Amazon SAA-C03: Alta Disponibilidad, Tolerancia a Fallos y Recuperación ante Desastres — Guía de estudio

By Laurynas Brazys · 15 July 2026 · #amazon #saa-c03 #certification #exam-prep #study-guide

Forma parte de la AWS SAA-C03 — Guía de estudio completa. Practica con respuestas verificadas en el centro de exámenes de Amazon, o realiza tests cronometrados en ExamRoll.io.

Despliegues Multi-AZ y Replicación

Multi-AZ architectures address failure of a single data center or Availability Zone — nothing more. This distinction is the single most misunderstood point in high-availability design. A Multi-AZ deployment tolerates the loss of an AZ within one Region; it does not tolerate a Region-wide outage, a regional service impairment, or the accidental deletion of a resource that immediately replicates the deletion to the standby. Replication faithfully propagates bad data — logical corruption, schema mistakes, ransomware writes — which is why replication and backup are complementary, not substitutes.

For Amazon RDS, Multi-AZ provisions a synchronous standby replica in a different AZ. Writes commit on both instances before acknowledgment, giving an RPO effectively at zero and an RTO typically of 60–120 seconds during automatic failover. In the classic Multi-AZ instance deployment the standby is not readable — it exists purely for durability and failover. Multi-AZ cluster deployments (two readable standbys) reduce failover time further and provide some read scaling, but still confine themselves to one Region.

For read scaling, add read replicas. Read replicas use asynchronous replication and exist to offload reporting, analytics, and dashboard queries. Treating a read replica as an HA failover mechanism is wrong on three counts: replication is asynchronous (data loss on promotion), promotion is manual or scripted (not automatic), and the primary endpoint is not preserved. When a growing workload needs more read capacity without new complexity, add a read replica; when the requirement is automatic failover with zero data loss, use Multi-AZ. When RPO/RTO must survive a Region failure for a relational engine, Aurora Global Database provides sub-second cross-Region replication lag and sub-minute managed failover RTO.

Amazon ElastiCache follows the same pattern with replication groups. A Redis replication group with Multi-AZ enabled maintains a primary and one or more replicas across AZs; if the primary fails, ElastiCache promotes a replica and updates the primary endpoint. For horizontal scale, Redis (cluster mode enabled) partitions data across shards, each shard being its own replication group. Memcached, by contrast, does not replicate — node loss means data loss for that partition.

Amazon FSx offers Multi-AZ deployment types for FSx for Windows File Server and FSx for ONTAP, using synchronous replication between a preferred and standby file server. FSx for Lustre is generally single-AZ (scratch or persistent); durability for Lustre comes from S3 data repository associations, not from AZ replication.

# RDS Multi-AZ con réplica de lectura entre regiones para DR
DBInstance:
  Type: AWS::RDS::DBInstance
  Properties:
    Engine: sqlserver-ee
    MultiAZ: true              # HA a nivel de AZ (síncrono)
    BackupRetentionPeriod: 35
    CopyTagsToSnapshot: true
    DeletionProtection: true

Copias de Seguridad Automatizadas de RDS y Recuperación a un Momento Específico

RDS automated backups combine a daily snapshot with continuous 5-minute transaction log uploads to S3, giving point-in-time recovery (PITR) to any second within the 1–35 day retention window. If your RPO is 2 hours, RDS’s native backups already cover it — no extra snapshot scheduling is required, and layering AWS Backup on top is redundant unless you need cross-Region copies, cross-account isolation, or Vault Lock semantics beyond what RDS snapshot copy provides. The default automated backup is often the cheapest correct answer to modest RPO requirements.

AWS Backup como Plano de Control Centralizado

AWS Backup is the policy-driven control plane for backup across EBS, EC2 (as AMIs), RDS, Aurora, DynamoDB, EFS, FSx, Storage Gateway, S3, and more. Rather than scripting service-specific snapshot logic, you define backup plans grouping rules that describe frequency, backup window, start/completion windows, lifecycle transitions to cold storage, retention, and destination vaults. Resources are enrolled through resource assignments by tag or ARN, so a tagging convention like Backup=Daily becomes the operational contract that governs coverage. For fleets of hundreds of EC2 instances, tag-based selection is the lowest-effort approach — apply the tag and let AWS Backup enumerate, rather than authoring per-instance schedules.

A backup vault is the KMS-encrypted container where recovery points live. Access is controlled by resource policies on the vault.

