Cloud · AWS Core Services

Active-active disaster recovery with S3 Cross-Region Replication

awsHardawss3-replicationdisaster-recoverykms

Interview question

How do you architect a multi-region active-active disaster recovery pipeline for S3 data lakes with near-zero RPO?

How to answer

The short answer

Designing disaster recovery (DR) for enterprise mission-critical analytics platforms requires balancing Recovery Point Objective (RPO) and Recovery Time Objective (RTO) against infrastructure cost.

If a primary cloud region experiences a catastrophic regional network outage, downstream analytical pipelines must continue operating in a secondary target region.

S3 Cross-Region Replication (CRR) with RTC

Standard S3 Cross-Region Replication replicates objects asynchronously between geographic regions over the AWS global network backbone.

For regulated financial systems, standard replication does not provide guaranteed service level agreements. Enabling S3 Replication Time Control (S3 RTC) provides an backed by AWS:

  • 99.99% of newly uploaded objects are replicated to the secondary region within 15 minutes.
  • Real-time CloudWatch metrics track replication latency, pending bytes, and replication operations.

Cross-region KMS key encryption

In regulated environments, all data at rest must be encrypted using customer-managed AWS KMS keys.

Because AWS KMS keys are strictly regional resources:

  • Objects encrypted with a KMS key in us-east-1 cannot be decrypted using that key in us-west-2.
  • You must configure S3 replication rules to decrypt objects in the source region and re-encrypt them upon arrival in the destination region using a designated target KMS key.
  • The replication role must possess kms:Decrypt permissions on the source key and kms:GenerateDataKey permissions on the destination key.

Bi-directional replication and collision handling

For true active-active ingestion architectures where pipelines in both regions write data concurrently:

  • Enable bi-directional replication rules on both buckets.
  • Enable ReplicaModificationSync to ensure metadata changes (such as object tags and ACLs) propagate between regions.
  • Structure pipeline write paths with regional prefixes (s3://bucket/events/region=us-east-1/ and s3://bucket/events/region=us-west-2/) to eliminate concurrent write collisions on identical S3 keys.