Home IoT Tips on how to implement a catastrophe restoration answer for IoT platforms on AWS

Tips on how to implement a catastrophe restoration answer for IoT platforms on AWS

Tips on how to implement a catastrophe restoration answer for IoT platforms on AWS


This weblog publish introduces a real-world use case from Web of Issues (IoT) service suppliers that use Catastrophe Restoration for AWS IoT to enhance the reliability of their IoT platforms.

IoT service suppliers, particularly these operating high-reliability companies, require constant gadget connectivity and the seamless switch of connectivity configurations and workloads to different areas when regional IoT companies develop into unavailable. This weblog publish describes a customizable answer that permits cross-region switch for AWS IoT Core and software companies that depend on it.


Integrating a catastrophe restoration (DR) answer inside an IoT platform has emerged as a vital crucial for firms working within the IoT area. The inherent complexity of IoT methods, characterised by quite a few interconnected gadgets and huge knowledge streams, amplifies the dangers posed by potential disruptions. Provided that IoT platforms usually carry vital purposes throughout industries akin to healthcare, manufacturing, and autonomous autos, even a quick downtime or knowledge loss may result in extreme monetary losses, compromised buyer belief, and regulatory non-compliance. By incorporating catastrophe restoration functionality into your IoT structure, you possibly can proactively mitigate these dangers, ship enterprise continuity, and reinforce your IoT platform’s reliability towards community outages, software unavailability, and unexpected occasions.

Answer overview

The structure proven in Determine 1 exhibits how the DR answer is adopted and prolonged to the excellent DR implementation within the IoT platform of the suppliers. A number of AWS accounts are used within the structure since many IoT service suppliers desire the multiple-account technique on AWS.

  • Amazon Route 53, within the shared companies account, controls the fail-over in accordance with outcomes returned by the well being checks of Amazon Route 53. The well being checks make the calls to the APIs positioned into a number of AWS accounts and determine to carry out fail-over in accordance with the responses from the API calls.
  • The IoT service suppliers’ purposes constructed on AWS IoT Core are deployed within the IoT companies account, together with the DR answer composed of AWS IoT Core guidelines engine, Amazon DynamoDB, AWS Lambda, and AWS Step Features.
  • The command & management account exposes the APIs to combine with exterior administration consoles that are used to concern gadget administration instructions, akin to for the onboarding or suspension of gadgets. The AWS Lambda features behind the APIs assume AWS Identification and Entry Administration (AWS IAM) roles offered by the IoT companies account to run the instructions.
  • The information analytics account makes use of the occasion buses offered by Amazon EventBridge to soak up the info from the IoT companies account. The information could be swallowed by a number of Amazon EventBridge targets, for instance, Amazon Kinesis Knowledge Streams, AWS Step Features, and many others. These targets can additional course of the info on demand and launch knowledge insights to exterior knowledge visualization dashboards.

Determine 1: The structure of the dependable IoT answer with DR

Catastrophe restoration

The answer makes use of Amazon DynamoDB international tables to synchronize all of the operations towards AWS IoT Core within the main area to the secondary area. AWS Step Features and the AWS Lambda perform within the secondary area replicate all these operations into AWS IoT Core within the secondary area. All the info synchronized for DR throughout the areas is software irrelevant and never required to be maintained by the customers.

Well being checks

The answer makes use of Amazon Route 53 well being checks to determine the fail-over launch. All of the elements beneath are monitored and the failure from any one in all them can set off the fail-over course of. The elements present the well being standing of:

  • AWS IoT Core message dealer
  • Utility companies
  • Command & management companies
  • Knowledge analytics companies

The unhealthy standing of every consider every of the areas is detected by the APIs powered by Amazon API Gateway positioned in each the first area and the secondary area of the IoT companies account, the command & management account, and the info analytics account. These APIs and the Lambda features behind them use predefined checkpoints within the code logic to determine whether or not to return failure or success within the responses. The API positioned within the IoT companies account makes use of the identical logic offered by the DR answer to examine the well being of AWS IoT Core, and it additionally checks the well being of the applying companies. The APIs positioned within the command & management account and the info analytics account examine the well being of these companies and return failure as soon as an error is detected.

As proven by the dotted pink traces in Determine 1, the AWS Lambda perform utilized in Amazon Route 53 well being checks makes calls to the APIs and receives all of the responses, throughout all of the AWS accounts included within the structure. The VPC endpoint for Amazon API Gateway can assist the Lambda perform invoke the APIs throughout accounts. Please consult with utilizing interface VPC endpoint to entry a non-public API in one other AWS account for particulars. The Lambda perform aggregates the API response and decides whether or not to set off the fail-over course of or not. The choice is handed to Amazon Route 53 by way of the well being examine APIs, and Amazon Route 53 performs the fail-over in accordance with the choice.

Fail-over course of

Amazon Route 53 follows the insurance policies outlined within the information to implement the fail-over. As proven in Determine 2, iot.shiyin.individuals.aws.dev is the IoT knowledge endpoint used on the gadgets. The gadgets get the DNS vacation spot from primaryiot.shiyin.individuals.aws.dev or failoveriot.shiyin.individuals.aws.dev after DNS lookup, and connect with the vacation spot. The locations the place the information route site visitors could be AWS IoT endpoint and AWS IoT Core configurable endpoints.

