TheArchitect

Multi-Region DR

AWS architecture template · SAA-C03: Route 53 failover → CloudFront → ALB → Auto Scaling EC2 → Aurora Global

Multi-Region DR is a free AWS architecture template built with Aurora, Auto Scaling, CloudFront, EC2, Load Balancer and Route 53. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
Public edge A/BPrivate app A/BPrivate data A/BPrimary VPC 10.10.0.0/16Route 53CloudFrontPrimary ALBWeb ASGWeb InstanceAurora Global
Multi-Region DR architecture diagram

AWS services in this template

  • Aurora
  • Auto Scaling
  • CloudFront
  • EC2
  • Load Balancer
  • Route 53

Deployment notes

Reference

  • Multi-region architecture requires a separate stack deployment in each region.
  • Aurora Global Database and Route 53 failover routing need cross-region configuration.

Generated CloudFormation — 35 resources

Logical IDResource type
Route53route53AWS::Route53::HostedZone
CloudFrontcloudfrontAWS::CloudFront::Distribution
PrimaryVPC10100016vpcAWS::EC2::VPC
PrimaryVPC10100016vpcedgewebsgSecurityGroupAWS::EC2::SecurityGroup
PrimaryVPC10100016vpcappruntimesgSecurityGroupAWS::EC2::SecurityGroup
PrimaryVPC10100016vpcappruntimesgSecurityGroupIngressRuleAWS::EC2::SecurityGroupIngress
PrimaryVPC10100016vpcworkersgSecurityGroupAWS::EC2::SecurityGroup
PrimaryVPC10100016vpcdatastoresgSecurityGroupAWS::EC2::SecurityGroup
PrimaryVPC10100016vpcdatastoresgSecurityGroupIngressRuleAWS::EC2::SecurityGroupIngress
PrimaryVPC10100016vpccontrolplanesgSecurityGroupAWS::EC2::SecurityGroup
PrimaryVPC10100016vpcPublicSubnet1AWS::EC2::Subnet
PrimaryVPC10100016vpcPublicSubnet2AWS::EC2::Subnet
PrimaryVPC10100016vpcPrivateSubnet1AWS::EC2::Subnet
PrimaryVPC10100016vpcPrivateSubnet2AWS::EC2::Subnet
PrimaryVPC10100016vpcPrivateSubnet3AWS::EC2::Subnet
PrimaryVPC10100016vpcPrivateSubnet4AWS::EC2::Subnet
PrimaryVPC10100016vpcInternetGatewayAWS::EC2::InternetGateway
PrimaryVPC10100016vpcGatewayAttachmentAWS::EC2::VPCGatewayAttachment
PrimaryVPC10100016vpcPublicRouteTableAWS::EC2::RouteTable
PrimaryVPC10100016vpcPublicRouteAWS::EC2::Route
PrimaryVPC10100016vpcPublicSubnet1RTAAWS::EC2::SubnetRouteTableAssociation
PrimaryVPC10100016vpcPublicSubnet2RTAAWS::EC2::SubnetRouteTableAssociation
PrimaryVPC10100016vpcNatEIPAWS::EC2::EIP
PrimaryVPC10100016vpcNatGatewayAWS::EC2::NatGateway
PrimaryVPC10100016vpcPrivateRouteTableAWS::EC2::RouteTable
PrimaryVPC10100016vpcPrivateRouteAWS::EC2::Route
PrimaryVPC10100016vpcPrivateSubnet1RTAAWS::EC2::SubnetRouteTableAssociation
PrimaryVPC10100016vpcPrivateSubnet2RTAAWS::EC2::SubnetRouteTableAssociation
PrimaryVPC10100016vpcPrivateSubnet3RTAAWS::EC2::SubnetRouteTableAssociation
PrimaryVPC10100016vpcPrivateSubnet4RTAAWS::EC2::SubnetRouteTableAssociation
PrimaryVPC10100016vpcDbSubnetGroupAWS::RDS::DBSubnetGroup
PrimaryALBelbAWS::ElasticLoadBalancingV2::LoadBalancer
WebASGautoscalingAWS::AutoScaling::AutoScalingGroup
WebInstanceec2AWS::EC2::Instance
AuroraGlobalauroraAWS::RDS::DBCluster
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "CloudFrontcloudfront",
          "To": "PrimaryALBelb"
        },
        {
          "From": "PrimaryALBelb",
          "To": "WebASGautoscaling"
        }
      ]
    }
  },
  "Resources": {
    "Route53route53": {
      "Type": "AWS::Route53::HostedZone",
      "Properties": {
        "Name": "dr.example.com.",
        "HostedZoneConfig": {
          "Comment": "Failover routing between primary and secondary regions."
        }
      }
    },
    "CloudFrontcloudfront": {
      "Type": "AWS::CloudFront::Distribution",
      "Properties": {
        "DistributionConfig": {
          "Enabled": true,
          "Comment": "CDN caching layer for DR traffic routing.",
          "PriceClass": "PriceClass_100",
          "HttpVersion": "http2",
          "DefaultCacheBehavior": {
            "TargetOriginId": "LoadBalancerOrigin",
            "ViewerProtocolPolicy": "redirect-to-https",
