3 / 4 Disaster Recovery, RTO & RPO

Three Hours Twenty Minutes

A 6 TB PostgreSQL cluster in one region has a stated RTO of 1 hour and RPO of 5 minutes. Three candidate postures:

standing in the DR region recovery steps measured
A backup and restore nothing; nightly base backup plus WAL shipped on archive_timeout = 15min redeploy from IaC, restore 6 TB, replay WAL restore throughput 500 MB/s
B pilot light replica streaming; app servers built but stopped promote replica, start app tier, shift DNS replica lag p99 3 s; app cold start 8 min
C active/active full stack live in both regions shift traffic weights near zero

Which postures meet both targets?

A

Only C meets both, because B's promote and cold start are unbounded control-plane operations with no completion guarantee.

B

B and C. A restores in about 6,000,000 MB/500 MB/s=12,000 s≈3h20m6{,}000{,}000\ \text{MB} / 500\ \text{MB/s} = 12{,}000\ \text{s} \approx 3\text{h}20\text{m}, more than triple the RTO, and its RPO is up to 15 minutes, so it misses both. B is the cheaper of the two that pass.

C

All three meet the RTO; only A misses the RPO, because the 15 minute archive interval is the sole thing standing between it and a 5 minute recovery point.

D

A misses the RTO but meets the RPO, because point-in-time recovery can be targeted at any timestamp, including one inside the last 15 minutes.