The Architecture Spectrum and the Problem of Shared Fate
Recovery architecture is a spectrum, not a switch. At one end you keep copies and rebuild slowly; at the other you run a full second copy of reality, warm and waiting, and pay for the privilege every day whether disaster comes or not. The right point on that spectrum is not the most impressive one — it is the one that meets your two numbers at the lowest honest cost. And whatever you build, ask the question that undoes most designs: what does my backup share with the thing it is backing up? Same power, same network, same account, same region, same quiet dependency? Shared fate is the failure of independence, and it is how two systems that were supposed to fail separately manage to die together.
Knowledge check
A company keeps its production database in one region and a synchronous replica in a second region for failover. During a review, someone notices that both regions authenticate through a single identity provider hosted in the primary region. Why does this undermine the recovery design, and what is the general principle at stake?
Show the answer
It undermines the design because the failover depends on a component that is not itself independent: if the primary region fails in a way that takes down the identity provider, the standby region cannot authenticate anyone and is useless despite holding a perfect copy of the data. The two regions are not genuinely independent — they share fate through the identity provider. The general principle is that a recovery site provides real protection only if every dependency required to run it is independent of the thing it is meant to survive; a single shared component reintroduces the common failure the second region was supposed to eliminate.