arc-region-switch

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

ARC Region switch Expert

ARC Region switch 专家

Overview

概述

Makes the agent an expert on Amazon Application Recovery Controller (ARC) Region switch — the feature for orchestrating cross-Region workload failover and switchover. Supports technical questions, customer positioning, and SA engagement preparation.

Region switch orchestrates recovery for applications already deployed multi-Region. It does not create multi-Region architecture or handle data replication — it orchestrates failover of existing replicas and resources.

使代理成为Amazon Application Recovery Controller (ARC) Region switch方面的专家——该功能用于编排跨区域工作负载的故障转移与切换。支持解答技术问题、客户定位以及解决方案架构师（SA）的参与准备工作。

Region switch 为已部署多区域架构的应用编排恢复流程。它不会创建多区域架构或处理数据复制——仅负责编排现有副本和资源的故障转移。

Guardrail — where this skill's own files live (MCP vs local install)

防护规则——技能文件的存储位置（MCP 本地安装）

Before reading a reference file, determine how this skill was loaded:

Loaded via the AWS MCP
retrieve_skill
tool: the skill's reference files are not on the local filesystem. Fetch each one through
```
retrieve_skill
```
with the
```
file
```
parameter (e.g.
```
file="references/positioning.md"
```
or
```
file="references/doc-links.md"
```
) — do NOT
```
file_read
```
these paths locally or search the filesystem for them.
Installed locally (e.g.
```
.kiro/skills/arc-region-switch/
```
or
```
~/.claude/skills/arc-region-switch/
```
): read reference files from the local skill directory using the relative paths shown here.

This applies only to the skill's own reference files; always read and write user or session data in the working directory, never through

retrieve_skill

读取参考文件前，请确定技能的加载方式：

通过AWS MCP
retrieve_skill
工具加载：技能的参考文件不在本地文件系统中。需通过
```
retrieve_skill
```
工具并指定
```
file
```
参数获取（例如
```
file="references/positioning.md"
```
或
```
file="references/doc-links.md"
```
）——请勿使用
```
file_read
```
读取本地路径或在文件系统中搜索这些文件。
本地安装（例如
```
.kiro/skills/arc-region-switch/
```
或
```
~/.claude/skills/arc-region-switch/
```
）：使用此处显示的相对路径从本地技能目录读取参考文件。

此规则仅适用于技能自身的参考文件；用户或会话数据始终在工作目录中读写，绝不通过

retrieve_skill

操作。

When Not to Use

不适用场景

In-Region failover — Region switch is for cross-Region recovery only. Use AZ-level mechanisms (ALB, Auto Scaling) for in-Region resilience.
Data replication design — Region switch orchestrates failover of existing replicas; it does not set up or manage replication. Use Aurora Global Database, DynamoDB Global Tables, S3 Cross-Region Replication, etc.
AZ-level resiliency — For Availability Zone failures within a single Region, use multi-AZ architecture patterns instead.

区域内故障转移——Region switch仅用于跨区域恢复。区域内弹性请使用可用区（AZ）级机制（如ALB、Auto Scaling）。
数据复制设计——Region switch仅编排现有副本的故障转移；不负责设置或管理复制。请使用Aurora全局数据库、DynamoDB全局表、S3跨区域复制等服务。
可用区级弹性——针对单一区域内的可用区故障，请使用多可用区架构模式替代。

Terminology Constraints

术语约束

ALWAYS use "Region switch" (lowercase 's') for the product name
Use "Routing Controls" only when referring to the Routing Controls execution block or the legacy cluster-based approach — do not use it as a synonym for Region switch
Do NOT conflate triggers (CloudWatch alarms that start execution) with application health alarms (measure actual recovery time)
Region switch orchestrates failover — it does NOT replicate data

产品名称必须使用"Region switch"（小写's'）
仅当指代Routing Controls执行块或传统基于集群的方案时，才可使用"Routing Controls"——请勿将其作为Region switch的同义词
请勿混淆触发器（启动执行的CloudWatch告警）与应用健康告警（衡量实际恢复时间）
Region switch仅编排故障转移——不进行数据复制

Critical Warnings

重要警告

Irreversible in-progress steps: Plan executions can be paused or cancelled, but any step that is already started cannot be reversed without another plan execution.
Monitor during events: Customers should still monitor their application health during an event, even if they configure plan triggers to automatically start a plan execution.
Regional endpoint matters: When deactivating a Region, call
```
start-plan-execution
```
from the healthy Region, not the Region being deactivated. When activating a Region, call from the Region being activated. See StartPlanExecution API.

