Summary

  • With health checks associated with both primary and secondary failover records, Route 53 returns the primary when both are unhealthy.
  • AWS preserves a last chance of connection when checks are wrong or overload cascades. The customer still owns the decision about which business actions remain acceptable.

The address survives its own red light

A backup server has an excellent part in a sales demonstration. The primary goes down, the secondary takes over, and the meeting ends before the secondary has an opportunity to disappoint anyone. The unfinished scene is the one in which both health checks turn red.

Route 53 has a documented answer. For primary and secondary failover records with health checks attached to both, a healthy primary wins. An unhealthy primary and healthy secondary send the answer to the secondary. If both are unhealthy, Route 53 returns the primary. The original candidate gets its address back into circulation without passing another medical. Record-selection rules

That is a rule for the DNS answer. The health verdict remains a health verdict; the application behind the returned address still has to handle whatever arrives. An address and a completed piece of business are separate products, however easily a procurement slide files both under availability.

The revealing choice is the final one. When observation has rejected every candidate, AWS keeps a candidate. A buyer expecting red lights to impose an absolute admission ban has purchased a different kind of doorman from the one imagined.

Why AWS keeps the door open

AWS explains the last resort in practical terms. A misconfigured health check can fail while the application continues to serve users. Removing every destination would allow the measurement error to create an interruption of its own. Returning an answer preserves a chance that would otherwise be lost. Failover troubleshooting and rationale

Its documentation also describes an overload sequence. One of three endpoints becomes unhealthy; the other two receive more work and fail in turn. Redistributing across all three can leave more opportunity than continuing to exclude them all. This is AWS’s explanatory example, rather than a measured incident at a particular customer.

The reasoning deserves respect. A probe observes a defined slice of a system, and probes can be wrong. Giving the observer absolute power to close every entrance makes the observer’s accuracy another dependency of availability. A final address can rescue a request that was still capable of succeeding.

The value of that rescue depends on the request. Another attempt to read a public document and another attempt to confirm a difficult-to-reverse transaction have different costs. An application may allow some reads while withholding some confirmations during degradation. Somebody who understands the business must choose that boundary, and something in the application must enforce it.

The spare server supplies resources and another route. Permission to keep making commitments does not arrive in the same box. When that permission has no owner, the supplier’s technical preference quietly becomes the customer’s operating policy.

Health has a job description

For endpoint checks, the customer chooses settings including protocol, interval and the failure threshold. Consecutive failures reaching the threshold produce an unhealthy result; a success before that point resets the failure count. Notifications can be arranged through CloudWatch and SNS. Informing an operator and selecting a record are distinct jobs. How health checks work

Endpoint checks run at ten- or thirty-second intervals, with independent checkers. A DNS question does not commission a fresh rehearsal of the customer’s entire business process. The routing decision uses periodic observations. Health-determination criteria

An HTTP or HTTPS response that meets the specified conditions provides useful evidence about the connection and response examined. A purchase involving stock checks, confirmation and a saved result needs further evidence. AWS also says its HTTPS health checks do not validate SSL/TLS certificates. The reassuring word “healthy” covers the examination actually performed.

The secondary’s configuration matters as much as its existence. A record without a health check is considered healthy. If the primary is unhealthy, an unchecked secondary can therefore be returned even when its endpoint really has a problem. Removing an observation changes the selection process; it adds no strength to the server.

The buyer should price three capabilities separately: alternative resources, useful observation and correct business results under degraded conditions. Two addresses relying on the same indispensable component can remain two entrances to one way of completing the work. Counting entrances does little to reveal that dependency.

Put the second red light in the acceptance test

A test with a failed primary and healthy secondary proves a valuable transition. It needs a companion: both associated checks unhealthy. In a controlled test, the team can record the check verdicts, the DNS answers actually received and the actions the application allows to finish. Those observations together describe the behaviour the business is buying.

The console offers information such as status, the last failure reason, checker address and time for the relevant checks, with exceptions for calculated checks. These are useful pieces of a timeline. Viewing check status

The observation point belongs in that timeline too. AWS warns that a network partition can give Route 53 locations different views of health, including views different from CloudWatch. A central screenshot cannot stand in for every answer received elsewhere.

The official documents provide no success rate for a particular customer in the both-unhealthy state; assessing an actual incident requires contemporaneous DNS answers and application outcomes.

For a purchasing decision, the available rule already supplies a concrete question. AWS has written its last resort. The customer needs to write what may happen behind it. Returning the primary can be a reasonable attempt to preserve service. Leaving the authority to accept business unspecified is a rather less impressive contingency plan.