Hacker News Reader

Have there been any incidents that affected more than one AZ?

AWS RDS in multi-AZ deployment gives you two availability zones. Aurora gives you three. What kind of scenario would be used to justify three AZ’s for the purposes of high availability?

View on HN

Aurora isn't really designed to handle the total failure of two availability zones (not short term, anyway). It's designed to handle one AZ + one additional node failure (which is reasonably likely to happen on large instances due to data from a single database being striped across up to 12,800 machines per AZ). Due to how quorum systems work the "simplest" way they decided to handle that was six replicas per 10 GiB segment across 3 AZs, with three of the replicas being log-only and three designated as full replicas (which is the lowest number of full replicas you can have given their failure model, and hitting that lower bound does require you to deploy across 3 AZs). If any three of the nodes are dead (log-only or otherwise), write traffic is stopped until they can bring up a fourth node, though there is some support for backup 3-of-4 quorums for very long-term AZ outages.

Amazingly insightful answer. Thank you very much!

Modern Paxos/Raft HA requires an odd number of nodes so that's how you end up with three AZs.

Reply on news.ycombinator.com