Pilot Light DR Architecture

The pilot light includes only what cannot be quickly provisioned: database replicas with continuous replication, encrypted AMIs or container images in the secondary region registry, and Terraform state with the infrastructure code. No application servers, no load balancers, no cache clusters — these are provisioned during failover from the same IaC codebase that manages production. Monthly cost is typically just the database replica: $50-200.

Failover automation provisions the full environment from IaC: terraform apply -var-file=dr-region.tfvars deploys load balancers, autoscaling groups, cache clusters, and networking. Container images are pre-pushed to the DR region's ECR. Application configuration and secrets are replicated to the DR region's Vault or SSM Parameter Store. The full provisioning takes 15-30 minutes and is fully automated.

Database promotion is the critical-path operation. For Aurora Global Database, promotion takes under a minute. For self-managed PostgreSQL, we promote the streaming replica with pg_ctl promote and update connection strings. For RDS, we promote the cross-region read replica. Application deployment follows immediately — containers pull configuration pointing to the newly promoted database. DNS cutover completes the failover.

Pilot light works when your RTO tolerance is 30-60 minutes and cost must stay minimal. It is ideal for: SaaS applications with SLAs that tolerate brief outages, internal tools where 30-minute downtime is acceptable, and startups that need DR but cannot justify warm standby costs. Pilot light is not appropriate for: payment processing (requires warm standby or active-active), real-time systems with sub-minute RTO, or applications with large, slow-to-provision infrastructure.