Route 53 Failover Routing with Regional Application Load Balancers – SAP-C02 Study Guide

Purpose of This Lesson

This hands-on pattern demonstrates how to create an active-passive, multi-Region web application using:

• An Application Load Balancer (ALB) in each Region
• A web application deployed behind each ALB
• A public Route 53 hosted zone
• Route 53 failover routing records
• Route 53 health checks that determine whether the primary endpoint is available

Under normal conditions, Route 53 directs users to the primary Region. If the primary endpoint becomes unhealthy, Route 53 returns the secondary Region’s ALB as the DNS answer.

Key Concepts

Route 53 failover routing is active-passive

Failover routing uses two records for the same DNS name:

• One record is designated Primary.
• One record is designated Secondary.

When the primary endpoint is healthy, Route 53 answers queries with the primary record. When the primary health check fails, Route 53 answers with the secondary record.

This is different from routing policies intended to distribute traffic continuously, such as weighted, latency-based, or geolocation routing.

ALBs are Regional endpoints

An ALB is scoped to a single AWS Region and is deployed across multiple Availability Zones within that Region. A multi-Region failover design therefore requires a separate ALB and application deployment in each Region.

The Route 53 records point to the ALB DNS names using alias records. Alias records are preferable to CNAME records for AWS resources because they can target supported AWS endpoints at the zone apex and do not incur an additional Route 53 query charge for the alias target.

Public hosted zones are required for public DNS failover

The example uses a public web application accessed from the internet. The DNS name must therefore be hosted in a public hosted zone. A private hosted zone would be appropriate only for clients resolving names through associated VPCs or hybrid DNS infrastructure.

Health checks determine whether the primary should receive traffic

A Route 53 health check can test the ALB DNS name over HTTP. The health check must use the correct:

• Endpoint hostname
• Protocol
• Port
• Optional path

For example, an HTTP health check against port 80 tests whether the ALB can respond to HTTP requests. Blocking port 80 at the ALB security group causes the health check to fail, which triggers DNS failover.

A health check on the ALB endpoint is not necessarily the same as checking the health of every backend target. The ALB itself may be reachable while some or all targets are unhealthy, depending on the endpoint behavior and configuration. Design the health-check path so it represents the application’s real availability.

DNS failover is not connection failover

Route 53 changes DNS answers; it does not move existing TCP connections or instantly redirect clients that have cached the old answer. The effective failover time depends on factors including:

• Route 53 health-check detection timing
• DNS record TTL
• Resolver and client caching
• Browser and application DNS behavior
• Connection reuse and retry behavior

A short TTL can reduce the time clients retain the primary answer, but it cannot eliminate all caching delays.

Regional resources and AMIs are separate

Amazon Machine Image IDs are Region-specific. When deploying the same CloudFormation template in another Region, provide an AMI ID that exists in that target Region. The template parameters, VPCs, subnets, security groups, and other regional resources must also be available or created in each Region.

Architecture Decision Guide

Requirement	Recommended design	Important consideration
Active-passive application across Regions	Route 53 failover routing with Primary and Secondary records	The secondary normally receives no user traffic until failover
Active-active traffic distribution	Latency-based, weighted, geolocation, or multivalue answer routing	These policies are not the same as health-based primary/secondary failover
Public application DNS	Public hosted zone with alias A/AAAA records to regional ALBs	The hosted zone must be authoritative for the application domain
Private internal application	Private hosted zone and appropriate private load balancers or endpoints	Public Route 53 health-check behavior and network reachability require careful design
Endpoint availability testing	Route 53 health check against an ALB DNS name and suitable path	Ensure the tested path reflects application health, not only load balancer reachability
Multi-AZ regional resiliency	ALB nodes in multiple Availability Zones with healthy targets in each AZ	Multi-AZ resilience does not protect against a full-Region failure
Repeatable lab or deployment	CloudFormation deployed independently in each Region	Region-specific parameters, including AMI IDs, must be supplied