Determine 2: The information for fail-over in Amazon Route 53

As soon as the fail-over begins, AWS IoT System SDK operating on the gadgets must terminate the connection to AWS IoT Core within the main area and connect with AWS IoT Core within the secondary, as solely through the reconnection does the SDK search for the DNS vacation spot from Amazon Route 53. If the fail-over is triggered by AWS IoT Core unavailability, the SDK performs reconnection routinely for the reason that connection between the gadget and AWS IoT Core is already lower off by the unavailability. If the fail-over shouldn’t be triggered by AWS IoT Core unavailability, the SDK might be pressured to chop over to the secondary area as a result of the present connection between the gadget and AWS IoT Core within the main area remains to be lively and required to be terminated. There are a number of choices to set off the reconnection.

  1. Ship Amazon Easy Notification Service (SNS) notifications from the Amazon Route 53 well being checks, as proven in Determine 3. The notifications could be processed and delivered to the gadgets.
    Determine 3: Notification configuration in Amazon Route 53 well being examine
  2. Terminate the present connections from the IoT companies. IoT companies can get notifications from the well being examine and provoke new connections that interrupt the present connections between the gadget and AWS IoT Core, for the gadgets reconnecting.
  3. Search for the DNS vacation spot incessantly. The gadgets evaluate the vacation spot returned from DNS lookup to the vacation spot presently in use, and actively reconnect to the brand new vacation spot if they’re totally different.

As proven in Determine 1, the applying companies implement excessive availability for the fail-over, counting on the Lambda features deployment in each areas, multi-region entry factors of Amazon Easy Storage Service (Amazon S3), and international desk replication of Amazon DynamoDB. As proven by the orange traces in Determine 1, the administration consoles publish messages to the command & management companies by way of Amazon Route 53. As soon as the well being examine returns failure, Amazon Route 53 factors the API endpoint to the companies within the secondary area. As proven by the purple traces in Determine 1, to reduce knowledge loss, the info from the Amazon EventBridge occasion bus in each areas is ingested into the info visualization. Throughout the fail-over, the info that remained within the main area can proceed to be processed.

Restoration Time Goal (RTO) and Restoration Level Goal (RPO)

The RTO of the structure primarily depends upon the length of the fail-over. The length consists of 4 elements:

  • The DNS resolvers use the Amazon Route 53 information of their cache for a sure interval, i.e., TTL configuration, earlier than they ask Amazon Route 53 for the newest information.
  • File interval is between the time that every well being examine will get a response and the time that it sends the subsequent well being examine request.
  • Failure threshold is the variety of consecutive well being checks that should go or fail to alter the present standing of the vacation spot from unhealthy to wholesome or vice versa.
  • The processing time of the well being checks depends on the efficiency of APIs used within the well being checks.

The fail-over length could be lower down by decreasing the variety of these elements, and the requests might be made to the well being checks by Amazon Route 53 extra incessantly.

The RPO of the structure could be impacted by the next elements:

  • When the first AWS IoT Core runs into an outage, the MQTT messages won’t be processed by the principles engine though they’re acquired by AWS IoT Core.
  • When the command & management companies within the main area develop into unavailable, all of the API calls from the administration consoles might be forwarded routinely by Amazon Route 53 to the secondary area.
  • The AWS Lambda perform focused by AWS IoT Core guidelines engine accesses the Amazon EventBridge occasion bus by way of Amazon EventBridge International Endpoint powered by Amazon Route 53. The worldwide endpoint will transmit the info ingested to the occasion bus within the secondary area, as soon as the first occasion bus turns into unavailable.
  • When AWS IoT Core stays working however the software companies fail within the main area, the gadgets maintain connecting and publishing knowledge to the first AWS IoT Core till Amazon Route 53 completes altering the DNS vacation spot. Throughout the vacation spot change, these knowledge might be processed if the command & management companies set off the fail-over, and the info can’t be processed if the info analytics companies set off the fail-over.


By leveraging the DR structure launched on this weblog, IoT service suppliers can merely implement catastrophe restoration inside their IoT platforms and reap a large number of advantages. You’ll be able to assist safeguard towards potential income loss ensuing from IoT service interruptions, domesticate buyer belief and loyalty, and improve your IoT platform’s safety posture.

Past threat mitigation, the adoption of DR bolsters the operational effectivity of IoT companies by decreasing downtime-related prices and minimizing the necessity for handbook interventions throughout disruptions.

We stay up for seeing the way you allow catastrophe restoration to strengthen the reliability of your IoT platforms constructed on AWS. Get began with AWS IoT by going to the AWS Administration Console.

In regards to the writer

Shi Yin is a senior IoT advisor from AWS Skilled Providers, primarily based in California. Shi has labored with many enterprise prospects to leverage AWS IoT companies to construct IoT options and platforms, e.g., Sensible Houses, Sensible Warehouses, Related Autos, Business IoT, Industrial IoT, and many others.




Please enter your comment!
Please enter your name here