不可逆的进行中步骤：计划执行可暂停或取消，但已启动的步骤无法通过其他计划执行撤销。
事件期间需监控：即使配置了计划触发器自动启动执行，客户仍需在事件期间监控应用健康状态。
区域端点至关重要：停用区域时，需从健康区域调用
```
start-plan-execution
```
，而非待停用区域。激活区域时，需从待激活区域调用。详情请见StartPlanExecution API。

Workflow

工作流

Classify the question: technical architecture, customer positioning, how-to, troubleshooting, or comparison
Answer from embedded knowledge in this skill
If the knowledge base is insufficient, search official AWS documentation (
```
docs.aws.amazon.com
```
)
Format the response for the audience (engineer, SA, customer)

Always validate:

Correct terminology (Region switch, not routing controls for plan-based features)
Include doc links where helpful (see Documentation Links section)
Use positioning language from the Positioning section

分类问题：技术架构、客户定位、操作指南、故障排除或对比类
使用技能内置知识解答
若知识库内容不足，搜索AWS官方文档（
```
docs.aws.amazon.com
```
）
根据受众（工程师、SA、客户）调整响应格式

始终验证：

术语正确性（针对基于计划的功能，使用Region switch而非routing controls）
必要时添加文档链接（见文档链接章节）
使用定位章节中的话术

Architecture

架构

Components

组件

Component	Description
Plan	Top-level resource scoped to a multi-Region application. Contains workflows.
Child Plan	A self-contained plan nested within a parent plan (one level deep).
Workflow	Ordered sequence of steps within a plan. Defines activation/deactivation logic.
Step	Container for one or more execution blocks, run in parallel or sequence.
Execution Block	Performs a specific recovery action (e.g., scale up, reroute traffic, failover DB).
Trigger	CloudWatch alarm-based automation that initiates plan execution.
Application Health Alarms	CloudWatch alarms indicating app health per Region; used to calculate actual recovery time.
Post-recovery Workflow	Optional workflow that runs after recovery to prepare for future events.
Plan Evaluation	Automated checks verifying plan execution readiness. Verifies IAM permissions, resource existence and configuration, capacity, etc.
Automatic Execution Reports	PDF reports delivered to S3 after each plan execution for compliance/audit.

组件	说明
Plan	面向多区域应用的顶层资源，包含工作流。
Child Plan	嵌套在父计划中的独立计划（仅支持一层嵌套）。
Workflow	计划内的有序步骤序列，定义激活/停用逻辑。
Step	包含一个或多个执行块的容器，支持并行或串行运行。
Execution Block	执行特定恢复操作（如扩容、流量重定向、数据库故障转移）。
Trigger	基于CloudWatch告警的自动化机制，用于启动计划执行。
Application Health Alarms	各区域应用健康状态的CloudWatch告警；用于计算实际恢复时间。
Post-recovery Workflow	恢复完成后运行的可选工作流，为未来事件做准备。
Plan Evaluation	验证计划执行就绪性的自动化检查，包括IAM权限、资源存在性与配置、容量等。
Automatic Execution Reports	每次计划执行后生成的PDF报告，交付至S3用于合规/审计。

Execution Modes

执行模式

Recommend using graceful execution unless not possible (e.g., when an execution block has a dependency on the impaired Region — such as Aurora/DocumentDB/Neptune switchover requiring connectivity to the impaired Region, or a Custom Action Lambda deployed in the impaired Region).

Graceful: Runs all steps in orderly sequence. Preferred for planned switchovers, DR tests, and any scenario where the source Region is still healthy.
Ungraceful: Skips or modifies certain execution blocks — only critical steps run. Use only when the source Region is impaired and graceful execution is not possible.
Post-recovery: Runs after successful recovery in the previously-impaired Region. Requires both Regions to be healthy. Supports a subset of execution blocks — see the Add execution blocks documentation for the current set.

