Dead Region Button

An active-passive service runs in us-east-1 with a warm standby in eu-west-1. This is the failover runbook, in order:

Confirm us-east-1 is unhealthy.
Promote the eu-west-1 read replica to primary.
Raise the Auto Scaling group's desired capacity in eu-west-1 from 4 to 40.
Change the Route 53 weighted routing policy to send 100 percent of traffic to eu-west-1.
Post the incident update.

The ordering is correct and the team has rehearsed it. During a real regional event, what is most likely to stall this runbook?

Going from 4 instances to 40 will exceed the default instance quota in the standby region

Steps 3 and 4 are control-plane calls, and control planes carry lower availability design goals than data planes, so the runbook leans on the machinery most likely to be degraded during the event

Step 2 is manual, and a human promoting a replica adds minutes that a health-check-triggered automatic promotion would remove

The runbook never states an RPO, so the team cannot tell how many writes the promotion discarded