Lesson 11 of 16

High Availability & Failover Models Compared

Applies to PostgreSQL 13–17 Last reviewed Jun 2026 Grounded in source

The one thing to understand first

Every HA design answers the same two questions: how much data can I lose on failover (RPO, the recovery point) and how long am I down while it happens (RTO, the recovery time). The architecture family decides the answers. Family one fails over between machines that each have a copy of the data; family two fails over between machines that share one durable storage layer.

Family one: synchronous standby on its own storage

RDS Multi-AZ, Cloud SQL regional HA, and Azure Flexible Server zone-redundant HA all work the same way: a standby in another zone is kept current by synchronous replication, so an acknowledged commit exists in two zones before the client is told it committed. RPO is effectively zero for committed transactions. On failure, the provider promotes the standby and repoints DNS — RTO is typically tens of seconds to a couple of minutes, dominated by failure detection and the standby finishing recovery. The standby is generally not readable; it is pure insurance.

Family two: shared-storage failover

Aurora and AlloyDB do not copy data to the failover target because the storage is already shared and already durable across AZs. Promoting a replica is mostly a matter of pointing writes at it; there is no data to replay from scratch, so RTO is short (often well under 30 seconds for Aurora). RPO is governed by the storage quorum, which already holds every acknowledged commit. The catch is cache warm-up: the newly-promoted node starts with a cold buffer cache, so latency is briefly elevated.

This is a Pro lesson

Get every Learning Pathway and cookbook recipe — grounded in PostgreSQL source code, with diagnostics, fixes, and prevention for each topic.

Continue this lesson to learn:

  • Serverless: consensus on the log
  • What people miss
  • Key takeaway
  • All 36 Learning Pathway lessons
  • 170+ cookbook recipes
  • Source-grounded diagnostics & fixes

Secure checkout Cancel anytime Source-grounded

Keep going

Related & next steps

Was this helpful?

← Back to 06 — Managed PostgreSQL in the Cloud: Architecture & Trade-offs