Lecture 206: Routing Policy - Failover
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：04:12
- 来源：Udemy Lecture 28556415
- Slide 数量：6
- 画面切换：01:00、01:48、02:17、02:36、03:28
扫描说明
逐条读取了 Udemy 页面中的 108 条英文 Transcript cue，并按时间轴扫描全长约 04:12 的视频。依据 Active-Passive 原理、Primary Record、Secondary Record、Primary Healthy 验证、故障注入与监控、DNS Failover 与恢复划分为 6 个小节。截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Failover Policy 实现一主一备的 Active-Passive DNS
时间范围：00:00–01:00
总结 / Summary
中文
Failover Routing 由一条 Primary 与一条 Secondary/Disaster Recovery Record 组成，只允许这两个角色各一条。Primary 必须关联 Health Check；Primary Healthy 时 Route 53 返回它，Unhealthy 时自动改答 Secondary。Secondary 也可选配 Health Check，使 Client 始终得到被判定为 Healthy 的 Resource。
English
Failover routing consists of exactly one primary and one secondary or disaster-recovery record. The primary must have a health check. Route 53 returns the primary while healthy and automatically answers with the secondary when the primary is unhealthy. The secondary can optionally have its own health check so clients receive a resource considered healthy.
Transcript
00:00 Okay, so now let's talk about routing policies
00:02 and this one is going to be for the failover.
00:04 So the idea is that we have route 53 in the middle
00:07 and we have EC2 instances,
00:08 one is going to be our primary EC2 instance,
00:11 and the second one is going to be a secondary,
00:13 or disaster recovery, EC2 instance.
00:15 In this case, what's going to happen is that we're going
00:17 to associate our primary record with a health check,
00:19 and this is mandatory.
00:21 And if the health check it becomes unhealthy,
00:23 then route 53 is going to automatically failover
00:26 to the second EC2 instance,
00:28 and start sending that result back instead.
00:32 And of course the secondary EC2 can also be
00:34 associated with the health check as well, if we want it to.
00:37 But there can only be one primary and one secondary.
00:40 Now the client, when it makes DNS requests,
00:42 will automatically get the resource that is deemed healthy.
00:45 So if our primary is healthy,
00:47 then route 53 will answer with a primary record.
00:50 But if the health check is unhealthy, automatically,
00:52 we will get the response of the second record,
00:54 which really helps us do (indistinct) a failover.
00:57 So that's it, let's go in the hands-on
00:58 to see how we can practice this.
2. 创建 Frankfurt Primary，并强制关联 eu-central-1 Check
时间范围：01:00–01:48
总结 / Summary
中文
创建 failover.stephanetheteacher.com A Record，Value 使用 eu-central-1 IP 3.70.14.253，TTL 设为 60 秒，Routing Policy 选 Failover，Failover Record Type 选 Primary。Primary 关联 eu-central-1 Health Check，Record ID 为 EU；这项健康关联使 Route 53 能在故障时切换。
English
Create failover.stephanetheteacher.com as an A record using eu-central-1 address 3.70.14.253, a 60-second TTL, Failover routing, and record type Primary. Associate it with the eu-central-1 health check and use record ID EU. This health association enables Route 53 to switch on failure.
Transcript
01:00 Okay, so now let's leverage these health checks
01:02 and create a failover record.
01:05 So in my hosted zone, I'm going to create a record,
01:09 and this one's going to be called
01:11 failover.stephanetheteacher.com,
01:13 and it's the A record,
01:14 and the first value is going to be
01:15 for my EU-central-1 instance, so the one close to me,
01:19 and the routing policy is going to be a failover.
01:22 So the TTL will set it something really low,
01:24 like 60 seconds.
01:25 And the failover record type has two options.
01:27 It could be either primary or secondary, just these two.
01:30 So this is my primary record, and I will associate it
01:33 with a health check, I have to.
01:35 So it will associate with my health check
01:36 named EU-central-1,
01:38 and the record ID is going to be E.
01:40 So what this is saying is that this record
01:42 should be my primary one,
01:44 but this is going to be associated with a health check,
01:46 which means that you can failover to a second record.
3. 创建 N. Virginia Secondary，Health Check 可选
时间范围：01:48–02:17
总结 / Summary
中文
再创建同名同 Type 的第二条 Record，Value 使用 us-east-1 IP 54.172.8.44，TTL 同为 60 秒，Failover Record Type 选 Secondary，Record ID 为 US。Secondary 的 Health Check 是 Optional；演示可关联 us-east-1 Check，但 Primary 与 Secondary 的 Role 仍是唯一且固定的。
English
Create the second same-name, same-type record using us-east-1 address 54.172.8.44, the same 60-second TTL, failover type Secondary, and record ID US. A health check is optional for the secondary; it may use the us-east-1 check, while the primary and secondary roles remain unique and fixed.
Transcript
01:48 So let's add a new record, and I will keep the record name
01:50 as failover.stephanetheteacher.com,
01:53 and the value of which is going to be my instance
01:55 in US-east-1.
01:58 Okay, we're still going to have to do a failover,
02:00 the TTL is 60 seconds,
02:02 and the failover record type is going to be secondary.
02:05 Now we can optionally associate your health check with it,
02:08 okay, of US-East-1, but you don't have to.
02:10 And the record ID is going to be US.