Exam-Relevant Takeaways

• Route 53 failover routing supports an active-passive architecture with a primary and secondary record.
• A failover record set requires an identifier such as Primary or Secondary so Route 53 can distinguish the records.
• Route 53 health checks can control whether the primary record is considered eligible to answer DNS queries.
• An ALB is Regional, so multi-Region failover requires an ALB and application stack in each Region.
• Use alias A or AAAA records to reference ALBs rather than hard-coding load balancer IP addresses.
• A public internet-facing application generally uses a public hosted zone.
• Health-check failure does not automatically repair the primary application. It only changes DNS responses while the failure condition persists.
• DNS failover is subject to health-check detection and DNS caching. It should not be described as instantaneous or guaranteed to affect every client at the same time.
• CloudFormation stacks are Region-scoped. Deploying the same template in two Regions creates independent stacks.
• Testing failover by removing the ALB’s HTTP ingress rule is useful because it causes an HTTP health check to fail, but it is not a production failure-management method.

Common Exam Traps

• Confusing failover with latency routing: Failover sends traffic to the secondary only when the primary is unhealthy. Latency routing can send users to different healthy Regions based on network latency.
• Assuming Route 53 checks EC2 instances directly: In this pattern, the health check targets the ALB DNS name. The ALB’s listener, security group, target health, and application response all affect the observed result.
• Expecting immediate global redirection: Existing DNS caches may continue returning the primary endpoint until the cached TTL expires.
• Using a CNAME at the zone apex: A CNAME cannot be used at the root of a DNS zone. An alias record can target an ALB and can be used at the zone apex.
• Deploying the same AMI ID in every Region: AMI IDs are Region-specific unless an image is copied or independently available in the destination Region.
• Treating an ALB as global: ALBs are Regional. Global entry points require DNS or another global traffic-management service.
• Assuming a Route 53 health check validates business correctness: A successful HTTP response may not mean the application is fully functional. Use a meaningful health-check path and application-level checks where appropriate.
• Forgetting to make the secondary usable: A secondary DNS record alone does not provide resilience if its ALB, targets, data layer, dependencies, or security controls are not operational.

Real-World Engineer Notes

• Keep the application configuration and deployment process consistent between Regions, but do not assume the data layer is automatically replicated. Stateless web tiers are easier to fail over than stateful databases.
• Use a dedicated health endpoint that verifies the dependencies required to serve production traffic, while avoiding checks that create excessive load or expose sensitive information.
• Confirm that Route 53 health-check traffic can reach the endpoint. Security groups, network ACLs, WAF rules, authentication requirements, and listener configuration can all cause false failures.
• Consider whether the health check should test the ALB’s default DNS name or a custom hostname. Host-based routing and TLS certificate configuration may require the request to use the application hostname.
• Set and test DNS TTLs based on the desired recovery behavior. Lower TTLs can improve responsiveness but may increase DNS query volume and do not override resolver behavior.
• Automate deployments in both Regions and regularly test failover. An idle secondary environment can drift from the primary and fail when it is needed.
• Monitor Route 53 health checks, ALB target health, application metrics, and failover events. Alerting should distinguish an unhealthy primary from an unhealthy secondary.
• After a lab, remove the CloudFormation stacks, Route 53 health checks, and failover records. Preserve the hosted zone’s required NS and SOA records.

Quick Reference Summary

• Pattern: Active-passive multi-Region web application
• DNS service: Amazon Route 53
• Routing policy: Failover
• Primary: Receives traffic while its health check passes
• Secondary: Receives traffic when the primary is unhealthy
• Targets: Regional Application Load Balancers
• Record type: Alias A or AAAA
• Hosted zone: Public hosted zone for internet-facing applications
• Health check: Endpoint test using the ALB DNS name, protocol, port, and optional path
• Resiliency scope: Cross-Region DNS failover plus ALB multi-AZ resilience
• Main limitation: DNS caching and health-check detection delay

Flashcards

1. Q: What Route 53 routing policy provides primary/secondary DNS failover?

A: Failover routing.

1. Q: What happens while the primary failover record is healthy?

A: Route 53 returns the primary endpoint for DNS queries.

