Thans! So do you have a staging environment for everything, then cut off the network or kill the instances, Aurora DB, etc.? Simulate some load while its going on, and then check for data loss? Then if that works try it in prod?

It seems like a lot of work, and it seems that as architectures evolve it would be hard to ensure that the multi-AZ failover works well.