Multi-AZ redundancy

An availability zone is a group of datacenters inside one region with its own power, cooling and network, a millisecond or two from its neighbors. Spreading every tier across two or three zones lets the app survive a zone failing — if the zones left already have the capacity to carry the load. Launching replacement servers after the loss is too slow and depends on the very systems that may be impaired, so statically stable designs over-provision ahead of time, for example three zones each sized so that any two carry everything. Stateful parts need their own zone redundancy, such as a database standby in a second zone. Zones share their region's fate, so they don't protect against a whole region going down.

Use when

Any production workload — run in at least two zones, three where the region has them · Services that must ride out a datacenter's power, cooling or network failure without anyone acting · Databases and other single-primary stores — a standby in a second zone

Avoid when

Dev and test environments where an outage costs little · As the only protection when the business needs to survive a whole region failing (core/multi-region)

Trade-offs

Survives a zone without reacting, for capacity that sits idle every normal day (+50% with three zones, +100% with two) · Cross-zone calls add a millisecond or two and may be billed; keeping traffic inside a zone is faster and contains a bad zone, at the cost of more moving parts · A synchronous standby in another zone keeps data safe through a zone loss, but every write waits for it