Three ways to survive a region failure — measured

Built, measured and torn down on 12 August 2026 across us-east-1 and us-west-2. Total cost $0.36. The infrastructure no longer exists — the code, the teardown scripts and the raw samples behind every number here are in the repo.

The question

“We fail over to another region” is a claim people make without a number attached. I wanted the number, and I wanted it for more than one mechanism, so I built three and pointed a request loop at each while breaking them.

What was measured

	Mechanism	Failover	Requests lost	Data	Cost floor
Blue/green	listener rule swap, one region	~40 s to propagate	0 of 62	shared	one ALB
DNS failover	Route 53 stops answering with the primary	60–80 s	yes, the whole window	replicated	~$1/mo
Anycast	Global Accelerator withdraws the endpoint	25 s	79 of 233	none — stateless	~$18/mo fixed

The anycast build. Normal path: request loop → Global Accelerator → ALB → EC2 in us-east-1. Failover (red): the accelerator withdraws us-east-1 and routes the same two IPs to us-west-2.

requestfailure / failover Hover, tap or Tab to a component to see what it does and why. Swipe sideways for the whole diagram.

The anycast run, one bar per request. Blue is us-east-1, green is us-west-2, red is HTTP 503:

233 requests at ~5/s. The primary was broken by deregistering its only target, so the load balancer had no healthy backend. Recomputable from data/s9-failover.log.

The finding

Anycast is two to three times faster than DNS, and neither prevents the outage.

They fail for different parts of the same total, and both are bounded below by detection:

DNS: a 30-second check interval with a threshold of 2 is a 60-second floor before Route 53 even begins serving the secondary — and resolver caching adds more on top, because the mechanism is “stop handing out the old address” and clients hold addresses they already have.
Anycast: a 10-second interval with threshold 2 is a 20-second floor, plus nothing. The client never re-resolves. The same two static IPs stay valid and AWS changes what they route to inside its own network.

So anycast removes the caching penalty entirely and permits a tighter interval. What it cannot do is notice a failure faster than it looks. You cannot get below detection time with either, which is why 34% of requests still failed on the fastest of the three.

If you need genuinely zero errors, failover is the wrong tool — you need both regions serving simultaneously, which is a different and more expensive architecture.

The detail the summary hides

The raw samples show something the test script’s own timing missed: the last 503 arrives at +30 s, five seconds after the secondary starts serving at +25 s. A short tail of requests keeps reaching the withdrawn endpoint after the switch has effectively happened.

That also corrected a number. The script reported 28 s because it polled on a five-second sleep and carried that granularity into its own measurement. Recomputing from the samples gives 25 s. The log is committed so anyone can check.

What each one is actually for

Blue/green — deploying without downtime, in one region. Not a DR mechanism at all; it just resembles one.
DNS failover — cheap, works with any endpoint type, and it was the only one of the three carrying replicated data (a DynamoDB Global Table). Correct when a 60–90 second RTO is acceptable and you don’t want a fixed monthly bill.
Anycast — faster, and it gives clients two static IPs that never change in any region. That matters more than the speed when a partner has firewalled your addresses or an IoT fleet has them baked in. But $18/month before a single request arrives, and here it was moving stateless traffic. Pairing it with the Global Table is what a real design does.

What it cost to find out

$0.36 across two regions for an afternoon — Global Accelerator at $0.025/hr fixed, two ALBs, two t3.micro. The same stack left running is about $70/month, and the accelerator’s share of that accrues in a console view nobody opens: its control plane lives in us-west-2 regardless of where the endpoints are, so a per-region sweep never finds it.