Hedronite · Cert Lesson · Cert-Prep / AWS · Wed 2026-08-26

SAP-C02 Route 53 Failover and Alias — the failover that is not a replica

The name moved. The volume did not follow.

Lesson Class: Cert (SAP-C02 — failover, health checks, alias vs CNAME)
Blueprint: Third SAP visit. 08-02 landing zone. 08-14 TGW. Today is the name.
Paired Ops: Python Route 53 health-check and failover-pair census
Paired Dev: try/else / for/else, the else that is not a handler
Grounding: Bootcamp route53.md · SAP notes 5.9 · dr.md Route53 failover
Failover
Active-passive. Primary probe mandatory. Secondary is an address.
Alias
Apex door. EvaluateTargetHealth is the vote on the target.
The trap
A secondary record is not a standby volume.
The name moved. The volume did not follow.

<!-- hal:authoritative:yaml -->

The name moved. The volume did not follow.

§I — Frame: the third SAP visit

The first Cloud-rotation fire, 02 August, took the landing zone. Organizations, OUs, SCPs, Control Tower, the account as the blast radius. The second, 14 August, took the hub. Transit Gateway, RAM shares, the attachment that is not a peering. Those accounts still have to be reached by name when a region stops answering.

The exam's second domain, Design for New Solutions (29%), spends task 2.2 on business continuity and task 2.4 on reliability. Route 53 failover is how a public name survives a region that the TGW can no longer usefully serve. The third domain, Continuous Improvement (25%), asks the same distinction on an existing zone: why an apex CNAME failed, why a private ALB never flipped, why simple routing ignored the check you created.

06-09 already surveyed the edge as a trio of products: Route 53, CloudFront, Global Accelerator, plus the four DR strategies. That lesson stays the survey. Today's cut is narrower. Failover routing. Health-check types. Alias versus CNAME. The trap the candidate imports from RDS: that a "secondary" is a copy.

Coin it: the failover that is not a replica. A replica copies data. A failover record answers a different target. The primary's disk is not in the secondary. The resolver received a different name.

Verified this morning against the SAP-C02 exam guide on docs.aws.amazon.com. Four domain weights unchanged: Organizational Complexity 26%, New Solutions 29%, Continuous Improvement 25%, Migration and Modernization 20%. Pass score 750.

§II — Domain foundations: three objects, one vote

Route 53 does three jobs, and the notes list them in the order you would buy them: register a domain, host the zone, check health (SAP notes, 5.9.1 Overview). You can buy any subset. A zone hosted at Route 53 with a registrar elsewhere is normal. A health check with no record pointing at it is also normal, and it is a finding for an ops census.

A hosted zone is the container. Public zones join the global DNS. Private zones answer inside associated VPCs. Split-view (the clone's "Split Horizon") is two zones with the same name, one public, one private (route53.md, Private Hosted Zones). The exam loves a stem that asks why app.example.com resolves differently on a laptop and on an EC2 instance. Two zones. Same name. Different answers. Not a replica. Two databases.

A record is an answer. A, AAAA, MX, TXT, NS, CNAME, and the alias form of A or AAAA. TTL is how long a resolver may cache. Low TTL is flexibility. High TTL is fewer queries and a slower failover (route53.md, DNS TTL). Failover that must beat a 300-second TTL is a conversation about cache, not about the record you just edited.

A health check is a separate object. The clone says it twice (route53.md, Health Checks). Checkers live in many AWS locations. They probe on a 30-second interval, or 10 seconds at extra cost. A target is healthy when 18% or more of the checkers say so. Endpoint checks speak TCP, HTTP, HTTPS, or HTTP(S) with a string match in the first 5120 characters of the body. HTTP(S) must return 2xx or 3xx (route53.md; SAP notes, 5.9.3.2).

Three check types (route53.md; SAP notes, 5.9.3.1):

  1. Endpoint. A public IP or a public name.
  2. CloudWatch alarm. The check watches the alarm, not the packet.
  3. Calculated. A parent over children; you say how many must pass.

The notes add the private-endpoint fact that fails a common design: checkers are outside the VPC and cannot see private addresses (SAP notes, 5.9.3.3). Options: a public IP (usually wrong), a public dependency you can probe, or a CloudWatch alarm plus a check that watches the alarm. Calculated checks do not punch through a VPC either. They only vote on other checks.

The cheatsheet row is one clause: "DNS, health checks, routing policies" (aws-core-services.md). That is the exam depth for the product name. The rest of this lesson is the vote.

