> In Aurora, we have chosen a design point of tolerating (a) losing an entire AZ and one additional node (AZ+1) without losing data, and (b) losing an entire AZ without impacting the ability to write data. We achieve this by replicating each data item 6 ways across 3 AZs with 2 copies of each item in each AZ. We use a quorum model with 6 votes (V = 6), a write quorum of 4/6 (V w = 4), and a read quorum of 3/6 (V r = 3). With such a model, we can (a) lose a single AZ and one additional node (a failure of 3 nodes) without losing read availability, and (b) lose any two nodes, including a single AZ failure and maintain write availability. Ensuring read quorum enables us to rebuild write quorum by adding additional replica copies.
There are many 2 AZ regions in AWS, of course. I don't think you can stripe 3 copies per AZ, an AZ failure drops you to potentially 2/6, and if you allow for 2/6 and 3/6 writing you could have a split brain. Any thoughts how they manage that?
[1] https://www.allthingsdistributed.com/files/p1041-verbitski.p...