            "ForwardedValues": {
              "QueryString": false,
              "Cookies": {
                "Forward": "none"
              }
            }
          },
          "ViewerCertificate": {
            "CloudFrontDefaultCertificate": true
          },
          "Origins": [
            {
              "DomainName": {
                "Fn::GetAtt": [
                  "PrimaryALBelb",
                  "DNSName"
                ]
              },
              "Id": "LoadBalancerOrigin",
              "CustomOriginConfig": {
                "HTTPPort": 80,
                "HTTPSPort": 443,
                "OriginProtocolPolicy": "http-only",
                "OriginSSLProtocols": [
                  "TLSv1.2"
                ]
              }
            }
          ]
        }
      }
    },
    "PrimaryVPC10100016vpc": {
      "Type": "AWS::EC2::VPC",
      "Properties": {
        "CidrBlock": "10.10.0.0/16",
        "EnableDnsHostnames": true,
        "EnableDnsSupport": true,
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-primary-vpc"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcedgewebsgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "edge-web-sg",
        "GroupDescription": "Allow HTTPS from the internet to public load balancers",
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "edge-web-sg"
          }
        ],
        "SecurityGroupIngress": [
          {
            "IpProtocol": "tcp",
            "FromPort": 443,
            "ToPort": 443,
            "CidrIp": "0.0.0.0/0"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcappruntimesgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "app-runtime-sg",
        "GroupDescription": "Allow application traffic from the edge tier",
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "app-runtime-sg"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcappruntimesgSecurityGroupIngressRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": {
          "Ref": "PrimaryVPC10100016vpcappruntimesgSecurityGroup"
        },
        "IpProtocol": "tcp",
        "FromPort": 80,
        "ToPort": 80,
        "SourceSecurityGroupId": {
          "Ref": "PrimaryVPC10100016vpcedgewebsgSecurityGroup"
        }
      }
    },
    "PrimaryVPC10100016vpcworkersgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "worker-sg",
        "GroupDescription": "Private worker runtime egress only",
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "worker-sg"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcdatastoresgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "data-store-sg",
        "GroupDescription": "Allow PostgreSQL from application runtimes",
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "data-store-sg"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcdatastoresgSecurityGroupIngressRule": {
      "Type": "AWS::EC2::SecurityGroupIngress",
      "Properties": {
        "GroupId": {
          "Ref": "PrimaryVPC10100016vpcdatastoresgSecurityGroup"
        },
        "IpProtocol": "tcp",
        "FromPort": 5432,
        "ToPort": 5432,
        "SourceSecurityGroupId": {
          "Ref": "PrimaryVPC10100016vpcappruntimesgSecurityGroup"
        }
      }
    },
    "PrimaryVPC10100016vpccontrolplanesgSecurityGroup": {
      "Type": "AWS::EC2::SecurityGroup",
      "Properties": {
        "GroupName": "control-plane-sg",
        "GroupDescription": "Private EKS control plane attachment group",
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "control-plane-sg"
          }
        ],
        "SecurityGroupEgress": [
          {
            "IpProtocol": "-1",
            "CidrIp": "0.0.0.0/0"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPublicSubnet1": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "CidrBlock": "10.10.1.0/24",
        "AvailabilityZone": "us-east-1a",
        "MapPublicIpOnLaunch": true,
        "Tags": [
          {
            "Key": "Name",