除非特殊情况（如执行块依赖受损区域——例如Aurora/DocumentDB/Neptune切换需要连接受损区域，或自定义动作Lambda部署在受损区域），否则建议使用优雅执行模式。

优雅模式：按顺序运行所有步骤。适用于计划内切换、灾难恢复测试以及源区域仍健康的场景。
非优雅模式：跳过或修改部分执行块——仅运行关键步骤。仅在源区域受损且无法使用优雅模式时使用。
恢复后模式：在先前受损区域恢复成功后运行。要求两个区域均处于健康状态。仅支持部分执行块——当前支持的执行块列表请见添加执行块文档。

Active/Passive vs Active/Active

主备模式 vs 双活模式

Approach	Workflows Needed	Behavior
Active/Passive	1 activation workflow (either Region) OR 2 separate activation workflows (one per Region)	Failover from primary to standby; failback when primary recovers
Active/Active	1 activation workflow + 1 deactivation workflow per Region	Shift-away from impaired Region + return when healthy

方案	所需工作流	行为
主备模式	1个激活工作流（适用于任一区域）或2个独立激活工作流（每个区域一个）	从主区域故障转移至备用区域；主区域恢复后故障回迁
双活模式	每个区域需1个激活工作流 + 1个停用工作流	从受损区域转移流量；区域恢复后回迁流量

Supported Execution Blocks

支持的执行块

Execution blocks are the individual step types a Region switch workflow is composed of — each performs one recovery action, spanning traffic/DNS rerouting, compute scaling, database failover, custom-action Lambdas, manual-approval gates, and nested child plans.

Do not rely on a hardcoded list of block types — ARC adds and changes execution blocks over time. Retrieve the current supported set at query time from the Components & concepts and Add execution blocks documentation.

执行块是构成Region switch工作流的独立步骤类型——每个执行块执行一项恢复操作，涵盖流量/DNS重定向、计算扩容、数据库故障转移、自定义动作Lambda、人工审批门限以及嵌套子计划等。

请勿依赖硬编码的执行块类型列表——ARC会不断添加和修改执行块。查询时请从组件与概念和添加执行块文档获取当前支持的列表。

Recovery Time Tracking

恢复时间跟踪

Recovery Time Objective (RTO): Set when creating a plan
Actual Recovery Time: Plan execution time + time for application health alarms to return to green
Visible on plan execution details page for comparison against RTO

恢复时间目标（RTO）：创建计划时设置
实际恢复时间：计划执行时间 + 应用健康告警恢复正常的时间
在计划执行详情页面可见，可与RTO对比

Plan Evaluation

计划评估

Validates: IAM permissions, resource configurations, running capacity
Warnings surfaced in console, EventBridge, and API
Passing evaluation alone is NOT sufficient — always test by executing plans

验证内容：IAM权限、资源配置、运行容量
警告信息会在控制台、EventBridge和API中显示
仅通过评估并不足够——务必通过执行计划进行测试

Automatic Execution Reports

自动执行报告

PDF reports generated after each plan execution
Delivered to customer-specified S3 bucket (within ~30 min)
Customers must configure the S3 bucket and update permissions for the PlanExecutionRole to enable reporting
Contents: executive summary, plan config, execution timeline, resource states, alarm history, child plan details, glossary
Useful for regulatory compliance and DR audit evidence
See Security Considerations for encryption and access control guidance

每次计划执行后生成PDF报告
交付至客户指定的S3存储桶（约30分钟内）
客户需配置S3存储桶并更新PlanExecutionRole的权限以启用报告功能
报告内容：执行摘要、计划配置、执行时间线、资源状态、告警历史、子计划详情、术语表
适用于法规合规和灾难恢复审计证据
加密和访问控制指南请见安全注意事项

Cross-Account Support

跨账户支持

Plans can orchestrate resources across multiple AWS accounts via IAM roles with cross-account trust policies. This is a key enterprise differentiator — always mention it for large customers.

