Multi-Region Active-Active

Active-active is often requested and rarely required, and the distinction is worth forcing early because the cost difference against active-passive is very large.

What it genuinely provides: no failover delay, since traffic is already flowing everywhere; latency proximity for a geographically spread user base; and continuous validation that the second region works — the standing weakness of active-passive being that the passive side is untested until the moment it is needed.

What it costs: the data layer must accept concurrent writes in multiple regions, which means either strong consistency with cross-region coordination on every write (adding tens to over a hundred milliseconds and creating a partition-time availability decision), or eventual consistency with a genuine conflict resolution strategy that the domain must be able to express. Every stateful component inherits this. Operations become harder: deployments must be wave-based, and debugging spans regions.

The middle option that often fits better than either extreme is regional partitioning — active-active at the estate level, single-writer per data partition, with users routed to their home region. Each record has one authoritative region, which eliminates write conflicts entirely while still serving all regions live.

The question that resolves the requirement: what recovery time does the business actually need? If the answer is fifteen minutes, a well-rehearsed active-passive achieves it at a fraction of the cost and complexity, and the rehearsal is where the money should go.