Pilot Light DR Pattern on AWS

The Pilot Light pattern is a disaster recovery (DR) strategy where a minimal core set of AWS resources runs continuously in a secondary Region (or Availability Zone), while the full production environment is scaled down or stopped. The name comes from a gas furnace pilot light: a small flame that can instantly ignite the main burners. In AWS, the 'pilot light' typically includes:

The rest of the infrastructure – such as Auto Scaling groups with many EC2 instances, Elastic Load Balancers, and full application tiers – is either not deployed or is in a stopped/detached state. Upon a disaster declaration, you 'ignite' the full environment by scaling out the existing pilot light resources and launching additional resources from pre-prepared Amazon Machine Images (AMIs) or CloudFormation templates.

Pilot Light offers a middle ground between Backup & Restore (low cost but high Recovery Time Objective – RTO) and Warm Standby (higher cost but lower RTO). Typical RTO for Pilot Light is minutes to a few hours, and Recovery Point Objective (RPO) is typically seconds to minutes, depending on data replication frequency. It is ideal for workloads that can tolerate a short outage (e.g., 15-30 minutes) but cannot afford the cost of a full standby environment. The exam expects you to recommend Pilot Light when the scenario mentions 'cost-sensitive' and 'RTO of less than an hour' but not 'near-zero RTO.'

#### Data Replication Layer

The foundation of Pilot Light is continuous data replication. The most common services: - Amazon RDS: Use a cross-Region read replica (for MySQL, MariaDB, PostgreSQL, Oracle) or a Multi-AZ DB instance with a standby in another Region (using AWS Aurora Global Database). The replica is promoted to master during failover. - Amazon DynamoDB: Use global tables to replicate data across Regions with sub-second latency. - Amazon S3: Enable Cross-Region Replication (CRR) on buckets. Replication is asynchronous, typically within 15 minutes. - AWS Database Migration Service (DMS): For ongoing replication from on-premises or EC2 databases.

#### Compute Layer

#### Networking Layer

Create RDS cross-Region read replica:

aws rds create-db-instance-read-replica \
    --db-instance-identifier my-read-replica \
    --source-db-instance-identifier arn:aws:rds:us-west-2:123456789012:db:my-primary \
    --region us-east-1

Promote read replica:

aws rds promote-read-replica \
    --db-instance-identifier my-read-replica

Enable S3 CRR:

{
  "ReplicationConfiguration": {
    "Role": "arn:aws:iam::account-id:role/s3-replication-role",
    "Rules": [
      {
        "Status": "Enabled",
        "Destination": {
          "Bucket": "arn:aws:s3:::destination-bucket"
        }
      }
    ]
  }
}

A mid-size e-commerce company runs its application on EC2 instances behind an ALB with an RDS Multi-AZ database in us-east-1. They need DR in us-west-2 with an RTO of 30 minutes and RPO of 5 minutes, but they cannot afford a full warm standby. The solution: implement Pilot Light. They create a cross-Region read replica of their RDS instance in us-west-2 (using db.r5.large instead of db.r5.xlarge to save 50% on compute). They also run a single t3.nano EC2 instance running a configuration management agent and a small Redis cache (ElastiCache) for session data. S3 Cross-Region Replication is enabled for static assets. They use EC2 Image Builder to create a weekly AMI of their application server and copy it to us-west-2. A CloudFormation template is stored in S3 and can be executed to launch the full environment (Auto Scaling group, ALB, additional instances). A Lambda function triggered by a CloudWatch alarm (based on RDS ReplicaLag > 10 seconds) executes the template. In production, a minor AWS outage in us-east-1 caused a 15-minute database failover; the pilot light pattern allowed full recovery in 22 minutes, well within the 30-minute RTO. The monthly cost for the DR resources was under $500, compared to an estimated $3,000 for a warm standby.

A financial services firm runs a critical application on a stack of EC2 instances, RDS for PostgreSQL, and ElastiCache. They require DR in a second Region with an RPO of 1 second and RTO of 5 minutes. They initially considered Multi-Site Active/Active but found it too complex and costly. Instead, they chose Pilot Light with Aurora Global Database, which provides replication lag of typically < 1 second. They run a single db.r5.large instance in the DR Region as part of the global database (the secondary Region has a cluster with zero compute capacity until failover). They also maintain a small EC2 instance running a health check endpoint. Automation uses AWS Systems Manager Automation documents that promote the secondary Aurora cluster, update the Auto Scaling group launch template, and switch Route 53 records. During a compliance audit, they demonstrated a failover drill that completed in 4 minutes 30 seconds. The key challenge was ensuring that the AMIs for EC2 instances were updated daily to include the latest security patches; they used EC2 Image Builder with a scheduled pipeline.

A SaaS provider uses a multi-Region architecture but wants to minimize DR costs. They run a fleet of EC2 instances, RDS for MySQL, and S3 for tenant data. For DR, they implement Pilot Light by using RDS cross-Region read replicas for each tenant database (they have 50 tenants). They also run a single small EC2 instance that hosts a configuration service. They use AWS CloudFormation StackSets to deploy the same infrastructure in the DR Region but with a parameter to keep the compute resources at zero (e.g., Auto Scaling group min=0). Upon failover, they update the parameter to min=5 and the stack updates. They also use DynamoDB global tables for session state. The main challenge was managing the replication lag across 50 read replicas; they used CloudWatch composite alarms to detect when any replica lag exceeded 10 seconds. During a real outage caused by a power failure in the primary data center, they successfully failed over in 18 minutes. The cost savings compared to a warm standby were approximately 70%.