Question

Design automatic failover for the primary database of an e-commerce order service with async cross-AZ replicas and one async cross-region replica. The business wants RPO near zero for orders (no lost paid orders) and RTO under 60 seconds, but cannot afford the latency of synchronous cross-region replication on every write. Reconcile these goals: how do you do failover, and what do you tell the business is actually achievable?