            "Value": "public-edge-a"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPublicSubnet2": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "CidrBlock": "10.10.2.0/24",
        "AvailabilityZone": "us-east-1b",
        "MapPublicIpOnLaunch": true,
        "Tags": [
          {
            "Key": "Name",
            "Value": "public-edge-b"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet1": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "CidrBlock": "10.10.11.0/24",
        "AvailabilityZone": "us-east-1a",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-app-a"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet2": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "CidrBlock": "10.10.12.0/24",
        "AvailabilityZone": "us-east-1b",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-app-b"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet3": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "CidrBlock": "10.10.21.0/24",
        "AvailabilityZone": "us-east-1a",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-data-a"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet4": {
      "Type": "AWS::EC2::Subnet",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "CidrBlock": "10.10.22.0/24",
        "AvailabilityZone": "us-east-1b",
        "MapPublicIpOnLaunch": false,
        "Tags": [
          {
            "Key": "Name",
            "Value": "private-data-b"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcInternetGateway": {
      "Type": "AWS::EC2::InternetGateway",
      "Properties": {
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-primary-vpc-igw"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcGatewayAttachment": {
      "Type": "AWS::EC2::VPCGatewayAttachment",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "InternetGatewayId": {
          "Ref": "PrimaryVPC10100016vpcInternetGateway"
        }
      }
    },
    "PrimaryVPC10100016vpcPublicRouteTable": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-primary-vpc-public-rt"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPublicRoute": {
      "Type": "AWS::EC2::Route",
      "DependsOn": [
        "PrimaryVPC10100016vpcGatewayAttachment"
      ],
      "Properties": {
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPublicRouteTable"
        },
        "DestinationCidrBlock": "0.0.0.0/0",
        "GatewayId": {
          "Ref": "PrimaryVPC10100016vpcInternetGateway"
        }
      }
    },
    "PrimaryVPC10100016vpcPublicSubnet1RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPublicSubnet1"
        },
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPublicRouteTable"
        }
      }
    },
    "PrimaryVPC10100016vpcPublicSubnet2RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPublicSubnet2"
        },
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPublicRouteTable"
        }
      }
    },
    "PrimaryVPC10100016vpcNatEIP": {
      "Type": "AWS::EC2::EIP",
      "DependsOn": [
        "PrimaryVPC10100016vpcGatewayAttachment"
      ],
      "Properties": {
        "Domain": "vpc"
      }
    },
    "PrimaryVPC10100016vpcNatGateway": {
      "Type": "AWS::EC2::NatGateway",
      "Properties": {
        "AllocationId": {
          "Fn::GetAtt": [
            "PrimaryVPC10100016vpcNatEIP",
            "AllocationId"
          ]
        },
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPublicSubnet1"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-primary-vpc-nat"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPrivateRouteTable": {
      "Type": "AWS::EC2::RouteTable",
      "Properties": {
        "VpcId": {
          "Ref": "PrimaryVPC10100016vpc"
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-primary-vpc-private-rt"
          }
        ]
      }
    },
    "PrimaryVPC10100016vpcPrivateRoute": {
      "Type": "AWS::EC2::Route",
      "Properties": {
