Cross-Region Backups

Why Same-Region Backups Fail Their Purpose

 backups in the same region as production:

 region dies → production AND its backups die together.
 ransomware with regional access encrypts both.
 credential compromise reaches both.

 the backup's job is surviving PRODUCTION'S disasters.
 same-blast-radius copies are decoration, not protection.

The Geography Patterns

 CROSS-REGION COPY:
   primary backup in-region (fast restores)
   + async copy to second region (survival copy)

   [region-A]──backups──►[A-backup store]
        │ async replication
        ▼
   [region-B backup store]  ← survives A's death ✓

 MULTI-REGION SPREAD (stronger):
   copies across ≥2 distant regions; no single event
   touches all. cost grows; compliance sometimes demands it.

 CLOUD-NATIVE options: managed cross-region snapshot copies,
   replicated object storage, backup vaults with immutability
   (object-lock) — ransomware-resistant by construction.

The Tradeoffs Table

Property	In-region only	Cross-region
Restore speed	fast	slower (distance)
Regional disaster survival	✗	✓
Bandwidth cost	~	significant at TB scale
Compliance posture	weak	required usually

 bandwidth math matters at scale:
 10TB weekly full × cross-region = real money + transfer windows.
 mitigate: incremental-forever strategies, deduplication,
 full-copies only to one region + incrementals beyond.

Immutability and Access Separation

 cross-region alone doesn't stop everything:

 RANSOMWARE with valid credentials deletes/copies backups too.
 defenses:

 □ IMMUTABLE retention (object-lock/WORM): writes can't be
   deleted before lock expiry, even by admins ✓
 □ SEPARATE ACCESS DOMAIN: backup credentials ≠ production
   credentials; separate accounts/projects entirely
 □ MINIMAL automation reach: prod workloads cannot touch
   backup stores (network policies, IAM boundaries)
 □ ONE AIR-GAPPED-ish tier: offline/cold copies for the
   paranoid tier (compliance-grade requirements)

 threat model to state plainly: defend against
 compromised-production-scenario, not just hardware failure.

Restore Implications

 where backups live shapes recovery:

 - REGIONAL DISASTER: restore FROM survivor region into a
   third region or rebuilt original — rehearse THIS path;
   it differs from routine restores (ingress throughput!)
 - LARGE-SCALE restore timing: pulling 20TB cross-region
   takes hours minimum — factor into RTO honestly
 - PRE-STAGED templates: IaC for "rebuild region X from
   region-Y backups" turns archaeology into a runbook step

Interview Framing

“Region containing your backups is gone — now what?” scored answer: the question reveals same-region backup design flaw; present cross-region copy topology with immutable tier, access-separation rationale (ransomware scenario), bandwidth/cost tradeoffs acknowledged, restore-from-survivor-region rehearsal note with honest RTO impact. This question tests whether your DR plan survives losing its OWN safety net.