1. Q: What happens when the primary health check fails?

A: Route 53 returns the secondary endpoint, subject to DNS caching and propagation behavior.

1. Q: Are ALBs global or Regional resources?

A: ALBs are Regional and operate across multiple Availability Zones in one Region.

1. Q: Which Route 53 record type is typically used to target an ALB?

A: An alias A or AAAA record.

1. Q: Why is an alias record useful at the root of a domain?

A: It can target supported AWS resources such as an ALB without the zone-apex restriction that applies to CNAME records.

1. Q: What type of hosted zone is normally used for a public web application?

A: A public hosted zone.

1. Q: What does a Route 53 health check actually control in a failover design?

A: Whether the associated endpoint is considered healthy and eligible to receive DNS traffic.

1. Q: Does DNS failover terminate or migrate existing client connections?

A: No. It changes future DNS answers; existing connections and cached answers may persist.

1. Q: Why can the same CloudFormation template require different AMI parameters in two Regions?

A: AMI IDs are Region-specific.

1. Q: Is failover routing active-active or active-passive by default?

A: Active-passive: the primary is preferred and the secondary is used after primary failure.

1. Q: What is a key risk of an untested secondary Region?

A: Configuration drift or missing dependencies may prevent it from serving traffic during a real failure.

Practice Questions

Question 1

A company hosts a public application behind an ALB in us-east-1. It has deployed an equivalent ALB and application in us-west-1. The company wants all traffic to use the eastern Region unless it becomes unhealthy. Which Route 53 configuration best meets the requirement?

• A. Latency-based records for both ALBs
• B. Weighted records with a 100/0 distribution
• C. Failover records with the eastern ALB as Primary and the western ALB as Secondary
• D. Geolocation records that map North America to the eastern ALB

Correct answer: C

Explanation: Failover routing explicitly models an active-passive relationship. Latency, weighted, and geolocation policies do not provide the same primary/secondary semantics.

Question 2

An architect creates a Route 53 failover alias record for an internet-facing ALB but cannot select a health check in the record configuration. What should the architect do?

• A. Create a Route 53 health check for the ALB endpoint and associate it with the record
• B. Create an Amazon Inspector assessment for the ALB
• C. Add a second alias record with the same failover role
• D. Replace the ALB with a Network Load Balancer

Correct answer: A

Explanation: A Route 53 health check can test the ALB’s DNS name over the required protocol and port. Its status can then determine whether the failover record is healthy.

Question 3

A team blocks inbound HTTP traffic to the primary ALB to simulate an outage. Route 53 eventually directs new DNS lookups to the secondary ALB, but some users continue reaching the primary for several minutes. What is the most likely explanation?

• A. ALBs cannot be used with Route 53 failover routing
• B. DNS resolvers or clients have cached the previous DNS answer
• C. The secondary record must use a CNAME instead of an alias
• D. Route 53 always waits 24 hours before failing over

Correct answer: B

Explanation: DNS failover does not invalidate cached answers. The health-check transition and resolver/client caching contribute to the observed delay.

Question 4

A CloudFormation template deploys an EC2-based web application behind an ALB in two Regions. The deployment succeeds in the first Region but fails in the second because the specified AMI cannot be found. What is the most likely cause?

• A. ALB target groups cannot span Regions
• B. AMI IDs are Region-specific
• C. Route 53 requires a private hosted zone
• D. CloudFormation stacks cannot be deployed more than once

Correct answer: B

Explanation: AMI IDs are scoped to a Region. The template must receive an AMI that exists in the destination Region, or the image must be copied there first.

Question 5

A company uses a Route 53 health check that requests /health from an ALB. The ALB is reachable, but the application has lost access to a required database and still returns HTTP 200 for /health. What improvement would most directly reduce the risk of routing users to a broken primary application?

• A. Change the failover policy to geolocation routing
• B. Use a health-check endpoint that validates the dependencies required for serving requests
• C. Increase the DNS TTL substantially
• D. Remove the secondary record

Correct answer: B

Explanation: The health endpoint should represent meaningful application availability. A basic load balancer response may not detect dependency failures that make the application unusable.