Multi-Region: recovery

Validates recovery to another Region against your recovery objectives, not just in-Region resilience.

You choose which dependencies to impair in the primary Region, so you can practice detection and recovery.

The test integrates with ARC Region switch so you can track plan execution details in the test report.

This is a recovery test. The RTO countdown starts when test actions begin. The test passes if all success alarms return to OK state within your Multi-Region RTO and remain there until the test actions end. Your service must have a resilience policy with a Multi-Region RTO defined.

Choose dependencies in the impaired Region that are significant enough to trigger your recovery procedure. Pick hard dependencies or DNS endpoints that, if blocked, would meaningfully impair that Region.

The test injects faults in the impaired Region – you perform the recovery action yourself (for example, triggering failover/ARC Region switch plan). The test watches whether your recovery Region comes healthy within your RTO by evaluating alarm state.

Choose success alarms in the recovery Region that validate it's serving traffic – or use global/application-level alarms that reflect overall customer experience.

Consider setting duration longer than your RTO to validate recovery is sustained.

Ensure your dependencies are actively used during the test (traffic is flowing to them) – this validates the block is having an effect. Consider adding alarms or metrics that track dependency usage (for example, request count or connection errors) to verify that the dependency is being exercised during the test.

Dependencies must be resolvable DNS endpoints.

Blocking dependencies that trigger health check failures may cause compute (for example, Amazon ECS tasks) to be replaced. The packet loss action does not re-apply to replacement tasks and may report as failed.

Impaired Region – The Region where faults are injected.

Recovery Region – The Region where you expect your service to recover to.

Duration – The length of time the test actions run. It takes a few additional minutes afterward to collect final results before the test ends. Defaults to your Multi-Region RTO from your service policy plus 30 minutes when you first create the test.

Dependencies to block – Choose dependencies that, if blocked, would significantly impair your service and help validate failover to another Region. By default, the discovered hard dependency with the highest query volume is pre-selected. If no dependencies have been classified as hard, none are selected. You can adjust or manually add dependencies by DNS domain name. Additional dependencies added here are only used for this test and will not be saved to the service's dependency discovery. These defaults apply in the console; when using the API, you provide the dependencies explicitly.

Region Switch plan (optional) – Attaching an ARC Region Switch plan lets the next generation of Resilience Hub include the actual failover timeline in your test results and report. If you use manual failover or a custom automation, leave this empty.