A team runs a stateful relational database for a payments service on a single Amazon RDS instance in one Availability Zone. A recent zonal hardware event took the database offline for over an hour, and the business now requires that an Availability Zone failure trigger an automatic failover with no application code changes and minimal recovery time. The team wants the lowest operational overhead while meeting this requirement. Which approach should they choose?
- ACreate a cross-Region read replica of the RDS instance in a second AWS Region and promote that replica to a standalone primary manually whenever the original Availability Zone becomes unavailable.
- BSchedule automated RDS snapshots every fifteen minutes and write a runbook so an operator can restore the latest snapshot into a healthy Availability Zone after an outage is detected.
- CConvert the RDS instance to a Multi-AZ deployment so AWS maintains a synchronous standby in a second Availability Zone and automatically fails over to it when the primary Availability Zone is impaired. Correct
- DAdd an in-Region RDS read replica in a second Availability Zone and point the application at the replica endpoint so reads continue if the primary Availability Zone fails.
Why A is wrong: A cross-Region read replica protects against Regional loss but promotion is a manual step that adds recovery time, and it addresses a different blast radius than the single-AZ failure the requirement actually targets.
Why B is wrong: Frequent snapshots reduce data loss but restoring one is a manual, slow operation that misses the automatic-failover and minimal-recovery-time requirement, leaving the service down while the restore runs.
Why C is correct: Multi-AZ keeps a synchronous standby in another Availability Zone and performs an automatic DNS-based failover on a zonal fault, meeting the requirement with no code change and the least operational overhead.
Why D is wrong: A read replica serves reads only and cannot accept writes without manual promotion, so a payments database that needs writes after an AZ loss is not protected by this design.