Scaling
Is multi-region worth it?
The most expensive default in modern architecture. What the second region truly costs, what it truly buys, and the three cases where it earns its keep.
By TIS Partners · · 2 min
"Should we be multi-region?" arrives in our inbox more than any other question, usually after a cloud provider's bad week makes the news. The honest answer displeases both camps: multi-region is the correct call for a minority of systems, a catastrophic default for the rest, and the deciding variable is almost never the one in the headline.
What does the second region actually buy?
Protection against a full-region failure, which is real but rarer than the outage record suggests; the incidents people remember (S3's 2017 afternoon, the periodic us-east-1 weather) were mostly service or partial-region events, where multi-AZ posture and dependency hygiene decided who suffered, not continental redundancy. It also buys latency locality for genuinely global users, and jurisdiction compliance where law assigns data a homeland. Those are the three honest cases: survival of region loss with a contractual RTO behind it, physics for a global user base, and lawyers.
What does it cost beyond the invoice?
The invoice doubles-ish; the architecture pays more. Data is the whole problem: the moment writes happen in two places, you choose between synchronous replication (latency taxed on every write, forever) and asynchronous (an RPO measured in lost seconds of customer data, acknowledged in writing, ideally before the incident). Failover is a rehearsed capability or it is fiction; an unrehearsed second region is a donation, not insurance. And the coordination machinery itself becomes a leading outage cause: the industry's most instructive postmortems, from Roblox's Consul week to Cloudflare's control-plane outage, are stories about the systems that manage distribution failing harder than distribution itself.
What would have to be true to sign the check?
We ask four questions, in order. Has the single-region posture been finished first (multi-AZ, tested restores, dependency audit)? Most shops asking about regions have unrehearsed backups, which is buying a second house before locking the first one's door. Is there a signed RTO/RPO that single-region arithmetic cannot meet? Not a mood, a signature. Which tier actually needs it? The read path can often go multi-region cheaply (static assets, cached reads at the edge) while the write core stays home; all-or-nothing is a false menu. And who rehearses, on what calendar, with what game-day budget?
Answer those four and the decision generally makes itself, in a record with a reopening condition: revisit at the EU contract, at 30% non-US traffic, at the RTO renegotiation. Until a condition fires, the humble posture (one region, done impeccably, restores rehearsed quarterly) outperforms the ambitious one on every axis that pays invoices, including, most years, availability itself.