Active–passive

Problem

You need HA but don't want the complexity or cost of active-active.

Context

A regional or availability-zone failure should not take down the service. But the passive site can be idle most of the time.

Solution

One region is active — handles all traffic. Another is passive — receives replicated data, ready to take over. On failure, DNS or LB fails over to the passive region, which becomes active. The old active can rebuild and become the new passive.

Trade-offs

• Passive capacity mostly wasted (cheap alternative: warm standby, not full capacity)
• Failover has a downtime window (DNS TTL, connection drain, warmup)
• Passive is not battle-tested — 'we only see it work during failover'
• Split-brain risk if both sides think they're active

Failure modes

• Passive was underscaled; when it becomes active, it can't handle load
• Replication lag → data loss on failover
• Passive drift — infra changes made to active but not passive

When to use

• HA needed but cost-sensitive
• Team is uncomfortable with active-active complexity
• Traffic is single-region-dominated

When NOT to use

• You need zero-downtime failover
• Traffic is genuinely global — active-active better