§III — Failover routing, and the policies that are not failover

Failover is active-passive. Two records, same name, same type. PRIMARY and SECONDARY. The primary health check is mandatory. The secondary is optional (SAP notes, 5.9.2.4 Failover; route53.md, Failover Routing). While the primary check is healthy, resolvers receive the primary target. When it fails, they receive the secondary. The DR note is one line: Route 53 can route globally to different regions with failover routing (dr.md, Global Networking).

The secondary is an address. Another region's ALB. A static S3 website that says the service is down. A record in the same zone. It is not a standby volume. If the stem says "the secondary kept yesterday's writes," the candidate has imported Multi-AZ RDS into a DNS question. Send them back to the coin.

Simple cannot carry a check. One record per name, multiple values returned together, the client picks. No health checks (route53.md, Simple Routing; SAP notes, 5.9.2.4 Simple). A check you created and never joined is not failover. The record type is still SIMPLE.

Weighted splits by weight. Health checks are allowed. An unhealthy record is skipped; its weight still sits in the total, and Route 53 draws again (route53.md, Weighted Routing). Weighted is canary and percentage. It is not active-passive. Setting every weight to 0 returns all records. Setting one weight to 0 removes that record from the draw.

Latency sends the resolver to the lowest-latency healthy region. The latency table is not live (route53.md, Latency-Based Routing). If the closest region is unhealthy, the next closest healthy region wins. That is a ranking, not a replica, and not a failover pair.

Geolocation matches the user's location (state, then country, then continent, then default). No match and no default returns NO ANSWER (route53.md). It is a restriction tool. It is not "closest." Closest is geoproximity, which is Traffic Flow, with a bias (route53.md; SAP notes, 5.9.2.4).

Multi-value returns up to eight healthy records. The client picks. The clone's warning is the one to memorize: it is not a substitute for a load balancer (route53.md, Multi Value Routing). 08-20's MIG plus HTTP load balancer replaces an instance. Multi-value omits an answer. Different verb. A stem that offers multi-value as the HA design for a stateful database is a trap.

Sysops notes compress the same list: Simple, Weighted, Latency, Failover, Geolocation, plus a DNS Failover bullet that names health checks and evaluate target health (sysops-administrator-associate.md, 9.1). Use that list as a flash card. Use the clone for the rules that fail questions.

§IV — Alias versus CNAME, and evaluate-target-health

A CNAME maps a name to another name. It cannot sit on the apex. It cannot point at an IP. ELB, CloudFront, and S3 website endpoints give you a DNS name (route53.md, CNAME vs Alias Records). The apex problem is why alias exists.

An alias maps a name to an AWS resource. It works on the apex and on ordinary names. Alias queries against AWS resources are not billed as extra DNS queries. An alias is a subtype: A alias, AAAA alias, sometimes CNAME alias. It is not "a CNAME that AWS likes."

EvaluateTargetHealth is the join between alias and the vote. When true, Route 53 asks the target (the ALB, another record in the zone) whether it is healthy. You may skip a separate endpoint check. When false, the alias is always a candidate. A failover primary that is an alias to an ALB with EvaluateTargetHealth=true satisfies the "primary must have a probe" rule without a HealthCheckId. A failover primary that is a CNAME to the ALB DNS name has two problems: the apex may be illegal, and there is no evaluate-target-health on a CNAME.

The 06-09 lesson already named the other speed limit. Route 53 failover is bounded by TTL and by resolvers that ignore TTL. Global Accelerator keeps two anycast IPs and moves the vote onto the network. That distinction stays in 06-09. Today's stem will ask why a 60-second TTL still took four minutes. The answer is cache, not a missing replica.

Private hosted zones still cannot be probed by endpoint checks (SAP notes, 5.9.3.3). Sharing a private zone across accounts needs a VPC association per account, plus connectivity (peering or TGW). 08-14 already taught the hub. Do not rebuild it here. The DNS fact is the association call. The network fact is already filed.

§V — Worked scenario: the stem that imports RDS

A payments API runs in us-east-1 behind an ALB. A static "we are closed" site sits in S3 in us-west-2. The product owner wants pay.example.com to move to the static site when the east ALB fails. A candidate proposes:

  1. An RDS Multi-AZ standby in us-west-2 so the secondary "has the data."
  2. A CNAME on pay.example.com pointing at the ALB DNS name.
  3. A simple record with two values, ALB and S3, plus a health check created in the console and not attached.

Three misses. Multi-AZ RDS is a replica inside one region, and the standby is not readable. It is the wrong product for a region-level name change. Cross-region read replicas and Aurora Global exist; they are still data-plane copies, and they are not what makes the name move. The name moves with a failover pair.

pay.example.com may or may not be the apex. If the zone is example.com, pay can be a CNAME. If the zone is pay.example.com, the apex cannot. Either way the S3 website and the ALB want aliases, not raw CNAMEs, if you want evaluate-target-health and apex safety.

