-provision the standby with IaC. The part teams skip is this: **rehearse** the failover regularly (run a game-day). An untested disaster recovery plan is nothing but a guess that it'll work. I separately discuss the cloud-vs-own-server question on sade.dev.

## Related Reading

- [Why is keeping the key in .env risky when encrypting sensitive financial data — what do KMS/Vault give you?](https://www.muhammetsafak.com.tr/en/just-ask/encrypting-sensitive-financial-data-at-rest-and-key-management/) — Just Ask
- [How do I rewind to seconds before a disaster with WAL archiving and PITR?](https://www.muhammetsafak.com.tr/en/just-ask/point-in-time-recovery-with-wal-archiving/) — Just Ask
- [Health check design: how do I separate Liveness and Readiness?](https://www.muhammetsafak.com.tr/en/just-ask/health-check-design-liveness-vs-readiness/) — Just Ask