Cloud Lab: An Architecture You Can Break

Anyone can draw three availability zones. The useful question is what happens when one of them is not there, and most architecture reviews never ask it, because nobody wants to find out during the meeting.

Why the diagram is the least useful artifact#

A diagram shows intent. It cannot show you that the multi-AZ design you just approved still goes down when the primary database fails over and the application connection pool does not reconnect. That behaviour is invisible on paper and obvious within ninety seconds of an incident.

So the demo above removes things. Pick a shape, take a component away, and read what actually happens rather than what the topology implies.

The three findings people are usually surprised by#

Multi-AZ is not multi-region. It is frequently treated as though it is. A regional control-plane failure takes every zone with it, and this is the most common gap between what an organisation believes it has bought and what it has.

The front door is a single point of failure in every topology on the list. You can spend twice as much on active-active and still be undone by DNS. That is worth knowing before the invoice rather than after, and it almost never appears on a risk register.

Third-party dependencies are unaffected by your redundancy. You cannot buy resilience to somebody else's outage with your own regions. That is bought with timeouts, circuit breakers and a defined degraded mode, and those are application decisions rather than infrastructure ones.

Failover you have not rehearsed is not a capability#

Active-passive only works if somebody has actually run the drill this year. An untested failover is a plan, and the difference between a plan and a capability shows up exactly once.

The same applies to the database failover window in every shape here. The outage is the failover plus however long the application takes to reconnect, and the second part is usually longer than the first and is almost never measured.

On the cost multipliers#

They are ratios derived from the topology, not quotes. Active-active runs two production estates, so it is roughly double before cross-region data transfer, which is the line most often missing from the business case. Your real figure depends on reservations, egress, and how much of a passive estate you can genuinely run cold.

Treat the numbers as the shape of the decision rather than the price of it, and use the Cloud Migration Cost Calculator if you want your own inventory behind it.

What a real resilience review looks like#

The same exercise against your architecture, with the people who would be on the call at 3am in the room. The output is a ranked list of what actually breaks and what each fix costs, which is a different document from an architecture review and considerably more useful.

What else is coming for Cloud Lab