Simple routing will not use the health check. The check will sit in the account and vote, and the record will keep returning both values.

The design that matches the Bootcamp is two alias records named pay.example.com, type A, failover routing. Primary aliases to the east ALB with EvaluateTargetHealth=true. Secondary aliases to the S3 website endpoint. Optional: an endpoint check on a public /health the API exposes, attached to the primary, if you do not trust the ALB's own target health. No RDS object in the DNS answer.

A second stem: the API is on a private ALB. Endpoint checks go dark. The notes already gave the exit. Emit a CloudWatch metric from inside the VPC. Alarm on it. Point a health check at the alarm (SAP notes, 5.9.3.3). The failover pair stays the same. The probe changed shape. The secondary is still not a replica.

A third stem: the team wants eight healthy endpoints returned so clients can pick. That is multi-value, and it is not a load balancer, and it is not failover. If the requirement is active-passive with one answer at a time, multi-value is the wrong policy.

§VI — Connection to today's Ops and Dev lessons

Ops built a boto3 census: list_health_checks, get_health_check_status, list_resource_record_sets. It prints unpaired primaries, primaries with no probe, and HTTP checks aimed at 10.x. It does not call change_resource_record_sets. The exam will not ask for that script. The exam will ask the findings the script exists to print.

Dev taught try/else and for/else. else is the healthy-primary path. except is a different answer. The candidate who copies the success body into except has made a replica in syntax. The candidate who copies the primary record's value onto the secondary has made a replica in DNS. One coin.

08-14 stays the hub. 08-02 stays the account tree. 06-09 stays CloudFront, Global Accelerator, and the four DR strategies. Today stays the name, the probe, and the pair.

§VII — Practice questions

Question 1
pay.example.com must return an ALB in us-east-1 while that ALB is healthy, and a static S3 site in us-west-2 otherwise. The zone apex is example.com. Which record pair?
tap to reveal
Two A-alias records named pay.example.com, failover routing. Primary aliases to the east ALB with EvaluateTargetHealth true (or a separate endpoint check). Secondary aliases to the S3 website endpoint. Not a CNAME on the pair if you want evaluate-target-health. Not simple. Not multi-value. Not an RDS replica in the west.
Question 2
A health check of type HTTP targets 10.1.2.3, the private IP of an ALB. The failover pair never flips. Why?
tap to reveal
Route 53 checkers are outside the VPC and cannot reach private addresses (SAP notes, 5.9.3.3). Use a CloudWatch alarm check, or probe a public dependency. Giving the ALB a public IP is usually the wrong exit.
Question 3
A candidate creates a health check and a simple record with two IP addresses. They expect unhealthy IPs to drop out. What happens?
tap to reveal
Simple routing cannot attach a health check (route53.md, Simple Routing). Both IPs keep being returned. Multi-value would omit unhealthy records, up to eight answers, and is still not a load balancer. Failover would return one answer at a time.
Question 4
Why can example.com (apex) not be a CNAME to dualstack.my-alb.amazonaws.com, and what replaces it?
tap to reveal
A CNAME cannot sit on the apex (route53.md, CNAME vs Alias). An A alias to the ALB, with the ALB's hosted-zone id, replaces it. Alias queries to AWS resources are not billed as extra DNS queries.
Question 5
Weighted routing has three records, weights 80 / 20 / 0, each with a health check. The weight-80 record is unhealthy. What is returned?
tap to reveal
Route 53 draws from the remaining healthy records. The zero-weight record stays out of the draw unless every weight is 0 (route53.md, Weighted Routing). This is still not failover. Failover would have been one primary and one secondary.
Question 6
A stem says "the secondary Route 53 record kept serving writes after the primary region failed, with a recovery point of zero." What did the candidate confuse?
tap to reveal
They imported a database replica (RDS Multi-AZ, Aurora replica, Aurora Global) into a DNS pair. Route 53 failover changes the answer. It does not copy the volume. Zero RPO is a data-plane property. The name moving is a DNS property. The coin: the failover that is not a replica.

§VIII — Closing

Failover is a pair of answers and a probe. Alias is the apex door. Checkers do not enter the VPC. Simple ignores the check you created. Multi-value is not a balancer. A secondary record is not a standby volume.

The Bootcamp pages are route53.md, SAP notes 5.9, and one line in dr.md. The 06-09 lesson still holds CloudFront, Global Accelerator, and the four DR strategies. Do not restudy them under today's title.

Examine the next practice stem that says "secondary." If the sentence only makes sense when the secondary holds a copy of the data, the coin is already spent. Change the product, or change the verb.

Related