One host or one AZ can die, the order path survives
Survive one host or one AZ: stateless up top, fenced state below
teaching topology: 3 AZs, N+1 capacity, RPO 1 min, RTO 5 min
load balancer + health checks
client order writes, peak 231/s
AZ-a failure domain
stateless API x2
no session state inside
AZ-b failure domain
stateless API x2
any AZ row may go grey
AZ-c failure domain
stateless API x2
survivors take the peak
state failure domain: fencing and RPO/RTO live here
DB primary + crown
sync standby ACKs writes
old primary fenced by epoch
replicated queue
3 consumers, checkpointed
poison goes to dead-letter
backup + RPO/RTO
snapshot + WAL, RPO 1 min
restore drill proves RTO 5 min
legend: dashed lines = failure can strike everything inside together, crown = only one writer, deploy via expand-migrate-contract
HA (standby, seconds) is not backup (snapshot, minutes) is not DR (second region)