When configuring cross-account trust policies:

Include condition keys (
```
aws:SourceArn
```
,
```
aws:SourceAccount
```
,
```
sts:ExternalId
```
) to prevent confused deputy attacks
Scope IAM policies to least privilege — avoid
```
*
```
resource wildcards and
```
FullAccess
```
managed policies
Scope permissions to only the specific resources (ASG ARNs, Aurora cluster ARNs, Route 53 health check ARNs, etc.) referenced in execution blocks

计划可通过带有跨账户信任策略的IAM角色编排多个AWS账户中的资源。这是企业级客户的关键差异化特性——面向大型客户时务必提及。

配置跨账户信任策略时：

包含条件键（
```
aws:SourceArn
```
,
```
aws:SourceAccount
```
,
```
sts:ExternalId
```
）以防止混淆代理攻击
IAM策略遵循最小权限原则——避免使用
```
*
```
资源通配符和
```
FullAccess
```
托管策略
权限范围仅限执行块中引用的特定资源（ASG ARN、Aurora集群ARN、Route 53健康检查ARN等）

Regional Availability

区域可用性

Available in multiple commercial AWS Regions and AWS GovCloud (US) Regions — always verify the current list before stating availability to a customer, as Region coverage changes over time. Each Region has its own data-plane endpoint (

arc-region-switch.<region>.api.aws

), ensuring execution doesn't depend on the impaired Region.

Verify the complete list of available regions/endpoints at AWS Regions & endpoints.

在多个商业AWS区域和AWS GovCloud（美国）区域可用——向客户说明可用性前请务必验证当前列表，因为区域覆盖范围会随时间变化。每个区域都有独立的数据平面端点（

arc-region-switch.<region>.api.aws

），确保执行不依赖受损区域。

完整的可用区域/端点列表请验证AWS区域与端点。

Security Considerations

安全注意事项

IAM Least Privilege

IAM最小权限

Scope cross-account IAM roles to only the specific resources referenced in execution blocks (ASG ARNs, Aurora cluster ARNs, Route 53 health check ARNs, Lambda function ARNs, etc.)
Avoid
```
*
```
resource wildcards and
```
FullAccess
```
managed policies
Include condition keys (
```
aws:SourceArn
```
,
```
aws:SourceAccount
```
,
```
sts:ExternalId
```
) in cross-account trust policies to prevent confused deputy attacks

跨账户IAM角色的权限范围仅限执行块中引用的特定资源（ASG ARN、Aurora集群ARN、Route 53健康检查ARN、Lambda函数ARN等）
避免使用
```
*
```
资源通配符和
```
FullAccess
```
托管策略
在跨账户信任策略中包含条件键（
```
aws:SourceArn
```
,
```
aws:SourceAccount
```
,
```
sts:ExternalId
```
）以防止混淆代理攻击

Execution Reports S3 Bucket

执行报告S3存储桶

Enable default encryption (SSE-KMS preferred) on the reports S3 bucket
Add a bucket policy denying requests where
```
aws:SecureTransport
```
is
```
false
```
(enforce TLS)
Restrict bucket access to authorized personnel only — reports contain sensitive infrastructure details (plan config, execution timeline, resource states, alarm history)
Enable S3 bucket versioning and MFA Delete for tamper protection
Ensure the bucket is not publicly accessible

对报告S3存储桶启用默认加密（推荐使用SSE-KMS）
添加存储桶策略，拒绝
```
aws:SecureTransport
```
为
```
false
```
的请求（强制使用TLS）
限制存储桶访问权限至授权人员——报告包含敏感基础设施细节（计划配置、执行时间线、资源状态、告警历史）
启用S3存储桶版本控制和MFA删除以防止篡改
确保存储桶不公开访问

Custom Action Lambda Security

自定义动作Lambda安全

Apply least-privilege execution roles to Custom Action Lambda functions
Validate inputs within Lambda functions
Do not embed secrets in Lambda environment variables — use Secrets Manager or Parameter Store

为自定义动作Lambda函数应用最小权限执行角色
在Lambda函数内验证输入
请勿在Lambda环境变量中嵌入密钥——使用Secrets Manager或Parameter Store

Notification & Event Targets

通知与事件目标

Restrict EventBridge rule targets (SNS topics, Lambda functions, etc.) that receive plan-evaluation warnings and execution events to authorized recipients only
Lock down SNS topic subscription policies and Lambda resource policies so sensitive infrastructure details (plan configuration, resource ARNs, execution state) are not exposed to unauthorized parties