02:13 Now let's create this record,
02:15 and notice it was successfully created.
4. 两条 Check Healthy 时，DNS 正常返回 Primary Frankfurt
时间范围：02:17–02:36
总结 / Summary
中文
两条关联 Check 均为 Healthy 时，访问 failover.stephanetheteacher.com 返回 eu-central-1c，证明 Route 53 优先回答 Primary。Secondary 即使健康也不会参与正常流量分担；Failover 是 Active-Passive，而非 Weighted、Latency 或 Round Robin。
English
When both associated checks are healthy, failover.stephanetheteacher.com returns eu-central-1c, proving that Route 53 prefers the primary. A healthy secondary does not share normal traffic; failover is active-passive rather than weighted, latency-based, or round robin.
Transcript
02:17 And so let's go back into our health checks.
02:20 And currently these two health checks
02:21 I've associated with my records are healthy.
02:23 So if I go into the URL,
02:26 so if I go to failover.stephanetheteacher.com,
02:31 right now, I get an answer from EU-central-1c,
02:35 That's perfect.
5. 移除 Primary TCP/80 后，Check 与 Healthy Percentage 降为 0
时间范围：02:36–03:28
总结 / Summary
中文
为触发故障，删除 Frankfurt EC2 Security Group 的 HTTP Port 80 Inbound Rule，使 Health Checker 无法访问 Primary。等待阈值生效后 eu-central-1 Check 变为 Unhealthy；Monitoring 中 Health Check Status 从 1 降至 0，Reporting Healthy Checker Percentage 也从 100% 降到 0，说明 Failure 已被可靠确认。
English
To trigger failure, remove the Frankfurt EC2 security group's inbound HTTP port 80 rule so health checkers cannot reach the primary. After the threshold is met, the eu-central-1 check becomes unhealthy. Monitoring shows health-check status fall from 1 to 0 and the percentage of healthy-reporting checkers fall from 100% to 0.
Transcript
02:36 But what I'm going to do is trigger a failure.
02:37 So let's go into the EU-central-1 region,
02:42 and I'm going to find my instances, here,
02:44 and I'm going to find the security group,
02:46 and I'm going to, again, stop some security group roles.
02:49 So let's refresh this page.
02:53 It does exist, that's perfect.
02:54 And for the inbound rule, I'm going to edit it,
02:57 and it will remove the rule on port A.
02:59 So that will make my instance completely unreachable
03:02 from the health checkers.
03:04 So what I have to do now is to wait for this health check
03:06 to become unhealthy,
03:07 and then we'll be able to test the failover.
03:10 So let's refresh, and as we can see now,
03:13 my EU-central-1 health check is deemed unhealthy,
03:16 and we can look into the monitoring tab and see
03:18 really when it got a unhealthy, so this is quite cool.
03:20 So the health checker was positive,
03:21 and then it went to zero,
03:23 and then we can see how many percentage
03:25 of the health checkers did report healthy,
03:26 and again, this went one down to zero.
6. 下一次解析无缝切到 us-east-1，修复后会 Failback
时间范围：03:28–04:12
总结 / Summary
中文
Primary Check 变为 Unhealthy 后，Route 53 不再返回 Frankfurt；刷新同一域名即得到 us-east-1a Secondary，DNS Failover 对 Client 无需改 URL。把 Frankfurt 的 HTTP Rule 加回后，Checker 会重新判定 Healthy；在 TTL 与 Check 状态传播后，Route 53 自动 Failback 到 Primary。
English
Once the primary check is unhealthy, Route 53 stops returning Frankfurt. Refreshing the same hostname reaches the us-east-1a secondary without any client URL change. Restoring Frankfurt's HTTP rule lets the check become healthy again, after which Route 53 automatically fails back to the primary following TTL and status propagation.
Transcript
03:28 So what this means,
03:29 is that now that this health check is unhealthy
03:33 because of the way we set up the failover
03:35 that was linked to this health check.
03:37 Then next time I refresh this,
03:39 I should not be in Eu-central-1c,
03:41 I should be in US-east-1.
03:43 So let's refresh this (indistinct) page,
03:44 and yes, the answer is that we are in US-east-1.
03:48 And so the failover did work seamlessly behind the scenes.
03:51 And while to fix it, you just go back
03:53 into your security group, you would edit the inbound rule,
03:56 and then you would add back the HTTP rule,
03:59 and then automatically the health check
04:01 is going to pass again, and therefore we are going to
04:04 failover back to our primary location, okay.
04:09 So that's it for this lecture, I hope you liked it,
04:10 and I will see you in the next lecture.
整讲总结 / Overall Summary
中文
Failover Routing 是严格的一主一备 Active-Passive DNS：Primary 强制关联 Health Check，Healthy 时独占响应，Unhealthy 时 Route 53 自动切到 Secondary。演示通过移除 Primary TCP/80 让 Check 与 Healthy Percentage 降为 0，随后同一域名无缝从 Frankfurt 切到 N. Virginia，并可在修复后自动回切。
English
Failover routing is strict one-primary, one-secondary active-passive DNS. The primary requires a health check and owns responses while healthy; Route 53 automatically switches to the secondary when it fails. Removing primary TCP/80 drives status and healthy-checker percentage to zero, seamlessly moves the same hostname from Frankfurt to Northern Virginia, and allows automatic failback after repair.
返回顶部 ↑