We brought up eu-de-1 in Frankfurt in 2021 as a warm standby and a second data residency option. Five years on, some honest corrections.
We assumed the primary value would be disaster recovery. It has not been — we have never failed over for a disaster. The actual value has been data residency, which customers ask about in nearly every enterprise procurement, and maintenance flexibility, which lets us do disruptive work in one region at a time.
We assumed warm standby would be cheap. It is not. A standby that is genuinely warm enough to take traffic is most of the cost of a live region, and a standby that is cheap enough to be comfortable is not warm enough to trust. We spent two years pretending otherwise before accepting the bill.
We assumed we would practise failover quarterly. We managed it twice in five years until 2024, because a real failover test is disruptive and there was always a reason to postpone. We now schedule it as a mandatory maintenance window twelve months ahead and treat postponement as requiring executive sign-off. Since then we have done four.
The correction that matters most: a standby you have not failed over to is a hypothesis, not a capability.