BackupPlan:
  BackupPlanName: tier1-daily
  Rules:
    - RuleName: daily-35day
      TargetBackupVault: vault-locked-compliance
      ScheduleExpression: cron(0 5 ? * * *)
      StartWindowMinutes: 60
      CompletionWindowMinutes: 180
      Lifecycle:
        MoveToColdStorageAfterDays: 30
        DeleteAfterDays: 365
      CopyActions:
        - DestinationBackupVaultArn: arn:aws:backup:us-west-2:111122223333:backup-vault:dr-vault
          Lifecycle: { DeleteAfterDays: 365 }

Copias entre Regiones y entre Cuentas

The CopyActions block is the mechanism for cross-Region DR copies. AWS Backup handles the snapshot copy, re-encrypts with a destination-Region KMS key (the destination vault must reference a key in that Region), and applies an independent lifecycle. EBS and RDS snapshots default to the source Region — if the whole Region is impaired, so are the snapshots. Any regulatory or business requirement mentioning regional resilience must include an explicit cross-Region copy step, whether through AWS Backup copy actions, RDS automated snapshot cross-Region copy, or DLM policies with cross-Region destinations.

For cross-account copies, AWS Organizations delegates an administrator account for AWS Backup; the source vault’s policy allows the destination account, and the destination vault permits copies from the source. This is the cost-effective way to centralize DR: one management account holds recovery points from many workload accounts and can restore into either Region. For EC2, an AMI copy to a second Region plus snapshot sharing lets you launch instances there without warm infrastructure. Encrypted snapshots require sharing the CMK — the destination account or Region needs kms:CreateGrant and access to the key. Missing this is why cross-account restores silently fail.

A 24-hour RPO is satisfied cheaply by a daily automated snapshot copied cross-Region — far less costly than a cross-Region read replica or a warm standby cluster. Tighten to continuous replication only when RPO drops below what snapshot cadence can deliver.

Ciclo de Vida de AMI y Copias de Seguridad de EC2

Two mechanisms automate EC2 backups: Data Lifecycle Manager (DLM) and AWS Backup. DLM predates AWS Backup and creates policy-driven EBS snapshots or AMIs on schedule with cross-Region and cross-account copy actions. AWS Backup subsumes this and adds central policy, Vault Lock, and multi-service scope. Prefer AWS Backup when you already run it for other services; use DLM for pure EBS/AMI scenarios where you don’t need vault features.

For stateless web tiers behind an Auto Scaling group with no persistent local data, backing up running EC2 instances is wasteful. The correct posture is to bake a hardened AMI (via EC2 Image Builder or a CI pipeline), reference it in the launch template, and let ASG handle instance replacement. Backup effort concentrates on the stateful tiers whose native automated backups meet the RPO.

Inmutabilidad: Vault Lock y Object Lock

A plain snapshot in your account can be deleted by anyone with the right IAM permission — snapshots alone do not satisfy immutability requirements. Regulatory regimes (SEC 17a-4, FINRA, HIPAA, GDPR) frequently demand write-once-read-many retention that even administrators cannot circumvent. Two AWS mechanisms deliver this.

AWS Backup Vault Lock enforces WORM on a backup vault:

In compliance mode, once the cooling-off period elapses, no user — including the root account — can shorten retention, delete recovery points before expiry, or remove the lock itself. This defeats both insider deletion and a ransomware operator who has fully compromised the account.

aws backup put-backup-vault-lock-configuration \
  --backup-vault-name ComplianceVault \
  --changeable-for-days 3 \
  --min-retention-days 2555 \
  --max-retention-days 2920

S3 Object Lock provides object-level WORM in Governance mode (privileged users with s3:BypassGovernanceRetention can override) or Compliance mode (nobody, including root, can delete or shorten retention). Legal Hold is independent of retention periods. Object Lock requires versioning and must be enabled at bucket creation for full protection.

Reservas de Capacidad para la Región de Conmutación por Error

A DR plan that assumes the failover Region will have EC2 capacity available on the day of a large-scale event is not a plan. When a Region fails, everyone fails over simultaneously, and instance types — especially large, GPU, or specialized shapes — can exhaust. On-Demand Capacity Reservations (ODCRs) in the target Region guarantee capacity for a specific instance type, platform, and AZ, and are billed whether used or not. Pair with a Savings Plan to offset cost. For long-horizon GPU/ML commitments, Capacity Blocks apply; for family flexibility, a Capacity Reservation Fleet covers multiple instance families. The principle: if the business requires guaranteed compute in the DR Region, reserve it — do not rely on best-effort On-Demand availability.