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPrivateRouteTable"
        },
        "DestinationCidrBlock": "0.0.0.0/0",
        "NatGatewayId": {
          "Ref": "PrimaryVPC10100016vpcNatGateway"
        }
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet1RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPrivateSubnet1"
        },
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet2RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPrivateSubnet2"
        },
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet3RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPrivateSubnet3"
        },
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "PrimaryVPC10100016vpcPrivateSubnet4RTA": {
      "Type": "AWS::EC2::SubnetRouteTableAssociation",
      "Properties": {
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPrivateSubnet4"
        },
        "RouteTableId": {
          "Ref": "PrimaryVPC10100016vpcPrivateRouteTable"
        }
      }
    },
    "PrimaryVPC10100016vpcDbSubnetGroup": {
      "Type": "AWS::RDS::DBSubnetGroup",
      "Properties": {
        "DBSubnetGroupDescription": "Private subnets for saa-dr-primary-vpc",
        "SubnetIds": [
          {
            "Ref": "PrimaryVPC10100016vpcPrivateSubnet1"
          },
          {
            "Ref": "PrimaryVPC10100016vpcPrivateSubnet2"
          },
          {
            "Ref": "PrimaryVPC10100016vpcPrivateSubnet3"
          },
          {
            "Ref": "PrimaryVPC10100016vpcPrivateSubnet4"
          }
        ],
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-primary-vpc-db-subnet-group"
          }
        ]
      }
    },
    "PrimaryALBelb": {
      "Type": "AWS::ElasticLoadBalancingV2::LoadBalancer",
      "Properties": {
        "Name": "saa-dr-web-alb",
        "Type": "application",
        "Scheme": "internet-facing",
        "IpAddressType": "ipv4",
        "Subnets": [
          {
            "Ref": "PrimaryVPC10100016vpcPublicSubnet1"
          },
          {
            "Ref": "PrimaryVPC10100016vpcPublicSubnet2"
          }
        ],
        "SecurityGroups": [
          {
            "Ref": "PrimaryVPC10100016vpcedgewebsgSecurityGroup"
          }
        ]
      }
    },
    "WebASGautoscaling": {
      "Type": "AWS::AutoScaling::AutoScalingGroup",
      "Properties": {
        "AutoScalingGroupName": "saa-dr-web-asg",
        "MinSize": "2",
        "MaxSize": "10",
        "DesiredCapacity": "2",
        "HealthCheckType": "ELB",
        "HealthCheckGracePeriod": 300,
        "VPCZoneIdentifier": [
          {
            "Ref": "PrimaryVPC10100016vpcPrivateSubnet1"
          },
          {
            "Ref": "PrimaryVPC10100016vpcPrivateSubnet2"
          }
        ]
      }
    },
    "WebInstanceec2": {
      "Type": "AWS::EC2::Instance",
      "Properties": {
        "InstanceType": "t3.small",
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-dr-web-instance"
          }
        ],
        "SubnetId": {
          "Ref": "PrimaryVPC10100016vpcPrivateSubnet1"
        },
        "SecurityGroupIds": [
          {
            "Ref": "PrimaryVPC10100016vpcappruntimesgSecurityGroup"
          }
        ],
        "MetadataOptions": {
          "HttpTokens": "required"
        }
      }
    },
    "AuroraGlobalaurora": {
      "Type": "AWS::RDS::DBCluster",
      "Properties": {
        "DBClusterIdentifier": "saa-dr-global-db",
        "Engine": "aurora-postgresql",
        "EngineVersion": "16.2",
        "VpcSecurityGroupIds": [
          {
            "Ref": "PrimaryVPC10100016vpcdatastoresgSecurityGroup"
          }
        ],
        "MasterUsername": "globaladmin",
        "ManageMasterUserPassword": true,
        "StorageEncrypted": true,
        "BackupRetentionPeriod": 7,
        "DBSubnetGroupName": {
          "Ref": "PrimaryVPC10100016vpcDbSubnetGroup"
        }
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates