3.1.1.7. Enabling Cross-Region Solutions (DynamoDB, RDS, Route 53, S3, CloudFront)
3.1.1.7. Enabling Cross-Region Solutions (DynamoDB, RDS, Route 53, S3)
Cross-region architectures protect against regional outages and serve users globally with lower latency. Each service has a different mechanism for cross-region data synchronization.
DynamoDB Global Tables: Active-active replication across up to 5 regions. Writes in any region propagate automatically (typically < 1 second). Conflict resolution: last-writer-wins based on timestamp. No application changes needed — reads and writes work against the local table.
RDS Cross-Region Read Replicas: Asynchronous replication to another region. The replica is read-only; you must manually promote it to a standalone instance during failover (RPO > 0 due to replication lag). Aurora Global Database provides faster replication (< 1 second lag) with managed failover.
Route 53 cross-region routing:
- Failover routing: Primary region serves traffic; Route 53 health check detects failure and routes to secondary
- Latency-based routing: Routes users to the lowest-latency region automatically
- Geolocation routing: Routes based on user's geographic location (compliance use case)
S3 Cross-Region Replication (CRR): Asynchronous object replication between buckets in different regions. Requires versioning enabled on both buckets. Replicates new objects; existing objects need a one-time batch replication job.
Exam Trap: S3 CRR only replicates new objects created after the rule is enabled. Existing objects must be copied using S3 Batch Operations or aws s3 sync. If a DR question says "all existing data must be available in the secondary region," CRR alone is insufficient — you need the initial sync first.
KMS keys are Regional: a replica in another region (DynamoDB global table replica, copied snapshot, S3 replica) is encrypted with a key that lives in that region. IAM or key policies that name only the primary region's key ARN work until failover, then return AccessDenied in the DR region. Grant access to the DR-region key as well, or use KMS multi-Region keys (related keys with the same key ID and key material in each region).