Selección de Estrategia de DR

AWS canonicalizes four DR tiers, each with a distinct cost/recovery tradeoff:

The correct tier is dictated by the business’s RPO and RTO — not architectural preference. A 24-hour RPO tolerates daily cross-Region snapshot copies (Backup & Restore). An RPO of seconds demands continuous replication — cross-Region read replicas, Aurora Global Database, DynamoDB Global Tables, or S3 Cross-Region Replication. Attempting a 5-minute RPO with nightly snapshots is architecturally impossible, regardless of budget. Conversely, defaulting to active-active for every workload is a cost antipattern: it demands globally-consistent data (DynamoDB Global Tables or Aurora Global with write-forwarding), duplicate compute at full scale, and complex traffic steering via Route 53 or Global Accelerator. Pick the cheapest pattern that meets the stated RPO/RTO — for a 2-hour RPO, backup-and-restore or pilot light usually suffices, and warm standby is over-engineering.

Protección contra Eliminación y Salvaguardas por Capas

Resilience is not merely “do we have backups” — it is “can any single actor, mistake, or attack erase them.” Layered controls prevent the one-wrong-click catastrophe:

• RDS: enable DeletionProtection and require a final snapshot on delete.
• EC2: enable DisableApiTermination and DisableApiStop on critical instances.
• DynamoDB: enable deletion protection and point-in-time recovery.
• S3: Versioning + MFA Delete + Object Lock for immutability.
• CloudFormation: DeletionPolicy: Retain on stateful resources and stack termination protection.
• IAM SCPs: deny backup:DeleteRecoveryPoint, backup:DeleteBackupVault, rds:DeleteDBInstance, and ec2:DeleteSnapshot outside break-glass roles.

aws rds modify-db-instance \
  --db-instance-identifier prod-pg \
  --deletion-protection \
  --backup-retention-period 35 \
  --apply-immediately

Combinado con Vault Lock en modo de cumplimiento, esto produce una defensa en profundidad: incluso una credencial de administrador comprometida no puede destruir los puntos de recuperación de última línea de defensa.

Errores Comunes

Confundir Multi-AZ con DR. RDS Multi-AZ, ElastiCache Multi-AZ y FSx Multi-AZ residen dentro de una misma Región. Una interrupción de la API Regional, una eliminación accidental de una tabla o una migración de esquema mal aplicada afectan a ambos nodos. Cualquier requisito que mencione “otra Región”, “fallo regional” o “RPO entre Regiones” exige replicación o copia entre Regiones; Multi-AZ por sí solo no cumple el requisito.

Confundir réplicas de lectura con HA. Las réplicas de lectura son asíncronas, se promueven manualmente y cambian los puntos de conexión. Resuelven el escalado de lectura, no la conmutación por error automática.

Asumir que las instantáneas equivalen a cumplimiento. Las instantáneas sin Vault Lock (modo de cumplimiento) o Object Lock pueden ser eliminadas por cualquier principal con el permiso IAM adecuado y por la cuenta raíz. La retención regulatoria WORM requiere una configuración explícita de inmutabilidad con un período de enfriamiento bloqueado transcurrido.

Instantáneas solo locales para un RPO Regional. Las instantáneas de EBS y RDS por defecto se guardan en la Región de origen. La resiliencia Regional requiere una acción explícita de copia entre Regiones.

Copias de seguridad sin restauraciones probadas o capacidad reservada. Una instantánea que nunca ha restaurado es una hipótesis, no una copia de seguridad. Los simulacros de restauración revelan roles de IAM faltantes, problemas de acceso a claves KMS en la Región y cuenta de destino, y tipos de instancia no disponibles. Sin Reservas de Capacidad para cargas de trabajo críticas, la Región de DR simplemente puede no tener la forma que necesita cuando todos fallan simultáneamente, y el RTO se vuelve ilimitado.

Diseño excesivo para activo-activo. La computación global duplicada, la replicación de datos globalmente consistente y el enrutamiento de tráfico complejo son costosos. Si el RPO/RTO no lo justifica, una arquitectura de piloto automático o de espera en caliente es la correcta.

Copia de seguridad de niveles sin estado. La creación de instantáneas de servidores web efímeros detrás de un ASG desperdicia dinero y complica la recuperación. Cree AMIs, haga referencia a ellas en las plantillas de lanzamiento y concentre la inversión en copias de seguridad en datos con estado.

← Gestión · Todos los dominios

Practica estas preguntas → · Práctica cronometrada en ExamRoll.io →

Explorar Amazon →