High availability from lesson 4.7.4 absorbs the failure of a data center without anyone having to intervene. A disaster is everything it does not absorb:

  • A whole region fails.
  • Data is deleted or incorrectly written, by a bug in the code, a person or an attacker. Zone redundancy dutifully copies the error into all zones.
  • A deploy destroys data, and rolling back the revision doesn't bring it back.

The review from lesson 4.7.1 has two findings on this: RE:04, "No recovery objectives (RTO, RPO) agreed", and RE:09, "Database restore never rehearsed". This lesson closes both: You agree on objectives, choose the right means from Azure SQL, write a disaster recovery plan and rehearse it, with a stopwatch. The drill is the only exercise of this module that really runs in Azure. It costs little as long as you clean up the same day, and the script for it cleans up after itself.

RTO and RPO, agreed with the domain expert

Two numbers describe what should hold after a disaster:

  • RTO (Recovery Time Objective): How long may it take until the flow runs again?
  • RPO (Recovery Point Objective): How much data, measured in time, may be lost in the process? An RPO of one hour means: What was written in the last hour before the disaster may be missing.

Both numbers are not technical decisions. They are business decisions, and that is why you agree on them with the domain expert, for the Kladde with the office's owner. Your job as an architect is to ask the question in an understandable way and to say what each answer costs. Good questions are concrete:

  • "If the Kladde fails at nine in the morning: By when does appointment booking have to work again so that it doesn't really hurt?"
  • "If we have to go back to the state of an hour ago: How do you find out which customers booked in that hour? And how long could that be, an hour, a day?"
  • "What is worse, a day without the Kladde or a week in which an hour of work is lost every evening?"

The answers differ by flow and by kind of disaster. The public tenders from TED can be fetched again at any time; for them, any loss is harmless. A quote that has been sent, on the other hand, is a commitment to a customer, and it must not happen that the Kladde forgets it without anyone noticing.

The smaller the RTO and RPO, the more expensive. An RPO of minutes for the failure of a region requires a running copy of the database in a second region; an RPO of hours gets by with the backups that Azure SQL creates anyway.