Re:Amazon Aurora Backtrack
by exawsthrowaway on Thursday May 10, 2018 @06:52PM
(#17043599)
I left AWS before Aurora was introduced, but I suspect it's similar to how S3 fulfills a similar promise. From the S3 FAQ[1]:
> Amazon S3 Standard, S3 Standard-Infrequent Access, and Amazon Glacier storage classes replicate data across a minimum of three AZs to protect against the loss of one entire AZ. This remains true in Regions where fewer than three AZs are publicly available.
Italic emphasis is mine.
AWS has long had AZs that were not exposed via EC2, as somebody else pointed out, the S3 FAQ gives the game away that some regions have a 'hidden' AZ.
They are slowly adding a 3rd AZ to regions that didn't have one already.
E.g.
https://aws.amazon.com/blogs/aws/now-open-third-aws-availabi... https://aws.amazon.com/about-aws/whats-new/2018/03/aws-govcl... http://www.datacenterdynamics.com/content-tracks/colo-cloud/...
Re:Amazon Aurora Backtrack
by arosenbaum on Thursday May 10, 2018 @07:01PM
(#17043645)
AWS has consistently stated Aurora storage spans 3 AZs. I believe some 2 AZ regions have a third AZ for internal AWS use only (not a 3rd DC in small regions but otherwise a separate AZ). I would imagine they might run the 5th + 6th copies in storage cells there...seems more likely than the other options...
> In Aurora, we have chosen a design point of tolerating (a) losing an entire AZ and one additional node (AZ+1) without losing data, and (b) losing an entire AZ without impacting the ability to write data. We achieve this by replicating each data item 6 ways across 3 AZs with 2 copies of each item in each AZ. We use a quorum model with 6 votes (V = 6), a write quorum of 4/6 (V w = 4), and a read quorum of 3/6 (V r = 3). With such a model, we can (a) lose a single AZ and one additional node (a failure of 3 nodes) without losing read availability, and (b) lose any two nodes, including a single AZ failure and maintain write availability. Ensuring read quorum enables us to rebuild write quorum by adding additional replica copies.
There are many 2 AZ regions in AWS, of course. I don't think you can stripe 3 copies per AZ, an AZ failure drops you to potentially 2/6, and if you allow for 2/6 and 3/6 writing you could have a split brain. Any thoughts how they manage that?
[1] https://www.allthingsdistributed.com/files/p1041-verbitski.p...