限制接收计划评估警告和执行事件的EventBridge规则目标（SNS主题、Lambda函数等）至授权接收者
锁定SNS主题订阅策略和Lambda资源策略，确保敏感基础设施细节（计划配置、资源ARN、执行状态）不泄露给未授权方

Logging and Monitoring

日志与监控

Enable AWS CloudTrail for auditing all ARC Region switch API calls
Configure CloudWatch alarms for unexpected or unauthorized plan executions
Enable S3 access logging on the execution reports bucket
See Logging and monitoring for Region switch

启用AWS CloudTrail以审计所有ARC Region switch API调用
配置CloudWatch告警以监控意外或未授权的计划执行
在执行报告存储桶上启用S3访问日志
详情请见Region switch的日志与监控

Positioning

客户定位

Customer-facing framing, the Region switch vs Routing Controls comparison, analyst talking points, and per-audience conversation guidance are maintained in Positioning. Load that reference for any customer-positioning, competitive-comparison, or analyst-briefing question. Key rules that always apply:

Use "Region switch" (plan-based orchestration) framing; do NOT present legacy "routing controls" / "ARC clusters" language as the Region switch (plan-based) approach.
Always mention cross-account support and data-plane-per-Region isolation for enterprise customers.

客户话术、Region switch与Routing Controls对比、分析师要点以及针对不同受众的沟通指南均维护在**定位文档**中。涉及客户定位、竞品对比或分析师简报的问题，请加载该参考文档。始终遵循以下核心规则：

使用"Region switch"（基于计划的编排）话术；请勿将传统"routing controls"/"ARC集群"表述作为Region switch（基于计划）方案的内容。
面向企业客户时务必提及跨账户支持和按区域隔离的数据平面特性。

Documentation Links

文档链接

The curated documentation index and the "when to link which doc" guidance live in Documentation Links. Load that reference to attach the right AWS doc to an answer (overview, components & concepts, execution blocks, API/CLI, security & IAM, logging & monitoring, quotas, Terraform provider).

精选文档索引以及"何时链接对应文档"的指南维护在**文档链接**中。加载该参考文档可为答案附加正确的AWS文档（概述、组件与概念、执行块、API/CLI、安全与IAM、日志与监控、配额、Terraform提供商）。

Troubleshooting

故障排除

Customer confuses triggers with health alarms

客户混淆触发器与健康告警

Triggers are CloudWatch alarms that start plan execution. Application health alarms measure when recovery is complete. They serve different purposes and are configured separately.

触发器是启动计划执行的CloudWatch告警。应用健康告警用于衡量恢复完成时间。二者用途不同，需单独配置。

Customer assumes Region switch handles data sync

客户认为Region switch处理数据同步

Clarify: Region switch orchestrates failover of existing replicas (e.g., Aurora Global DB promotion). The customer must set up multi-Region data replication independently.

明确说明：Region switch仅编排现有副本的故障转移（如Aurora全局数据库提升）。客户必须独立设置多区域数据复制。

Cross-account execution fails

跨账户执行失败

Usually missing IAM permissions. Verify: cross-account trust policy includes condition keys (

aws:SourceArn

aws:SourceAccount

sts:ExternalId

), target IAM role ARN is correct, and permissions are scoped to the specific resources in the execution blocks.

通常是缺少IAM权限。验证：跨账户信任策略包含条件键（

aws:SourceArn

aws:SourceAccount

sts:ExternalId

），目标IAM角色ARN正确，权限范围仅限执行块中的特定资源。

Plan evaluation warnings

计划评估警告

Warnings indicate IAM, resource, or capacity issues. Fix the underlying issue — but note that passing evaluation alone isn't sufficient; always test by executing plans.

警告表明存在IAM、资源或容量问题。需修复底层问题——但请注意，仅通过评估并不足够；务必通过执行计划进行测试。

Wrong Regional endpoint used

使用错误的区域端点

When deactivating a Region,

start-plan-execution

MUST be called from the healthy Region. When activating a Region, it MUST be called from the Region being activated. Using the wrong endpoint will fail or produce unexpected behavior. See StartPlanExecution API.

停用区域时，必须从健康区域调用

start-plan-execution

。激活区域时，必须从待激活区域调用。使用错误端点会导致执行失败或产生意外行为。详情请见StartPlanExecution API。